Solved Invisible files/folders -- what's Windows hiding?

[pawprint]

Hello,

I recently had a problem where my jump lists stopped working. The solution I found on a blog site was to navigate to the folder c:\Users\username\Recent\automaticDestinations\ and delete the entire contents of this folder. What is funny about this folder, though, is that it's invisible in windows explorer. You would never even know that it's there---not even if you have "show hidden files," etc. turned on. You have to actually type this path into the location bar to view its contents.

After thinking about it for a while, I am sure I have encountered a similar thing at least once before, when I had to solve a ticket at work dealing with MS Outlook. I forget the details, but basically it was an invisible folder that you couldn't get to unless you knew it was there and manually typed it into the location bar.

This folder also will show up with a "dir" command from a command prompt. Looking at the attributes, it does not appear to be flagged as system or hidden. What is the mechanism at work here, then? Why wasn't it good enough to just flag the folder as hidden? Makes me wonder what other secrets are hiding deep in the jungle of the Windows 7 user profile, or in other places. And I would prefer to not have to "dir" my entire drive just to know that this stuff exists; I would much rather have it just show up in explorer, especially since I specifically turned off all the "hide stuff" options.

I spent at least an hour trying to dig up information on this, and can't find anything relevant. Maybe I'm just missing some specific keyword in google? Can anyone shed any light on this? Does anyone know of any other "secret" folders like this?

Thanks!

 

[pincushion]

That would be because that is not the actual location of the file but just a link to it - the actual location being -

C:\Users\username\AppData\Roaming\Microsoft\windows\recent\automaticdestinations\

and this applies to many other files too.

If you have CCleaner installed (possibly with added items) then ticking 'More Recent Items' (Applications - Windows) will show where these items are actually located.



Correction: Although the location is as above these appear to be superhidden files and although I managed to see the Custom Destinations folder in Explorer it seems to vanish and not be available coyly hiding - no sign of the Automatic Destinations folder! Not sure how one would ever know about these files as you commented. Apologies.

If you are really paranoid then using something like Directory Snoop will enable you to see all these hidden files but it might take quite a while to locate them all and to understand their purpose.



ps If you navigate to the actual location and right click then you can clear both of these Recent folders - assuming in admin mode.

 

[pawprint]

Thanks for your comment pincushion.

Besides the fact that I don't like the idea of hidden easter eggs like this in my filesystem, what concerns me more is that I have to wonder what's stopping malware and various other nasties from using the same trick---however it works---to evade detection, short of more forensic forms of filesystem analysis. As it is, I could just drop a file into one of these existing folders, and no one would ever see it in explorer unless they thought to type the location in manually and check. And who knows how many more folders like this exist in a Windows 7 environment?

I checked out the Directory Snoop application, but it seems buggy and always crashes with "out of memory" while analyzing my drive. I have 6 gigs.......Oh well. I will have to look around for a similar tool next time I get the chance.

 

[Jacee]

Besides the fact that I don't like the idea of hidden easter eggs like this in my filesystem, what concerns me more is that I have to wonder what's stopping malware and various other nasties from using the same trick

Ahhh, but malware and other nasties can and do 'hide' themselves

 

[scr]

There is another folder hidden in the same directory:

C:\Users\username\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

What I found on Google was:

"for those using windows 7/2008 server with mandatory profiles. i have just found where the jump lists are contained. i.e. adding a user specific word file to a pinned word app on the taskbar or a perticular folder to the windows explorer they are here.

%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations"

Source: http://www.apug.info/viewtopic.php?t=970&p=3493

 

[pawprint]

Ahhh, but malware and other nasties can and do 'hide' themselves

Well yeah---and as one who does not want any nasties on my system, nor on the hundreds of systems I am responsible for maintaining in my workplace, it behooves one to be aware of its potential hiding places, don't you agree?

There is another folder hidden in the same directory:

C:\Users\username\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

What I found on Google was:

"for those using windows 7/2008 server with mandatory profiles. i have just found where the jump lists are contained. i.e. adding a user specific word file to a pinned word app on the taskbar or a perticular folder to the windows explorer they are here.

%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations"

Source: AppSense User Groups • View topic - Personlizing pinned items to Apps in taskbar (jump lists)

Thanks. That is similar to the article I was reading, although as pincushion pointed out, the path I mentioned in OP is really a link to that absolute location.

So far, I'm aware of at least these two paths, based on having to deal with previously mentioned problem. If anyone knows of any additional "easter egg" locations like this, or what mechanism is causing them to be invisible in explorer, I would be most curious to hear!


ETA: I was just experimenting with this, and it appears that this is tied in with desktop.ini, and the way explorer presents special folders, such as this one. Navigate to your recent items from the command line, and then open up your desktop.ini with notepad and delete the CLSID= line, and suddenly the secret folders become visible. Add the line back, and they vanish again.

I tried to create my own replica of this folder by copying the desktop.ini out of it, but was unable to recreate the same effect manually. So, apparently there is a little more to it than that.

Based on this info, I think the locations are probably not truly hidden, as the folders seem to be just normal folders. I'm guessing it is purely a presentation trick used by Explorer. I still think that is weird, but now I have a starting point to look for further info. I think that is probably good enough for me, so I am going to just mark this thread as solved; however if anyone has any related info to add, please do so.

 

[pincushion]

Thanks for your comment pincushion.

Besides the fact that I don't like the idea of hidden easter eggs like this in my filesystem, what concerns me more is that I have to wonder what's stopping malware and various other nasties from using the same trick---however it works---to evade detection, short of more forensic forms of filesystem analysis. As it is, I could just drop a file into one of these existing folders, and no one would ever see it in explorer unless they thought to type the location in manually and check. And who knows how many more folders like this exist in a Windows 7 environment?

I checked out the Directory Snoop application, but it seems buggy and always crashes with "out of memory" while analyzing my drive. I have 6 gigs.......Oh well. I will have to look around for a similar tool next time I get the chance.

I've rarely had a problem with Directory Snoop but I know there are many other utilities out there that can do the same sort of thing. As someone who always has all files and extensions shown for safety reasons I also do not like the way things can be hidden from a user and although I know the lack of wisdom in doing so I always run as admin because it is more convenient to do it this way. Perhaps other replacements for Explorer - there seem to be quite a few - can show these files?

 

[michaelmullen2]

Ahhh, but malware and other nasties can and do 'hide' themselves

Well yeah---and as one who does not want any nasties on my system, nor on the hundreds of systems I am responsible for maintaining in my workplace, it behooves one to be aware of its potential hiding places, don't you agree?

There is another folder hidden in the same directory:

C:\Users\username\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

What I found on Google was:

"for those using windows 7/2008 server with mandatory profiles. i have just found where the jump lists are contained. i.e. adding a user specific word file to a pinned word app on the taskbar or a perticular folder to the windows explorer they are here.

%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations"

Source: AppSense User Groups • View topic - Personlizing pinned items to Apps in taskbar (jump lists)

Thanks. That is similar to the article I was reading, although as pincushion pointed out, the path I mentioned in OP is really a link to that absolute location.

So far, I'm aware of at least these two paths, based on having to deal with previously mentioned problem. If anyone knows of any additional "easter egg" locations like this, or what mechanism is causing them to be invisible in explorer, I would be most curious to hear!


ETA: I was just experimenting with this, and it appears that this is tied in with desktop.ini, and the way explorer presents special folders, such as this one. Navigate to your recent items from the command line, and then open up your desktop.ini with notepad and delete the CLSID= line, and suddenly the secret folders become visible. Add the line back, and they vanish again.

I tried to create my own replica of this folder by copying the desktop.ini out of it, but was unable to recreate the same effect manually. So, apparently there is a little more to it than that.

Based on this info, I think the locations are probably not truly hidden, as the folders seem to be just normal folders. I'm guessing it is purely a presentation trick used by Explorer. I still think that is weird, but now I have a starting point to look for further info. I think that is probably good enough for me, so I am going to just mark this thread as solved; however if anyone has any related info to add, please do so.

Great solution-idea. Many thanks

 

[Callender]

CustomDestinations

C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

On my machine this folder is shown - I guess because hidden files and folders is set to "show" in folder view options.

In the C:\Users\Username\AppData\Roaming\Microsoft\Windows directory on my machine the following folders shown highlighted in blue are the superhidden ones.



If I want to view all hidden files using a single application I tend to make use of:

Hidden File Finder : Free Tool to Find and Unhide/Remove all the Hidden Files | www.SecurityXploded.com

It shows all hidden files and folders. Note: Just because they're hidden it doesn't automatically mean that there's a problem.