Most of my data disappeared after restarting. Windows 10 corruption or ransomware?

O

oceanboy

Extraordinary Member
Joined
Jan 27, 2012
Messages
12
Hi...





I've tried many things offered by the net and AI but to no avail. I've been at it for well over 5 hours so I'm not one of those peeps asking for help before trying a gazillion things!



Basically I went to restart my machine and it offered me an option to restart or restart with updates that were pending. I was in a hurry (Imagine that) and selected just the restart When it came back up, my desktop was much different, data was missing and some of the folders were still present even though they were empty


After running an elevated Command Prompt, using "vssadmin list shadows" I was able to get some information and had a recommendation to download ShadowExplorer which I did. I was happy to find all my data but when I exported it to an external drive, most of it was corrupted and not readable. Thank god I was working from a clone of my original drive! WHEW!


At this point I've exhausted all the options that I can muster up!


Any thoughts?


Thank you!
 
Solution
Thanks for sharing the details—sounds like a truly stressful situation! You’ve clearly done your homework, so let’s see if we can dig a bit deeper.
Some key points and next steps:

What’s Happening:​

  • Your desktop layout changed, lots of data disappeared, and many folders are now empty.
  • Shadow copies (using ShadowExplorer) let you see data, but most of the exported files are corrupted.
  • Thankfully, you’re operating from a cloned drive, so we’ve got a “safety net.”

Classic Causes:​

  1. Profile Corruption or Temporary Profile Loaded
    Sometimes, after an update or a failed login, Windows may load you into a temporary user profile. This can look like your data has disappeared, but it's just referenced from a...
Sort by date Sort by votes
Thanks for sharing the details—sounds like a truly stressful situation! You’ve clearly done your homework, so let’s see if we can dig a bit deeper.
Some key points and next steps:

What’s Happening:​

  • Your desktop layout changed, lots of data disappeared, and many folders are now empty.
  • Shadow copies (using ShadowExplorer) let you see data, but most of the exported files are corrupted.
  • Thankfully, you’re operating from a cloned drive, so we’ve got a “safety net.”

Classic Causes:​

  1. Profile Corruption or Temporary Profile Loaded
    Sometimes, after an update or a failed login, Windows may load you into a temporary user profile. This can look like your data has disappeared, but it's just referenced from a different user directory (e.g., C:\Users\TEMP instead of your usual profile).
    • Check if you’re in a temp profile (you may see a notification, or your folder under C:\Users is not your regular username).
    • If so, logging out and back in—or a reboot—sometimes resolves it.
  2. Actual Data Loss from File System Corruption/Ransomware
    • Since you don’t mention ransom notes or encryption extensions, ransomware seems less likely.
    • If only select data is missing, these are often side effects from abrupt shutdowns, failed updates, or file system errors.
  3. Location Mismatch / Folder Redirection
    • Make sure “Desktop” and other folders haven’t been redirected (look in Properties > Location tab for Desktop/Documents/etc.).

Next Steps:​

1. Check User Profile​

  • Go to C:\Users\ and compare the contents of each profile folder.
  • Is your original data in another folder?

2. Run System File Checker & Check Disk​

Open an elevated Command Prompt and run:
Code: 
sfc /scannow
chkdsk C: /f
Check for and repair system file and disk errors.

3. Check for Orphaned Files​

Windows may move files to C:\Windows.old or other “recovery” folders after updates.

4. Shadow Copy Recap​

  • Unfortunately, if exported shadow files are corrupted, the underlying shadow itself may be damaged.
  • If you have multiple shadow versions, try a different restore point with ShadowExplorer.

5. Data Recovery Tools​

Since you’re working from a clone (good call!), you can safely run data recovery utilities without risking your original drive. Try these:
  • Recuva (Piriform)
  • R-Studio or UFS Explorer (very advanced but not free)
  • PhotoRec/TestDisk (free, text-based, excellent for deep recovery)

6. Event Viewer/Audit Logs​

  • Check Windows Event Viewer (System/Application logs) for errors or warnings around the time of your restart. Look for profile, disk, or corruption issues.
If you want to get super-savvy and upload any logs, screenshots, or system reports (e.g., exported Event Logs or the results of above commands), I can help you analyze them directly.
Finally—since you have a clone—do all recovery attempts on the copy! Don’t touch the original.
If you let me know:
  • Whether you see any temp user warnings
  • If there are extra user folders under C:\Users
  • If sfc/chkdsk report errors
    … I can help tailor the next steps further. Hang in there, you’re handling this better than 90% of folks would!
 
Upvote 0 Downvote
Solution
You must log in or register to reply here.