FAT or NTFS partition shows as RAW – Repair a RAW disk

I recently did a post on ‘file system recovery’ vs. ‘RAW recovery’. It resulted in some questions of people inquiring about data recovery of RAW partitions. Now, ‘RAW recovery’ is something else than recovery of data from a RAW partition. I will try to explain what a RAW partition, or RAW file system is and what can be done.

 

You need to format the disk in drive before you can use it.
Do you want to format it?

This volume does not contain a recognized file system. Please make sure 
that all required file system drivers are loaded and that the volume is not corrupted.

chkdsk can not be run on the drive

The type of the file system is RAW. CHKDSK is not available for RAW drives.

Formatting the drive will reinitialize the file system. It creates a new ready to use, empty volume. It does not restore the old file system or it’s data. So, you do NOT want to format the file system if you want to recover the data.

A RAW file system can be caused by a lot of things. The exact cause determines if the corruption can be repaired or fixed, or that you need to recover the data using data recovery software.

Option 1. Using File Recovery Software

If unsuccessful in repairing the RAW drive , or you want the safest approach, then you will need to use DIY data recovery or file recovery software to copy your data from the damaged volume to another disk. This is the safest option anyway. As repairs can not only fail, they can wrong too!

As file recovery software will rebuild a virtual file system in memory from which you can recover data, you will need an extra disk to copy data to.

An example using ReclaiMe is shown in the below video. In most cases, using ReclaiMe you can rescue data from a RAW disk in under an hour. In the example, which is quite typical, the first data is copied to another disk within the first 5 minutes:

Repair or fix a RAW partition.

I have seen a lot of these where the corruption was limited to one sector of the drive: the boot sector. Because these were so common I wrote simple command line utilities years ago that were able to repair FAT32 and NTFS boot sectors using the backup boot sector. Both FAT32 and NTFS keep a copy of the original boot sector. Then when I wrote the first version of DiskPatch this functionality was included in DiskPatch. DiskPatch 2 even had the ability to create a boot sector from scratch, without having to rely on a backup boot sector.

The boot sector contains the first important pointers and parameters of the file system, and without this info Windows or chkdsk can not read the file system. It may not even know the type of file system, hence the phrase ‘RAW’.

Important: Fixing a RAW volume is not the safest approach! The safer approach involves using file recovery software to copy files from the RAW file system to another disk.

Checking and repairing a NTFS boot sector using DiskPatch

DiskPatch (can be found here: DIYDataRecovery.nl).

First things first, check for bad sectors

One cause I have often seen for a RAW partition is bad sectors in file system areas. One or more bad sectors in the file system itself (in the FAT or MFT) may cause the OS to be unable to parse the file system.

You can use DiskPatch to:

• Check the physical state of the hard disk using SMART.
• Scan for and fix (reallocate) bad sectors using the surface scan feature.

Some times ‘fixing’ the bad sectors is all it takes to regain access to the volume, however in other cases it’s not.

This procedure is described in detail here Repair bad sectors using DiskPatch.

Checking the boot sector of a RAW partition (NTFS).

DiskPatch can check the boot sector for inconsistencies. It can detect invalid values, and it can verify if the boot sector points to valid file system structures. For example, the NTFS boot sector points to the MFT (master file table). DiskPatch follows the pointer and checks if the MFT is actually there.

DiskPatch can show you the problems it found. Some values are more critical than others. For example, an incorrect jump code may prevent the partition to boot, but you can probably still access the partition by slaving the disk. After all, the boot code is not required to access the volume. However, DiskPatch not finding a valid MFT is a more serious problem. The MFT is main file system structure in NTFS to track files. If the MFT is corrupt, or like in our example can not be found, the file system can not be read.

Fixing a RAW NTFS Drive

If DiskPatch determined that one or more values from the boot sector are corrupt, then you can have DiskPatch try to repair it. DiskPatch limits it’s repairs to the boot sector only! It saves a copy of the boot sector in it’s current state, so that repairs can be reversed (undo the repair).

Finding the correct parameters

As some values such as cluster sizes are somewhat standard you can either select them or have DiskPatch determine them (recommended).

Most repairs DiskPatch does do not require user interaction. For example, DiskPatch will scan the volume for a valid MFT structure. It will either find it or not. If it does not, this is an indication that the MFT itself is corrupt.

Automatic cluster size detection …

DiskPatch is done fixing the NTFS boot sector. If corruption is limited to the boot sector, then Windows is often able to mount the volume again: It is no longer a RAW partition. You best test this by attaching the disk to a system that runs Windows.

---