What are hidden drives?
A hidden drive is a disk partition or section of a storage device that has been intentionally concealed and restricted from normal access. There are several reasons why drives may be hidden:
Definition of hidden drives:
- Hidden partitions – Partitions that do not appear in Windows File Explorer or Disk Management, but physically exist on the hard drive.
- System reserved partitions – Special partitions created by Windows for system files and bootloaders. They are not assigned drive letters.
- Recovery partitions -Partitions for recovery software and files. Not normally visible to users.
- Backup partitions – Sections reserved for backups that are inaccessible during normal use.
Reasons drives may be hidden:
- To conceal private or sensitive data from unauthorized access.
- To preserve backup data or system recovery files.
- By malware trying to hide malicious programs and processes.
Ways drives can be hidden:
- Having no drive letter assigned in Disk Management.
- Marked as “hidden” in diskpart using the command “attributes disk set hidden”.
- Unmounted or detached from the filesystem so they cannot be accessed.
- Filesystem not recognized by the operating system.
- Only mounted when certain programs are activated.
Checking for Hidden Partitions
One way to check for hidden partitions on your hard drive is to use the Disk Management utility in Windows. This allows you to view all partitions, including any that may be hidden.
To open Disk Management, press Windows Key + R to open the Run dialog box. Type “diskmgmt.msc” and press Enter. This will open the Disk Management console.
In Disk Management, you can view all disk partitions. Look for any partitions listed as “Healthy (Hidden)” or that have unfamiliar labels or sizes. These may be hidden partitions.
You can also look for disk sections labeled as “Unallocated.” This often indicates hidden or deleted partitions. Right click on unallocated space and choose “Change Drive Letter and Paths” to try exposing any hidden partitions.
Keep in mind that some computer manufacturers create hidden partitions for system recovery or backup purposes, so not all hidden partitions are suspicious. But checking Disk Management is a good way to view all partitions and look for any unknown ones that could be deliberately hidden (source).
Enabling hidden drives
Hidden drives can be shown and made accessible again by changing some partition attributes. Here’s how to unhide hidden partitions in Windows:
Open Disk Management by pressing Windows Key + R, typing “diskmgmt.msc” and hitting Enter. Right-click on the partition you want to unhide and select “Change Drive Letter and Paths…”. Then click “Add” and assign a drive letter so the partition gets a drive path again.
You can also use the command line to unhide partitions. Open Command Prompt as admin and run the command “diskpart”. Then enter “list volume” to show all volumes. Select the hidden volume by entering “select volume X” (where X is the volume number). Finally enter “attributes volume clear hidden” to remove the hidden attribute and make the partition visible again (Source).
Third party tools like EaseUS Partition Manager have options to unhide partitions as well. Just right-click on the hidden partition, choose “Advanced” then select “Unhide” (Source).
By modifying partition attributes, it’s possible to access and view hidden drives again in Windows.
Checking the registry
The Windows registry contains several keys related to mounted and hidden drives that can provide useful information. Some important registry keys to check include:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices – This key contains subkeys for each drive letter that has a mounted volume. Each subkey contains data like the volume name, serial number, and mount point.[1]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR – This key contains info about USB mass storage devices connected to the system.[2]
To reveal hidden drives, you may need to modify the “Hidden” DWORD value within MountedDevices subkeys. Setting it to 0 instead of 1 will unhide the drive.[1] Be very careful when editing the registry to avoid damaging your system.
Third-party tools like Registry Viewer can make it easier to navigate to and modify the relevant registry keys related to mounted devices.
Using the command prompt
The command prompt provides several useful commands for viewing and enabling hidden drives on Windows. Two key commands are diskpart and mountvol.
Diskpart is a command-line disk partitioning utility built into Windows. To list all volumes, including hidden ones, type diskpart at the command prompt to enter diskpart mode. Then type list volume. This will display all volumes on the system.
To mount a hidden volume, use the mountvol command. For example: mountvol X: /L will mount the X: drive and make it accessible in Windows Explorer. See this guide for more details on mountvol syntax.
So in summary, diskpart and mountvol provide powerful command-line tools for viewing and accessing hidden drives and volumes in Windows.
Third-party tools
There are many third-party tools available that can help find hidden partitions on your hard drive. Some of the most popular and effective options include:
EaseUS Partition Master – This free partition manager makes it easy to find, resize, format, delete, clone, and organize partitions. It can detect hidden drives and recover lost or deleted partitions.
AOMEI Partition Assistant – Hide and unhide partitions easily with this tool. The partition manager allows you to access hidden hard drive partitions in just a few clicks.
MiniTool Partition Wizard – Scan your storage devices for hidden partitions with this free tool. It also provides a full set of features to manage your disk layout.
GParted – This free partition editor for Linux and other operating systems can detect and mount hidden partitions so you can access the data.
HxD – This advanced hex editor allows you to search drive sectors to find hidden or lost partitions. It takes more technical skill but can recover partitions other tools miss.
These third-party tools provide an easy way to find and access hidden partitions that don’t show up through the standard disk management utilities. Their advanced scanning and recovery features make them a useful solution for detecting and mounting hidden drives.
Checking USB Devices
USB drives can sometimes contain hidden partitions that are not visible in Windows File Explorer. To view any hidden partitions, connect the USB drive to your computer and follow these steps:
1. Open Disk Management (press Windows Key + R and type “diskmgmt.msc”).
2. Right-click on the USB drive and select “Properties”. Go to the “Volumes” tab.
3. This will display any hidden partitions on the drive. If you see any unknown volumes listed here, that is a hidden partition.
You can also use third-party tools like MiniTool Partition Wizard or Recuva to scan USB drives and identify any hidden or deleted partitions. These tools give you more options to view disk information compared to the built-in Windows tools.
With Partition Wizard, you can connect a USB drive, right-click on it, and select “Check Partition” to scan for any hidden partitions. Recuva has a “Deep Scan” mode that thoroughly searches a drive for any deleted or hidden partitions.
Checking for rootkits
Rootkits are a type of malware that are designed to stay hidden on your system. They can hide files, processes, registry keys, and even entire partitions or hard drives. Rootkits use sophisticated techniques like hooking, patching, and filtering to stay undetected from users and security tools.
One way rootkits can hide drives is by manipulating data structures in the operating system kernel to hide disk volumes from being displayed in Windows Explorer or Disk Management. For example, they may remove a drive letter or partition information from the partition table.
To check for hidden rootkits, you need to use dedicated anti-rootkit scanning tools. Some free options include Kaspersky TDSSKiller, GMER, and RootkitRevealer. These tools use techniques like signature scanning, behavioral analysis, and hidden volume detection to uncover rootkits. They search areas like the kernel, file system, registry, drivers and more.
It’s important to keep your operating system and security software up-to-date to help prevent rootkit infections. However, if an advanced rootkit is detected, the safest way to remove it is often to completely reformat the drive and reinstall the OS. This helps eliminate any hidden malware remnants left behind.
Recovering lost partitions
If you’ve accidentally deleted a partition on your hard drive or external storage device, the data is likely still present on the disk – it just needs to be recovered. There are several data recovery tools that can scan disk drives and rebuild partition tables to restore access to lost partitions.
Some popular free data recovery tools include Recuva, MiniTool Partition Wizard, and Disk Drill. These tools can scan drives and recover lost or deleted partitions by rebuilding the partition table – the index that tells the operating system where partitions are located on the drive.
The recovery process involves scanning the drive for file signatures that indicate the start and end points of previous partitions. Once the partition boundaries are identified, the tool will rebuild the partition table to restore access to the lost partition and data.
For best results, it’s important not to save new data onto the drive before attempting partition recovery. Overwriting existing data makes it much harder to recover lost partitions and files.
When to seek help
There are limits to what you can accomplish with DIY data recovery solutions. While software like Disk Drill, EaseUS, and Recuva may help recover deleted files or lost partitions, they are not as effective for complex cases like hardware failure or catastrophic data loss.
Professional data recovery services have extensive capabilities and high success rates for challenging scenarios. As Secure Data Recovery states, “A professional data recovery service consistently delivers solutions in the most challenging circumstances and remains the best option for recovering data from failed, damaged, or inaccessible storage media” (Source).
It’s recommended to use professional data recovery services when DIY solutions are unable to recover your lost data. They have advanced techniques and tools to rescue data from failed hard drives, SSDs, RAID arrays, and more. As Secure Data Recovery highlights, “When getting your data back is crucial, call Secure Data Recovery” (Source).
The high success rates of professional services make them worthwhile when you have irreplaceable or mission-critical data at stake. As one guide recommends, “Professional services often have a higher success rate, especially for complex data loss scenarios involving hardware failure or catastrophic damage” (Source).