If Windows reports used space on a USB drive but File Explorer shows few or no files, the contents may be hidden, protected as system items, located inside an unexpected folder, unavailable because of filesystem damage, or already deleted. Do not assume that every case is a shortcut virus.
Start with read-only observations
- Stop copying new files to the drive. New writes can overwrite recoverable deleted data.
- In File Explorer, note the drive letter, capacity, used space, free space, and filesystem.
- Enable View → Show → Hidden items. Do not yet change attributes across the entire drive.
- Run a Microsoft Defender custom scan on the removable drive.
- Look for unexpected
.LNK, script, executable, orautorun.inffiles without opening them.
Four different explanations
1. Files are hidden or marked as system items
This is common in shortcut-virus incidents, but it can also be caused by manual settings or software. If the folders become visible after showing hidden items, confirm their names and contents, scan first, and only then consider clearing attributes. The attrib command changes metadata; it does not remove a threat.
2. File Explorer is not showing the location you expect
Files may have been moved into a hidden folder, a folder with a similar name, or a recovery directory created after filesystem repair. Search from the drive root by known filenames or extensions. Do not open unfamiliar shortcut results just because their icons resemble folders.
3. The filesystem is damaged
Unexpected disconnects, failing flash storage, unsafe removal, or controller faults can damage directory information. Repeated prompts to repair or format the drive, extremely slow reads, I/O errors, or changing capacity readings point toward a storage problem rather than a shortcut-only problem.
If the files are important, create an image or consult a data-recovery professional before running repair tools that write to the disk. A filesystem repair can make the volume usable while reducing the chance of recovering some deleted data.
4. Files were deleted but their space has not been reused
Deleted directory entries can sometimes be recovered until new data overwrites their clusters. Hidden-item settings and attrib cannot restore deleted files. Avoid formatting and avoid installing recovery software onto the affected drive.
| Signal | More consistent with | Safer next step |
|---|---|---|
| Folders appear when Hidden items is enabled | Hidden attributes | Scan, inspect unexpected files, then repair attributes if appropriate |
| Used space is high but directory search finds nothing | Protected items, corruption, or deleted data | Minimize writes and decide whether data recovery is required |
| Folder-looking .LNK files are present | Possible deceptive shortcuts | Inspect the target and arguments without opening them |
| Capacity or filenames change between connections | Storage or filesystem instability | Stop normal use and preserve an image if the data matters |
Inspect shortcuts without opening them
Use Windows Properties or the local .LNK File Safety Checker. A shortcut that launches a normal document or program can be legitimate. A folder icon combined with a script interpreter, encoded command, or remote path deserves investigation.
Frequently asked questions
Does used space prove my files are still recoverable?
No. It is a useful signal, but filesystem overhead, hidden system data, corruption, and allocated deleted data can also consume space.
Should I run CHKDSK immediately?
Not when irreplaceable files may need recovery. CHKDSK changes filesystem structures. Preserve an image or consult a specialist first.
Will showing hidden items remove a shortcut virus?
No. It changes what File Explorer displays. Scan and address the active cause separately.