Windows 10: Sudden massive data and program loss

I turned on my computer this morning and most of my programs and data on my hard drive are gone. Some data is still present. The hard drive troubleshooting program states it is working fine. I did receive an "Incorrect Function" message. I repaired and reset Cortana and the message went away, but the data is still gone. How does this happen? What can I do? Thanks.Edition Windows 10 Pro Version 22H2 Installed on ‎3/‎8/‎2021 OS build 19045.3086 Serial number R90QHJYZ Experience Windows Feature Experience Pack 1000.19041.1000.0 Device name LAPTOP-74UH2ISD Processor IntelR CoreTM i7-750

:)

 

Sudden massive data and program loss

I turned on my computer this morning and most of my programs and data on my hard drive are gone. Some data is still present. The hard drive troubleshooting program states it is working fine. I did receive an "Incorrect Function" message. I repaired and reset Cortana and the message went away, but the data is still gone. How does this happen? What can I do? Thanks.

Edition Windows 10 Pro

Version 22H2

Installed on ‎3/‎8/‎2021

OS build 19045.3086

Serial number R90QHJYZ

Experience Windows Feature Experience Pack 1000.19041.1000.0

Device name LAPTOP-74UH2ISD

Processor Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz 2.90 GHz

Installed RAM 16.0 GB (15.9 GB usable)

Device ID 227D1645-CA4A-4BD3-B9ED-C568B636AC80

Product ID 00330-51040-66949-AAOEM

System type 64-bit operating system, x64-based processor

Pen and touch Pen and touch support with 10 touch points

 

Sudden massive data and program loss

David - Thank you for the response. I tried system restore to be 3 days ago (before the problem), and no improvement or change. Still missing almost all programs, photos, and data. Some random files are still there with personal names, so not all is gone. I have a 500GB SSD and it had about 420GB daye on it. It now states it has 66GB on it.

 

Sudden massive data and program loss

Hello Michael,

If it had that much data free on it, a system restore did nothing, and now it says that it has very little space left, then there are only a few [possibilities. We want to save as little to the hard drive as possible so as to avoid overwriting a deleted file that might still be recoverable.

First, check for malware. This could be ransomware gone wrong, for example.

1. Run Microsoft Defender offline: https://support.microsoft.com/en-us/windows/hel...

2. Download and run the Microsoft Emergency Response Tool: https://learn.microsoft.com/en-us/microsoft-365...

3. If these find nothing, or they find something and your files are not available after they have run, download and run a respected third-party antimalware or antivirus tool. I cannot officially recommend one, but there are a number out there that have solid free versions that can do on-demand scanning. Some examples are Malwarebytes, Avast, McAfee, Symantec, and others. Note that I can not make recommendations and that I cannot be responsible for whatever any of these tools do.

Do this as soon as you can, as this may be a ransomware scenario, and you do not want the ransomware to start up again and finish the job.

If these find nothing, then we should check out the disk itself.

1. Click Start and type "disk manager'. Open "Create and format hard disk partitions". Be careful. Without knowing what went wrong any changes made here could result in data loss.

2. Check for the partition that had the data on it. Most likely this is drive 0, partition (C:\). Whatever you do do not make any changes here.

3. Whichever disk has your boot drive (likely C:\) on it will have four partitions, the boot drive, and three much smaller partitions. Check out the boot partition.

Look for oddities. Is the C:\ oddly shrunk? In the upper section, how much space does it say that it should have, and how much is used? Are there additional partitions or very large sections of unused space?

You have three likely scenarios.

1. The drive appears to be the right size but overly full. This implies that the files are still there and are not deleted per se, but may have been duplicasted. It may imply a ransomware attack (the attacker created a virtual encrypted hard drive and moved all of your stuff into it), or it may be something else truly unusual.

2. The drive is small, and there are now large areas of your drive that are either free space or unallocated. Something has messed up your partition table.

3. The drive is small, and there is another large drive visible. Something has deliberately shrunk your drive and created a new drive on the disk. Most likely this is a case of ransomware and the new drive has all of your data.

I hope this helps! Please let me know if this helps.

Regards,

David N.

Community Independent Advisor