How to show hidden files in Windows

What are hidden files in Windows?

Hidden files and folders in Windows are components that are not displayed by default by File Explorer. They are hidden by the operating system or applications for system protection, security, and to reduce clutter. There are two common types of hidden files:

• Regular hidden files: Windows files that are not visible by default in Windows Explorer.
• Super hidden files: Also known as system files, that are specifically hidden because of their deep integration with Windows operating system's functions. These files are typically located in system32 and Windows folders.

While both these files are hidden, super hidden files require additional complex steps to view them.

This article explores the different ways to view hidden files in Windows systems.

How to show hidden files in Windows

The methods to view hidden files vary depending on the version of Windows operating system you use. Most often, this is accomplished through graphical user interfaces like file explorers or through command-line tools.

How to show hidden files in Windows 11 and 10

Follow the below steps to view regular hidden files in Windows 11 and 10

Viewing regular hidden files

Using file explorer:

• Click on File Explorer icon in the task bar.
• Click the View tab on the toolbar of the File Explorer window.
• In the Show/hide group, check the box next to Show hidden items. This should enable you to view the regular hidden files in your Windows device.

Using the Control Panel

• Open the Control Panel.
• Click the Appearance and Personalization option.
• Select File Explorer Options.
• Under the View tab in the File Explorer window, select Show hidden items.

Using PowerShell

• Open PowerShell as an administrator.
• Run the command: Get-ChildItem -Force. This will list all the hidden files and folders in the current directory.

Using the command prompt

• Open the Command Prompt as an administrator.
• Run the command: dir /a:h to list all the hidden files without altering their hidden attribute.



• Alternatively, you can type attrib -h -r -s /s /d C:\*.* to remove the hidden attributes from the files and make them visible all the time.

Viewing super hidden files in Windows 11 and 10

To show the super hidden files, you will need to enable a hidden setting:

• Search for Control Panel in the Start menu and open it.
• Click the Appearances and Personalization option and then File Explorer.
• Click the View tab located on the toolbar of File Explorer.
• Uncheck "Hide protected operating system files (recommended)": This will allow you to see system files.
• A warning message will appear. Click Yes to proceed.

Viewing hidden files in Windows: A quick guide

Want to know the best method for finding hidden files? Here's a comparison of different methods, from user-friendly to more technical.

Hidden files and security

While legitimate files might be hidden to protect the system, adversaries can exploit this feature to conceal malicious files. By hiding directories or malicious files, attackers can evade detection, making it difficult for security teams to trace their activities or gather forensic evidence. A common tactic, the MITRE ATT&CK threat modeling framework technique known as T1564.001, involves Hidden Artifacts, where attackers manipulate file attributes.

How can EventLog Analyzer monitor hidden file operations?

ManageEngine EventLog Analyzer, a comprehensive log management and IT compliance solution, helps sysadmins monitor the integrity of files and folders, track user activities, and generate reports for Windows security auditing. By detecting key event data—such as unusual process behavior, command line executions, and abnormal file operations—this solution provides real-time alerts that enable administrators to quickly respond to potential threats.

EventLog Analyzer tracks file operations including changes in file attributes, even in hidden files, and notifies you about unauthorized and suspicious file hiding activities. This file integrity monitoring solution alerts, reports, and maps the file hiding event to MITRE tactic T1564.001 (Hide Artifacts) to provide detailed insights into who performed this event, from where, and when.

Comprehensive monitoring ensures no hidden attack vectors compromise the security of your critical files and systems. With a comprehensive view of file activities—such as creation, modification, and permission changes—EventLog Analyzer helps ensure data integrity and security.

Next steps: