Invisible files/folders -- what's Windows hiding?

Hello,

I recently had a problem where my jump lists stopped working. The solution I found on a blog site was to navigate to the folder c:\Users\username\Recent\automaticDestinations\ and delete the entire contents of this folder. What is funny about this folder, though, is that it's invisible in windows explorer. You would never even know that it's there---not even if you have "show hidden files," etc. turned on. You have to actually type this path into the location bar to view its contents.

After thinking about it for a while, I am sure I have encountered a similar thing at least once before, when I had to solve a ticket at work dealing with MS Outlook. I forget the details, but basically it was an invisible folder that you couldn't get to unless you knew it was there and manually typed it into the location bar.

This folder also will show up with a "dir" command from a command prompt. Looking at the attributes, it does not appear to be flagged as system or hidden. What is the mechanism at work here, then? Why wasn't it good enough to just flag the folder as hidden? Makes me wonder what other secrets are hiding deep in the jungle of the Windows 7 user profile, or in other places. And I would prefer to not have to "dir" my entire drive just to know that this stuff exists; I would much rather have it just show up in explorer, especially since I specifically turned off all the "hide stuff" options.

I spent at least an hour trying to dig up information on this, and can't find anything relevant. Maybe I'm just missing some specific keyword in google? Can anyone shed any light on this? Does anyone know of any other "secret" folders like this?

Thanks!

Thanks for your comment pincushion.

Besides the fact that I don't like the idea of hidden easter eggs like this in my filesystem, what concerns me more is that I have to wonder what's stopping malware and various other nasties from using the same trick---however it works---to evade detection, short of more forensic forms of filesystem analysis. As it is, I could just drop a file into one of these existing folders, and no one would ever see it in explorer unless they thought to type the location in manually and check. And who knows how many more folders like this exist in a Windows 7 environment?

I checked out the Directory Snoop application, but it seems buggy and always crashes with "out of memory" while analyzing my drive. I have 6 gigs.......Oh well. I will have to look around for a similar tool next time I get the chance.

There is another folder hidden in the same directory:

C:\Users\username\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

What I found on Google was:

"for those using windows 7/2008 server with mandatory profiles. i have just found where the jump lists are contained. i.e. adding a user specific word file to a pinned word app on the taskbar or a perticular folder to the windows explorer they are here.

%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations"

Source: http://www.apug.info/viewtopic.php?t=970&p=3493

pawprint said:

Thanks for your comment pincushion.

Besides the fact that I don't like the idea of hidden easter eggs like this in my filesystem, what concerns me more is that I have to wonder what's stopping malware and various other nasties from using the same trick---however it works---to evade detection, short of more forensic forms of filesystem analysis. As it is, I could just drop a file into one of these existing folders, and no one would ever see it in explorer unless they thought to type the location in manually and check. And who knows how many more folders like this exist in a Windows 7 environment?

I checked out the Directory Snoop application, but it seems buggy and always crashes with "out of memory" while analyzing my drive. I have 6 gigs.......Oh well. I will have to look around for a similar tool next time I get the chance.

I've rarely had a problem with Directory Snoop but I know there are many other utilities out there that can do the same sort of thing. As someone who always has all files and extensions shown for safety reasons I also do not like the way things can be hidden from a user and although I know the lack of wisdom in doing so I always run as admin because it is more convenient to do it this way. Perhaps other replacements for Explorer - there seem to be quite a few - can show these files?

:)

pawprint said:

Jacee said:

Ahhh, but malware and other nasties can and do 'hide' themselves

Well yeah---and as one who does not want any nasties on my system, nor on the hundreds of systems I am responsible for maintaining in my workplace, it behooves one to be aware of its potential hiding places, don't you agree?

scr said:

There is another folder hidden in the same directory:

C:\Users\username\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

What I found on Google was:

"for those using windows 7/2008 server with mandatory profiles. i have just found where the jump lists are contained. i.e. adding a user specific word file to a pinned word app on the taskbar or a perticular folder to the windows explorer they are here.

%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations"

Source: AppSense User Groups • View topic - Personlizing pinned items to Apps in taskbar (jump lists)

Thanks. That is similar to the article I was reading, although as pincushion pointed out, the path I mentioned in OP is really a link to that absolute location.

So far, I'm aware of at least these two paths, based on having to deal with previously mentioned problem. If anyone knows of any additional "easter egg" locations like this, or what mechanism is causing them to be invisible in explorer, I would be most curious to hear!


ETA: I was just experimenting with this, and it appears that this is tied in with desktop.ini, and the way explorer presents special folders, such as this one. Navigate to your recent items from the command line, and then open up your desktop.ini with notepad and delete the CLSID= line, and suddenly the secret folders become visible. Add the line back, and they vanish again.

I tried to create my own replica of this folder by copying the desktop.ini out of it, but was unable to recreate the same effect manually. So, apparently there is a little more to it than that.

Based on this info, I think the locations are probably not truly hidden, as the folders seem to be just normal folders. I'm guessing it is purely a presentation trick used by Explorer. I still think that is weird, but now I have a starting point to look for further info. I think that is probably good enough for me, so I am going to just mark this thread as solved; however if anyone has any related info to add, please do so. :)

Great solution-idea. Many thanks