$RECYCLE.BIN::
When you delete files, it goes from Your Files to the Recycle Bin, obviously. You know that part. But when you delete the files in your Recycle Bin, they don't disappear; instead, they are 'sent' to the $Recycle.Bin Folder.
When the file is "deleted" by emptying the Recycle Bin, the space on the disk used by the file is designated as "free" without any changes being made to the file data itself. Future files will overwrite the data when they are saved on the disk.
Other words, When the file is "deleted" by emptying the Recycle Bin, the space on the disk used by the file is designated as "free" without any changes being made to the file data itself. Future files will overwrite the data when they are saved on the disk. In other words, the data is not erased, but the address marking the data's existence is.You cannot delete the $Recycle.Bin Folder; it is built in and will always reappear when you delete it.
The actual location of the Recycle Bin depends on the type of operating system and file system. On older FAT file systems (typically Windows 98 and prior), it is located in Drive:\RECYCLED. In the NTFS filesystem (Windows 2000, XP, NT) it is Drive:\RECYCLER. On Windows Vista and Windows 7 it is Drive:\$Recycle.Bin folder.[1]
How to remove $RECYCLE.BIN folder from removable drive ?
To remove the virus
1. Open Run
2. Open CMD
3. Terminate explorer.exe process in task manager.
3. Navigate to pendrive and use "del autorun.inf" command. If it says "Can't find autorun.inf" type "attrib -h -r -s" and repeat the command.
4. Navigate to C:/ Documents and Settings/ Your username directory and type "attrib -h -r -s"
5. Type "del csrss.exe". If it says "access is denied" terminate every process running under your username and repeat the command.
6. Restore explorer by typing "start explorer", go to the pendrive and delete the recycle bin folder.
To prevent pendrive viruses in the future, download a free program called "Autorun Eater" from http://oldmcdonald.wordpress.com/
Youtube : http://www.youtube.com/watch?v=vdVhxpkmX4Y
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Alternatively you can disable the AUTORUN feature:
1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following entry in the registry:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutorun
3. Right-click NoDriveTypeAutoRun, and then click Modify.
4. In the Value data box, type 0xFF to disable all types of drives. Or, to selectively disable specific drives, use a different value as described in the "How to selectively disable specific Autorun features" section.
5. Click OK, and then exit Registry Editor.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
================================================================================
found.000
These found.000, found.001 ..etc folders are system hidden folders that are made hidden by default by the Operating System.
These folders are created automatically when we run the chkdsk scan or possibly another disk checking utility. When errors are found such as lost clusters on your drive, Windows will fix the errors but depending on whether or not you have chosen to convert lost clusters or chains to file, windows will create these folders sequentially starting with .000. So you may have several of them.The folders contain files with names File0000.chk, File 0001.chk and so on. These file are created to save any lost data during the chkdsk fix.But usually these files are of no use and you can delete them at your will.
The reference to the FOUND.XXX folder is the results of Windows 2000 or Windows XP (not used in Windows 98) finding a problem in the operating system and placing random segments of unallocated data that it finds into those folders.The folders reside on the “root” of your primary hard drive (usually the C: drive) and are hidden. There are a number of ways to see if you have built up FOUND folders, but my preference is to use the command line.
Sometimes, When you don't make a habit of shutting your pc without closing windows properly. When you do that file pointers are not properly written and you end up with orphan files which the bootup disk checking utility finds but doesn't know what they are or their real filename extension so it puts .chk. Probably if you rename the large one to avi or mpg you will find that's it's one of those videos your friend brought over. Nothing "virus or trojan" about it. Just don't shut the power to the pc until windows says it's safe to do so and you should rarely if ever see any lost files.
How to remove "found.000" folder from removable drive ?
Go to the folder location and use below command for removal of folder.
rd found.000 /s
awsome piece of information, I had come to know about your website from my friend vinod, indore,i have read atleast seven posts of yours by now, and let me tell you, your blog gives the best and the most interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts, once again hats off to you! Thanks a ton once again, Regards, Deleted Data From Pendrive Why Not Goes Into Recycle Bin
ReplyDeleteThe FOUND.000 folder which came to my memory stick got all my files and documents into itself and if I remove it all my data will remove and I lose my data, what to do to have a copy of my data and delete the FOUND.000 folder
ReplyDelete