Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Not necessarily. A partition missing from File Explorer, or a Windows boot entry whose device and osdevice point to different places, is not by itself evidence of malware. EFI, Recovery, and other system partitions normally have no drive letter; BitLocker and multi-boot setups can also produce different BCD locations. Identify the partition and preserve your recovery key before changing anything.
The safest order is: identify first, scan second, repair third, delete last.
What “hidden volume” can mean
“Hidden” is not a precise diagnosis. It may mean a partition has no drive letter, has a partition type Windows does not normally show in File Explorer, is encrypted, or is visible only in Disk Management, DiskPart, or a recovery environment. It could also be a second Windows installation or a virtual disk that is not mounted. None of those descriptions alone means the volume is malicious.
Windows uses partitions that are deliberately kept out of everyday browsing. Depending on the computer’s setup, these can include an EFI System Partition (UEFI boot files), a Microsoft Reserved (MSR) partition, Windows Recovery Environment (WinRE), an older System Reserved partition on a BIOS/MBR system, or an OEM recovery partition.
#1 Best Overall
- SATA DRIVES ONLY — 2.5in & 3.5in: Works with SATA I/II/III hard drives and SSDs. Does NOT support IDE/PATA, M.2 NVMe, M.2 SATA, SAS, or drives already in a USB enclosure. Check your drive's connector before ordering — a bare SATA drive has a wide flat L-shaped edge connector, not a ribbon cable or a small M.2 gold-finger card.
- USB TYPE-A HOST CABLE — NOT A USB-C PORT: The included host cable ends in USB Type-A and plugs into a USB 3.0 Type-A port. If your computer has only USB-C ports, you will need a USB-C to USB-A adapter, which is not included. For stable operation plug directly into the computer — USB hubs and USB 2.0 ports may cause intermittent disconnections.
- REAL-WORLD SPEED, NOT INTERFACE MATH: USB 3.0 with UASP support (UASP-capable host required). Typical mechanical HDD transfer speeds are 100-160 MB/s, which is the drive's own limit, not the port's; SSD speeds vary up to the USB interface maximum. Backward compatible with USB 2.0 and USB 1.1.
- 12V POWER ADAPTER INCLUDED — REQUIRED FOR 3.5in DRIVES: A 12V/2A AC power adapter is in the box and a wall outlet is needed. 3.5in HDDs cannot run on USB power alone — without the adapter the drive will fail to spin up or drop out during use. 2.5in drives are generally bus-powered, but the adapter is recommended for stability.
- PLUG AND PLAY, TOOL-FREE, HOT-SWAP: No drivers on Windows 10/11, macOS, or Linux. Lay-flat bay accepts a bare drive without tools, swaps without rebooting, and an LED shows power and activity. Note: S.M.A.R.T. diagnostics are not passed through the USB bridge, and on macOS a drive may need remounting after sleep. Drive not included.
What a “different OS specification” may mean
The wording may refer to Windows Boot Configuration Data (BCD). In a BCD entry, device identifies the location of the boot application, while osdevice identifies the partition containing the Windows system root. They often refer to the same Windows installation, but they can legitimately differ, including in BitLocker or multi-operating-system arrangements. A mismatch alone does not prove a second OS or an infection. Microsoft explains the BCD device and OS-device settings.
A boot entry may also be left over from a removed or previous Windows installation. Read the full entry before drawing conclusions; do not remove an entry simply because its description looks old or unfamiliar.
Inspect the disk without changing it
First save or photograph the current layout in Disk Management. Then open Windows Terminal, Command Prompt, or PowerShell as administrator. The following DiskPart commands list disks, partitions, and volumes; they do not delete or format anything:
diskpart
list disk
select disk 0
list partition
list volume
exitIf the computer has more than one disk, do not assume Disk 0 is the Windows disk. Check the disk sizes and layout in Disk Management and select the correct disk before inspecting its partitions. To see more detail about a particular item, use its number from the listing:
Rank #2
- Tool free design, easy to install,Transfer Rates Up to 480 Mbps when connected to a USB 2.0 port,Transfer Rates Up to 5 Gbps when connected to a USB 3.0 port.
- Suitable for 2.5” SATA/SSD;Supports Standard Notebook 2.5″ SATA and SATA II Hard drives
- Optimized for SSD, Supports UASP SATA III,Backwards-Compatible with USB 2.0 or 1.1
- Hot-swappable, plug and play, no drivers needed
- Operating System:Supported Operating Systems:Mac,Windows;Supported Windows Versions :Windows 7, Windows 8, Windows Vista, Windows XP; Supported Mac Versions: Mac OS X and Higher
diskpart
list disk
select disk <disk number>
detail disk
list partition
select partition <partition number>
detail partition
list volume
select volume <volume number>
detail volume
exitRecord each disk and partition number, size, file system, label, status, and drive letter. PowerShell can also provide an overview:
Get-Disk
Get-Partition
Get-VolumeDo not run clean, delete partition, format, convert, or assign as a way of “checking” a volume. These commands alter the disk, and deleting or formatting the wrong system partition can make Windows unbootable or destroy data.
Read the boot entries, but do not edit them yet
To display the BCD store without changing it, run:
bcdedit /enum allFor a narrower view, you can use bcdedit /enum OSLOADER, bcdedit /enum BOOTMGR, or bcdedit /enum {default}. In the output, note identifier, description, device, osdevice, path, and systemroot. Typical clues include:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
path EFIMicrosoftBootbootmgfw.efiis a common Windows UEFI boot-manager path.systemroot Windowsindicates the Windows directory for that loader entry.- Several OS loader entries may represent a dual-boot setup or stale entries left behind after an old installation was removed.
- A
HarddiskVolumereference may not look like a drive letter. Do not guess which partition it means from the name alone; compare the BCD output with the disk layout.
Microsoft documents bcdedit /enum as a listing command and warns that boot-configuration changes can make a computer inoperable. Listing entries is different from editing them; avoid bcdedit /set or deleting entries unless you have a specific, verified boot problem and know which entry is active.
Rank #3
- Feature - BENFEI Type-C/Type-A 2.5 inch Hard Drive Enclosure easily hook up your 2.5 inch SATA I/II/III hard drive to transfer files from one PC to another PC, laptop, PS4 or as a USB external hard drive.
- Speed - Up to 5 Gbps data transfer rate with supports UASP SATA III transmission protocol, which is 70% faster than traditional USB3.0. Backward compatible with USB 2.0 or 1.1 ports.
- Design - With USB Type-C/Type-A plug design, provide a easy connection option to laptop/phone/pad. Tool free installation, Plug & Play, No driver needed for this SATA enclosure. Just push out the cover, plug in the drive, close the cover and go. Hot-Swappable.
- Compatibility - BENFEI Hard Drive Enclosure supports Windows, LINUX, MacOS 8.0, and above. Specifically designed for 7/9.5mm thick, 2.5 inches, 6TB HDD & SSD. Compatible with Western Digital, Seagate, Toshiba, Samsung, Kingston, Crucial, Hitachi, and more.
- Warranty - Exclusive BENFEI Unconditional 18-month Warranty ensures long-time protection of your purchase; Friendly and easy-to-reach customer service to solve your problems timely.
Common findings and what to do
| Finding | Often indicates | Safer next step |
|---|---|---|
| Small FAT32 partition with no drive letter on a GPT/UEFI system | EFI System Partition containing boot files | Leave it alone unless there is a demonstrated boot problem. |
| Small partition marked Recovery | Windows RE or OEM recovery tools | Keep it until you understand its role and have working recovery media. |
| MSR partition with no ordinary file system | Microsoft Reserved partition on GPT | Do not format or assign a letter to it as a test. |
| Large partition containing a Windows folder | A current, previous, or second Windows installation | Confirm which installation is active and whether any needed files remain before removal. |
| Several Windows loader entries | Dual boot or a stale boot-menu entry | Compare each entry’s paths and partitions; do not remove an entry solely because it is unfamiliar. |
| BitLocker-protected volume or recovery prompt | Encryption and/or a change to boot, hardware, firmware, or software | Find the recovery key before making further changes. |
| Unexpected boot executable or a path outside expected Windows/EFI locations | Potentially suspicious, but not proof on its own | Record the details, scan, and seek expert help if there is evidence of boot-level tampering. |
Partition size and file system are clues, not proof. OEM layouts vary, and drive letters can change in Windows Recovery Environment (WinRE) or Windows installation media. A volume called C: in recovery may not be the everyday Windows C:.
Check BitLocker before any repair
Before changing partitions, boot files, BCD entries, or firmware settings, check whether BitLocker or Windows Device Encryption is enabled and make sure the recovery key is available. One way to check from elevated PowerShell is:
Get-BitLockerVolumeBitLocker recovery prompts can follow legitimate hardware, firmware, software, or boot-configuration changes; they do not by themselves prove infection. The recovery key is a unique 48-digit number. Depending on how encryption was set up, it may be saved to a Microsoft account, a work or school account, or held by the organization’s IT administrator. Do not proceed with boot or partition changes if you cannot obtain the key and the encrypted data matters. See Microsoft’s BitLocker overview.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsScan for malware in a measured way
- If compromise appears active, disconnect from the internet. Avoid logging into sensitive accounts on a system you believe is compromised.
- Preserve useful information. Record the disk layout and BCD output. Back up important personal files if you can do so safely, but do not copy suspicious executables or scripts.
- Run a Microsoft Defender scan. Start with a normal scan in Windows Security.
- Run Microsoft Defender Offline if concern remains. Save your work first: the scan restarts the computer and checks outside the ordinary Windows environment. On Windows 10 version 1607 and later, and Windows 11, it is built in. From elevated PowerShell, run
Start-MpWDOScan. Microsoft also documents launching it from Windows Security. - If Offline scan does not run, check WinRE. Run
reagentc /info. If WinRE is disabled and enabling it is appropriate for your system,reagentc /enablemay be needed before trying the offline scan again. - Use extra scanners only when symptoms justify them. A reputable second-opinion scanner can help investigate adware or suspicious detections, but a scan result does not establish that an EFI or Recovery partition is malicious.
Microsoft describes Defender Offline’s requirements and behavior in its Defender Offline documentation. If a scanner reports a boot-level threat, preserve its detection name and location and get qualified help rather than formatting a partition based only on the alert.
Rank #4
- 5 Gbps High-speed Transfer: CLAVOOP 3.5 hard drive enclosure supports UASP protocol for faster data transfer over USB 3.0, with tested read speeds up to 336 MB/s. Actual performance may vary depending on your device's capabilities
- Latest Design: Lay-Flat dock station 3.5 external hdd enclosure made from sturdy ABS material with a unique circular top, large ventilation holes, and four non-slip pads to ensure stable and cool operation
- Humanized Design: 3.5 hdd enclosure case built-in shock-proof sponges protect your drive; LED indicators show the 3.5 external hard drive enclosure working status; Auto-sleep function helps save energy—wake the drive with the power button; Plug and play, no tools or drivers required
- Wide Compatibility: HDD Enclosure 3.5 works with 3.5"/2.5" SATA I/II/III HDDs and SSDs up to 20TB to a PC, laptop, and other devices. Compatible with Windows 9/8/SE/ME/2000/XP, Mac OS 8.6 or latest version, Linux, ChromeOS, and gaming consoles like PS5, PS4, Xbox One, and more. (Note: Not compatible with IDE, mSATA, M.2 drives; System compatible hard disk format details see figure)
- Packing List: USB 3.0 to 3.5 sata hard drive enclosure x1 (include 12V/2A DC power adapter x1, USB 3.0 data cable x1, User manual x1); Please confirm your hard drive type before purchasing
Repair boot configuration only when Windows has a boot problem
If Windows starts normally and the only concern is a hidden partition or different device/osdevice values, do not rebuild the boot files as a precaution. Boot repair is relevant when there is a concrete symptom: for example, a “Boot device not found” message, a Windows Boot Manager error, repeated automatic-repair failure, a missing legitimate Windows installation, or a boot entry that clearly points to a partition that no longer exists.
Before any planned BCD repair, save a backup from normal Windows using an elevated Command Prompt:
mkdir C:temp
bcdedit /export C:tempbcdbackupIn the recovery environment, drive letters may differ from normal Windows. Identify the actual Windows directory and system partition before using bcdboot. Microsoft’s troubleshooting example is:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11bcdboot D:Windows /s R: /f ALLThe placeholders matter: replace the OS and system drive letters with the ones you have verified in that environment. The general form is:
Best Value
- SATA-Only Compatibility: Fits 2.5" and 3.5" SATA HDDs and SSDs. NOT compatible with SAS, M.2 NVMe, M.2 SATA, NVMe PCIe, or IDE/PATA drives. Note: some 4TB+ 3.5" drives with non-standard PCB height may not seat correctly — verify your drive's physical dimensions before purchasing.
- Tool-Free Setup: Slide, click, and go—no tools or screws needed. Swap drives in seconds without hassle.
- USB 3.0 (USB-A) with UASP: USB Type-A host connection — a USB-C to USB-A adapter is required if your computer only has USB-C ports (not included). Transfer speeds up to 625 MB/s theoretical maximum; typical real-world speeds are 100–180 MB/s for HDDs and up to 400–500 MB/s for SSDs.
- External Power Required: Includes 12V/2A AC power adapter — a wall outlet is needed (not bus-powered via USB). Aluminum shell with internal ABS shock-absorbing tray for durability and heat dissipation.
- Plug & Play — Windows 10/11, macOS & Linux: No drivers needed. LED indicates power and activity status. Note: S.M.A.R.T. diagnostics are not accessible through the USB bridge. Hard drive not included.
bcdboot <OSDrive>:Windows /s <SystemDrive>: /f ALLDo not run this just because two BCD fields differ. Boot-file changes can make the computer unbootable or trigger BitLocker recovery. Microsoft’s boot troubleshooting guidance covers identifying volumes, backing up BCD, and recreating boot files.
Why the original forum thread is not a diagnosis
The phrase in this question comes from a malware-removal help thread. The thread’s helpers requested logs and a computer-specific FRST fix, but that does not establish that the hidden volume itself was malware. FRST fix lists are tailored to a particular computer after its logs have been reviewed; do not reuse one from a forum post on another machine. The thread also cautions against making unrequested system changes. Read the original BleepingComputer discussion as a case-specific help exchange, not a general repair recipe.
When to stop and get help
Do not continue with manual repair if the disk may be failing, the partition table looks damaged, important data exists only on the suspect volume, the BitLocker key is unavailable, there are multiple disks and you cannot identify the boot disk, or the system no longer boots after earlier DiskPart/BCD changes. Seek help from the device maker, a qualified repair professional, or your organization’s IT team for employer- or school-owned computers. Suspected bootkit or firmware compromise also warrants specialist assessment rather than trial-and-error deletion.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
