There was a time when I had on my hands a USB memory which was supposed to be infected by a virus, and looking at it I realized that this malware had been erased many folders and files, but I first tried to see if they were only hidden. Let's suppose that this was the USB file structure, with no virus. Once the virus infected the USB, the situation changed into this. As you can see, there was no files inside, but going to the folder properties we could look at the line that it actually had 1 file and 1 directory. Once the virus infected the USB, the situation changed into this. As you can see, there was no files inside, but going to the folder properties we could look at the image that it actually had 1 file and 1 directory. The next thing I did was to show all hidden files but it didn't work, so I disabled the "Hide protected operating system files (recommended)" option , having as result this. Therefore, the virus hadn't erased them, but only hidden them, ...