Tech Support Guy banner

Sudden drive permissions issue causing missing files and folders

1.9K views 8 replies 2 participants last post by  PeterOz  
#1 ·
On Win11 after doing a windows update (1 security update installed) I restarted my computer to find my main external storage drive was not accessible and the icon was a white sheet of paper instead of the drive icon.
  • I could not eject it at first - it said it was in use by something.
  • After disabling/enabling the drive and restarting I was able to eject and power cycle the drive. - same result.
  • I noticed the permissions were weird - they were all blank and the owner was unknown. I changed the permissions to be the same as my other drives (owner: SYSTEM with full access for admin. added users, added everyone. It scanned all the files and gave me a few errors: like "Failed to enumerate objects in the container. Access is denied" D\found.000\30000000-$boot, D\found.000\310000000-(foldername), d\found.000\340000000file.chk..etc...
  • after the permissions change I could open the drive but I can only see a few files and folders - almost everything is gone even though it says most of the drive is full. All the files that were within the folders that could not be enumerated in the previous step are not visible or accessible.
  • I tried system restore from a week ago and it did not fix it.
  • chkdsk finds no errors.
  • I checked system event viewer and I see at the exact same time that the windows update finished
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.389.2544.0)
that two errors popped up from Ntfs (microsoft-windows-ntfs) and ntfs(ntfs), respectively:
Volume D: (\Device\HarddiskVolume14) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.
and
A corruption was discovered in the file system structure on volume D:. The Master File Table (MFT) contains a corrupted file record. The file reference number is 0xb00000000000b. The name of the file is "<unable to determine file name>".
both chkdsk and repair volume say no errors...but also only take ~10 seconds when its an 8tb drive.
cyrstaldiskinfo says the drive is in good health.
Explorer shows 1.5tb free of 8tb but windows only shows about 1.2tb of actual files.

Any tips to get proper access back so I can see and use these files again?
 
#4 ·
When I run chkdsk it says:
7630867 MB total disk space.
6378467 MB in 94646 files.
28816 KB in 4308 indexes.
0 KB in bad sectors.
418195 KB in use by the system.
65536 KB occupied by the log file.
1282011516 KB available on disk.

so chkdsk is even seeing that 6tb+ of used space and files.
 
#5 ·
So clearly there was some kind of corruption but for what ever reason chkdsk won't acknowledge it now. There is no mention of mtf corruption now. The data is still on the drive and is found by both chkdsk and the permissions scan. BUT I can't access or view it. What kind of recovery software would I be looking for to help with this? Most software I find like GetDataback does scans for "deleted" files or for missing partitions. It doesn't seem this fits the case for recovering deleted files, since chkdsk and permissions scan sees the files, or for a drive that won't mount or is missing it's drive letter since the drive is mounted and shows healthy without having done any formatting or partitioning.
 
#7 ·
Do you have any data you need to get off this computer? If yes then make a ubuntu bootable usb or dvd
https://ubuntu.com/tutorials/create-a-usb-stick-on-windows#1-overview NO install needed
Or here is a Youtube on how to make the usb

Copy your data to an external drive or another computer/nas.
Insert the usb or cd/dvd and boot your system. You may have to change bios settings to boot from the usb or cd/dvd(every computer is different) We can help with this.
If you are copying to another usb drive plug it in before booting.
When the computer boots choose TRY UBUNTU and let the system boot.
When booted look on the left-hand side of the screen and click on Files icon
Image


Then click on Other Locations
Image


Click on your drive for example Win 7
Image

Click on Users Icon
Click on your name listed under users

You should now see your data e.g Documents Pictures etc.
Copy your data to an external drive or another computer/nas.
When finished Click on the shutdown icon in the top right-hand corner Click on Power Off
 
#8 ·
Do you have any data you need to get off this computer? If yes then make a ubuntu bootable usb or dvd
https://ubuntu.com/tutorials/create-a-usb-stick-on-windows#1-overview NO install needed
Or here is a Youtube on how to make the usb

Hi Peter,
Thanks for the response. this is probably one of the more useful responses to this issue.
I think I've actually figured out the resolve and your post is one of the options that would help!

basically it seems running data recovery software was not necessary in my situation - although it gave me a clearer understanding of what was going on. It showed the found.000 folder that would not enumerate was actually "existing" not "lost" or "deleted" which helped to clarify without a doubt the files were still on the drive (no need to recover files that are not actually lost). I used Easus data recovery to do a scan and check this and then was able to go through the folders to see what was what.

For anyone else running into the issue where you can't get permissions/access the found.000 folder and your drive/partition has not been completely corrupt or been deleted:

The folder is not a general hidden folder. It is an OS system folder that is hidden. You can access it by disabling the "hide protected operating system file and folders' in addition to the show hidden files and folders option in explorer.
If you're still having issues accessing the folder you should definitely do what @PeterOz said in that last post and boot the drive in a linux environment where the windows permissions should be ignored.

Furthermore - the files in the found.000 folder may be a mix bag of corrupt, completely fine or just mislabeled files.
In my case 99% of the files were fine but all jumbled around into mislabeled folders within the found.000 dir folders.

Having a mirrored backup would obviously save a lot of trouble here but if you're lucky and the disk/partition is fine and the files are not just jumbled around you can probably just copy back all the files you need to their "correct" folders without having to move files to/from the drive and then sync the rest with your backups.
...odds are something went wrong with the drive to cause this issue in the first place so at the very least it is a good idea copy the files to a different drive so you can format the drive before putting everything back.