← All posts

USB Folders Turned Into Shortcuts: Where Your Files Went and How to Get Them Back

September 9, 2026 · DiskRescue Blog

You plug in the USB stick and everything is still there by name — Photos, Work, 2025 Invoices — except each one now carries a small arrow in the corner and the Type column reads "Shortcut." Double-clicking one opens nothing, or flashes a window shut, or complains that the target has moved. Meanwhile the drive's properties still report gigabytes in use. Whatever is filling that space, it is not the handful of 2 KB files on screen.

Quick answer: In almost every case your folders are still on the stick, with the Hidden and System attributes set on them. Turn on hidden items and uncheck "Hide protected operating system files" — both, not just the first — then copy everything off to another drive before you change anything on the stick. Clean the PC as well as the drive, or the shortcuts come straight back. Anything genuinely missing after that needs a read-only scan, which the DiskRescue trial runs before you pay anything.

What those shortcuts actually are

Switch File Explorer to Details view and look at the Size column. Real folders show nothing there. Each of these shows 1–3 KB, because each one is a .lnk file — a Windows shortcut wearing your folder's name.

Right-click one, open Properties, and read the Target box on the Shortcut tab. Instead of a path you will find a long command line, usually calling cmd.exe /c or wscript.exe, pointing at a script somewhere on the drive, and ending with something that opens the real folder in Explorer. That last part is the whole trick. The shortcut does what you expected — your folder opens — while quietly starting something else first. People click them for weeks without suspecting anything, and every machine the stick touches gets a copy.

In the ordinary version of this, your folders never left the stick. They were given two file attributes: Hidden and System. Windows treats anything marked System as part of the operating system and keeps it out of sight under a separate setting from ordinary hidden files, which is why switching on "Hidden items" alone often shows nothing and convinces people the data is gone.

The shortcuts are rarely the only thing added, either. Worm families that spread this way drop their own component files onto the drive for the shortcuts to launch, so once everything is revealed you may find items you never put there sitting between your own folders. Open anything unfamiliar before you delete it and check that it is not holding your data.

One myth worth retiring: the autorun.inf sitting next to the shortcuts is almost certainly not how you got infected. Windows 7 stopped supporting AutoRun for non-optical removable media, and Microsoft pushed the same change out to XP and Vista as update 971029 in February 2011. On anything that recent, plugging the stick in did not start this. Something was opened.

Two settings, not one

In File Explorer, open the View menu and switch on Hidden items. Then go further: Options → View tab, and clear the checkbox for Hide protected operating system files (Recommended). Windows will ask whether you really mean it. You do.

Now reopen the drive. If your folders reappear with faded, washed-out icons, the data loss part is over — everything is intact and the rest is cleanup.

If you would rather not touch Explorer's settings at all, the same question answers itself at a command prompt. dir X:\ /a lists every entry on the drive whatever its attributes, hidden and system included, and folder names in that listing mean exactly what faded icons mean in Explorer.

That copy off the stick comes before the cleanup, not after it. An antivirus sweep can quarantine files it decides are suspicious, and every attribute change is a write to the stick. Drag with the right mouse button and choose Copy here, so nothing is moved off the source.

If the folders do not reappear, skip ahead. You are dealing with deletion rather than concealment.

Copy first, disinfect second

With your data safely duplicated, put the attributes back to normal. Open Command Prompt as administrator and run this against the stick's letter only — never against C::

attrib -h -s -r /s /d X:\*

-h -s -r clears the Hidden, System and Read-only attributes; /s applies the command to matching files in the current directory and all of its subdirectories; /d applies it to directories as well, rather than only to the files inside them. It unhides the malware's own files too, which is convenient, because deleting them is next: every .lnk, the autorun.inf, and any loose script or executable you did not put there — especially one wearing a folder icon.

Then scan the computer, not just the drive. These worms typically live in the user profile with a startup entry that reloads them at logon, and a resident copy can re-hide the stick seconds after the next plug-in. If your shortcuts return after a clean sweep, the PC is the source and the stick is only the victim.

Two things to avoid here. Do not reach for chkdsk /f — nothing is wrong with the file system in this scenario, and chkdsk writes to the disk, dumping orphaned clusters into a FOUND.000 folder as .CHK files with no names and no structure. Skip the ad-supported "shortcut fixer" downloads too, a poor place to go looking while your machine is infected.

Reformat the stick if you like, but only after the copy on your other drive has been opened and verified.

When the folders really are gone

Sometimes the used-space figure has dropped, the reveal turns up empty, or somebody already hit Format in a panic. That figure is worth reading closely before anything else: space still accounted for points at data that is present but concealed, while a drive reporting almost nothing in use points at deletion. From there, the file system on the stick decides what is realistic.

Flash drives are usually FAT32 or exFAT rather than NTFS, and deletion works differently on each. NTFS keeps a record per file in the master file table, so undelete there can return files with their original names and folder paths. FAT32 marks a deleted entry by overwriting the first character of its name and releasing the cluster chain that maps the file's pieces — the entry keeps the starting cluster and the size, so a file stored in one continuous run can come back cleanly, while a fragmented one has lost its map. exFAT behaves much the same unless the file was contiguous.

Signature carving therefore carries most of the weight on a USB stick. It ignores the file system, reads raw sectors, and rebuilds files by recognizing their headers — JPEG, MP4, PDF, DOCX and the rest. You get the contents back, not the original filename or the folder it lived in. For a camera roll that is usually enough. For a folder tree of documents you knew by name, it is a real loss, and better understood now than after the scan finishes.

One point is generally in your favor. A stick attached over the plain USB mass-storage protocol does not get TRIM passed through to it the way an internal SSD does, so deleted data is not routinely cleared in the background. In most cases it sits where it was until something writes over it — which is the whole argument for putting the stick down now. No new files, no format, and never install recovery software onto the drive you are recovering.

That is also as far as any honest promise reaches. Flash controllers manage their own blocks without reporting to the host, so nobody can tell you from the outside what is still intact down there. Whether a specific file survives comes down to overwriting, and nobody can tell you the answer before a scan has run.

Hardware is the exception. A stick that does not enumerate at all, shows 0 bytes, or reports a generic controller name has most likely failed at the controller, and the data sits on NAND chips the host can no longer reach — a lab job, not something you can install your way out of.

Walk through it on the free trial

The trial is worth running before you decide anything, because it shows you the answer instead of promising one.

1. Install it on the PC, not on the stick.
2. Select the drive and run a read-only scan. DiskRescue never writes to the source disk, so a scan adds nothing to the stick, and an interrupted overnight scan resumes with the same settings instead of starting over.
3. If the stick stalls or drops out mid-scan, use Recover safely instead. Step one images the whole disk to an .img on a healthy drive; step two recovers from that image, so the failing stick is read once rather than worked over repeatedly, which puts less strain on it. The image needs as much free space as the disk it is copying.
4. Preview before deciding. The scan reports what it finds as it goes, with running counts of the photos, documents and videos it has turned up, and you can open files to confirm they are the right ones.
5. Restore up to 20 files free, any file size, with no sign-up and no social share, and send them to a drive other than the one being scanned.

Carved output tends to arrive with duplicates, since the same photo can sit in more than one place on a drive; DiskRescue's duplicate cleaner compares contents and moves the extras to the Recycle Bin — ten of them on the trial, the rest once you register. And when you eventually pass the stick on, secure erase overwrites the free space, though on flash memory the controller remaps blocks behind the scenes, so no overwrite pass can be called absolute.

The 2 KB shortcuts were never your files. The gigabytes Windows still counts as used are.

How DiskRescue Compares

On a lifetime license, DiskRescue costs about 1/5 what the big-name recovery suites below charge — paid once and used for life, with no auto-renewal.

Prices, features, and free-tier limits checked on each official site (Windows editions) on July 14, 2026 — they may change with sales or updates. The price comparison uses DiskRescue's launch price ($29.99). EaseUS free recovery is 500 MB by default, expanding to 2 GB after a social-media share (kb.easeus.com); Disk Drill's official free limit is 100 MB (cleverfiles.com).

Further reading

• Deleted Files on an SSD: What TRIM Changes, and What It Doesn't
• "The Disk Is Write Protected" on Windows: Clear the Flag Without Losing Data
• Recover Files After a Windows Crash Without Making It Worse