Troubleshoot External hard drive formatted but AV scan shows 3,500 files.

jetman

Level 10
Thread author
Verified
Well-known
Jun 6, 2017
470
Hi-

I bought an old laptop hard-drive from ebay which I am going to use as an external backup drive. I gave it a good wipe using ccleaner and also re-formatted it. However, when I plugged it into my PC, it was scanned by kaspersky and found to be clean- but the scan was of more than 3,500 files.

My question is what are these files and why did they not get wiped when I erased and formatted the drive? My best guess they are some sort of system files on the hard-drive which are needed for it to work. But they don't show up in file manager in Windows. Its not some sort of hidden malware it is ?
 

Atlas147

Level 30
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 28, 2014
1,990
Go to explorer and click the header "View" and check "Hidden files"
See if any other files popped up.

Alternatively you might want to actually format the drive, I'm guessing you did a "quick format". Uncheck that the next time you do a format, although it takes longer it might actually remove the files from the hard drive.
 
Upvote 0

jetman

Level 10
Thread author
Verified
Well-known
Jun 6, 2017
470
I am still perplexed by this problem and have attached some screenshots from my PC in the hope that someone could help me. The disk has been formatted. I just don't understand what the 3,500+ files are that Kaspersky scans, or why 158MB of the disk is used. Thanks.


Capture.PNG



Capture1.PNG



Capture2.PNG


Capture3.PNG
 
Upvote 0

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,150
This is probably a hidden partition on the hard drive that contains necessary drivers etc for the hard drive to function. The user space is presumably empty, but there is a hard-coded system space that you can't erase. That's what I remember, anyways. This hidden partition is where state-sponsored malware wants to write itself, so it will survive all deleting attempts, and can even be shipped from the manufacturer that way.
 
  • Like
Reactions: brambedkar59
Upvote 0

brambedkar59

Level 29
Verified
Top Poster
Well-known
Apr 16, 2017
1,869
I gave it a good wipe using ccleaner and also re-formatted it.
I did a full overwrite of free space using ccleaner and eraser.
Can you select "Entire Drive" instead of only "Free space" in CCleaner while running Drive Wiper.
As @shmu26 said some space is used by the 'Firmware' of Hard drive to keep it running (think of Hard drive as PC and Firmware as it's OS). Even when I scan my completely empty SanDisk USB Flash drive with Zemana it shows 3 scanned files.
 
  • Like
Reactions: shmu26
Upvote 0

AlexCa

From Windows Repair Toolbox
Verified
Developer
Apr 30, 2016
197
Check the detailed report (from the screenshot you posted) to see what are the files. It might be the case that Kaspersky automatically does a quick system scan in addiction to the external drive scan.
 
Upvote 0
5

509322

Hi-

I bought an old laptop hard-drive from ebay which I am going to use as an external backup drive. I gave it a good wipe using ccleaner and also re-formatted it. However, when I plugged it into my PC, it was scanned by kaspersky and found to be clean- but the scan was of more than 3,500 files.

My question is what are these files and why did they not get wiped when I erased and formatted the drive? My best guess they are some sort of system files on the hard-drive which are needed for it to work. But they don't show up in file manager in Windows. Its not some sort of hidden malware it is ?

Here is the answer. Read David Schwarz's reply:

Used space on an "empty," formatted flash drive

It is the same with an NTFS formatted drive.

Access the detailed report at the end of the scan and you will see the "files" that were scanned.
 
Upvote 0

Vasudev

Level 33
Verified
Nov 8, 2014
2,224
Unhide system file in File explorer or windows explorer. Or use Linux LiveCD to delete windows system files like metadata and etc..
 
Upvote 0

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top