If malware hid your documents, the goal is to restore visibility without running suspicious shortcuts or destroying the original data.
Confirm that the data still exists
Review used space on the drive and inspect hidden items without opening unknown shortcuts. If the files are physically present, recovery may involve restoring attributes after the root cause is neutralized.
Do not restore before treating the infection
If the malicious process is still active, changing attributes can have only a temporary effect. Diagnose Windows and the external drive first.
Protect important data
Whenever possible, make a backup of legitimate files to a trusted destination after confirming that you are not copying malicious executables or shortcuts together with your documents.
Restore and verify
After remediation, restore visibility of legitimate items when applicable and run a fresh scan. Open known documents first and avoid unexpected executables that appeared during the infection.
Visibility recovery is not a substitute for backup. If the drive shows signs of physical failure, prioritize data recovery and avoid unnecessary writes.
Scan first. Decide after.
ANTÍDOTO shows the detected indicators before remediation.