uk Technology & digital loss

What to do if…
your user profile loads blank and your desktop files appear to be missing

Produced and maintained by PanicStation.org Published: 28 May 2026 Last reviewed: 17 July 2026 Editorial policy UK guide

Short answer

Stop making changes and first check whether you are in a temporary or wrong profile, or whether Desktop and Documents have been redirected into cloud sync. If you see a ransom note, sudden file-name changes, or security warnings, disconnect the device from the internet before doing anything else.

Do not do these things

Don’t start tidying, moving folders, creating lots of new files, reinstalling apps, or resetting the device before checking where the original files may be.
Don’t run “PC cleaner”, “driver fixer”, or file-recovery tools you found in a panic; some are unsafe and some can overwrite recoverable data.
Don’t pay a ransom or follow pop-up “support” phone numbers if you see a ransomware-style message.
Don’t keep rebooting repeatedly if you hear unusual disk noises or see repeated file errors; pause and protect what is left.
Don’t sign out of cloud sync accounts in a panic before checking the web version and recycle bin, because sync changes can spread.

What to do now

Pause and preserve what you are seeing.
Take photos or screenshots of the blank desktop, the username at sign-in, any error messages, any ransom-style note, and the date and time. This gives you a record for IT support, recovery help, or reporting.
If malware or ransomware is possible, isolate the device first.
If you saw a ransom note, sudden file extensions changing, unexpected encryption messages, or antivirus warnings, turn off Wi-Fi or unplug Ethernet. Do not plug in backup drives or USB storage. If this is a work, school, or shared organisation device, tell IT or the helpdesk straight away.
Check whether you are in the right account or a temporary profile.
- Windows: check the signed-in username on the Start menu or lock screen. If Windows says it cannot sign in to your account, or the profile looks temporary or newly created, your original files may still be under another folder in C:\Users\.
- Mac: check Apple menu → System Settings → Users & Groups and confirm you are in the expected user account. A new-looking desktop can mean you are in a different account.
Check the most likely “moved, not deleted” places first.
- Sign in through a browser to OneDrive or iCloud Drive and look for Desktop, Documents, recently moved items, and deleted items.
- If OneDrive is used on the Windows PC, check C:\Users\<your-username>\OneDrive\Desktop and C:\Users\<your-username>\OneDrive\Documents.
- Check the local Recycle Bin or Trash.
- Check the local user folders: C:\Users\<your-username>\Desktop, C:\Users\<your-username>\Documents, or your Mac home folder.
If this happened after a Windows update, search before changing anything.
Use File Explorer to search This PC for a distinctive missing file name. If C:\Windows.old exists, search inside it for the missing file name, Desktop, or Documents. Do not delete C:\Windows.old while you are still looking.
If OneDrive is involved, use OneDrive’s built-in recovery options rather than dragging folders around.
In OneDrive on the web, check the Recycle bin and missing-file guidance. If the option is available to your account, “Restore your OneDrive” can roll back unwanted mass changes.
If iCloud Desktop and Documents is involved, check iCloud Drive before assuming deletion.
On a Mac, a change to iCloud Drive Desktop and Documents can make files appear missing locally because they are shown through iCloud Drive. Check iCloud Drive in Finder and on the web for the Desktop and Documents folders.
If this is a work, school, or managed device, stop DIY fixes and escalate internally.
Tell IT that the device loaded a blank or temporary-looking profile and that Desktop or Documents may be missing or redirected. Avoid registry edits, system resets, or recovery tools unless they ask you to use them.
If this looks like cyber crime or fraud, report through the right UK route.
If you have lost money, shared details, been hacked, or think fraud or cyber crime is involved, use Report Fraud if you are in England, Wales, or Northern Ireland. If you are in Scotland, contact Police Scotland by calling 101. If an organisation is affected, the incident is ongoing, or the impact is significant, also follow internal incident reporting and use the NCSC cyber incident reporting route.

What can wait

You do not need to decide now whether to pay for recovery services.
You do not need to reinstall Windows, reinstall macOS, or reset the device right now; that can reduce recovery options.
You do not need to change every password before checking whether this is a profile or sync issue. If you suspect account compromise or malware, change important passwords from a different, trusted device.

Important reassurance

A blank-looking desktop often means the computer has loaded the wrong profile, a temporary profile, or a cloud-synced Desktop or Documents location. Going slowly and checking the common moved locations first gives you a better chance of finding the files without making recovery harder.

Scope note

These are first steps only to stabilise the situation and prevent irreversible mistakes. Later decisions may need specialist IT, cyber security, data recovery, employer, or reporting support.

Important note

This is general information, not professional IT, legal, financial, cyber security, or recovery advice. If malware, ransomware, employer data, or an organisation’s device may be involved, prioritise isolation and official or internal reporting over DIY fixes.

Additional Resources

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us