File folders turn into exec files

Polushenie wrote:

A) how to recover these files for my Mac

The easiest answer would be if you had a backup of those files. If you don't, remember, any file that you don't have a backup of, regardless of where it's stored, is a file that WILL be lost eventually. It's just a matter of when.

Kurt's right on track regarding recovering them from the drive. That may be possible, depending on what malware caused the problem. The originals may just be in a hidden folder on that drive, or they may have been encrypted to prevent you from recovering them. Which is the case, we can't say.

C) what corrupted the files

That one's easy, this was the work of Windows malware. There's malware out there that is known to replace all the files on an external drive with .lnk files. Usually, the purpose is to spread the malware (when you connect the drive to another Windows machine and open one of the files, boom... that machine is infected too), though it could also be for the purpose of ransom. Any Windows computers you have connected that drive to may be infected. Fortunately, your Mac is not susceptible to this malware.

Thanks for the info thomas_r and Kurt Lang.

I tried Kurt's commands on my Mac and the 'true' command showed me all the real files and folders grayed out, as well as showing all the .Ink files as clickable. Once I did the 'false' command, the grayed out files disappeared again and only .Ink files remained.

I guess this means the real files are not recoverable?

No, you can recover them. They're still on the flash drive, just hidden.

The first command above simply makes all files in OS X visible, including those with a hidden attribute. The 'false' command tells the OS to behave normally again and not allow you to see files and folders you aren't supposed to. Many users have found various methods to show all files in OS X, and then proceed to destroy their systems by deleting everything they don't recognize and have convinced themselves shouldn't be there.

Plug the flash drive in so it appears on the desktop. Go to the /Applications/Utilities/ folder and launch Terminal. Enter this string:

chflags nohidden *

Do not press enter yet. Put a space after the asterisk, then drag and drop the icon of the flash drive from the desktop into the Terminal window. It will fill in the path name. Now press enter. All files on the drive should now be visible and you can copy your data to your desktop or other location.

Kurt Lang wrote:

chflags nohidden *

Do not press enter yet. Put a space after the asterisk, then drag and drop the icon of the flash drive from the desktop into the Terminal window. It will fill in the path name. Now press enter. All files on the drive should now be visible and you can copy your data to your desktop or other location.

Kurt, shouldn't the command be …

chflags nohidden /Volumes/[name-of-disk]/*

If you do as you describe the wildcard is before /Volumes, so won't that start at the current working directory & then fail to find the dropped file path ( /Volumes/[name-of-disk]/ )?

Hi Drew,

I was testing this ad nauseum before posting. What you note is what I tried in testing many times and in many variations. Most that I knew should work with that type of argument would simply return to the next prompt in Terminal as if it were correct, but nothing would change on the drive.

I finally resorted to the "simple" method of entering the drive volume by drag and drop and it worked.

Voice to whom? Apple is not here. Hi-jacking a post, for a different issue, or attempting emphasis with a “me too” post — just in case we need to be reminded again, makes us less efficient, and takes more of our time to consume and filter. It slows the real help that is needed by the owner of the original post.

As you can see, there are others that have hi-jacked this post with their own issues, and should have started a new main post.

We want you to post questions, and contribute to an ongoing post if you can add value to the solution. I would not recommend you unsubscribe to this community, just submit a new post when the time is right for you. Someone will respond with the goal of helping you in your particular solution need.

Thanks Kurt.

I actually found and downloaded this software, UsbFix , on one of the sites you listed earlier. It finds and deletes the virus on all infected portable devices. It worked and all my files are restored! 🙂

Excellent! Yes, it was necessary to get rid of the virus since it would otherwise keep moving between the hard drive and all drives you connect to the Windows computer. Part of the UsbFix software must be to also remove the hidden attribute of all files on the drive. Otherwise, the virus would be gone, but the files would still be hidden.

I don't want to hijack the thread, just to join to say I'm getting the same thing, especially with mkv files. Here's a screenshot from my Macbook on Yosemite:

Here's the screenshot of that file.. Please help.. its important.. Thanks

Please help.. Very important data.. Same problem... folders have become exec files. Here's the screenshot. Thanks.

Please help!

That is not a folder, it's just a file that your system doesn't know how to identify. Your situation is not the same. You'll need to start your own topic.

It is far more then possible. It is very likely that there are no virus files on the thumb drive.