NTFS drive shows up as RAW in Windows, but all recovery software reads it OK

Hello,
We have a Windows XP Home laptop that failed to boot, showing a blinking cursor after POST.  I plugged the HD into a USB-PATA adapter and my Windows 7 desktop initially recognized it OK and I could see all the files.

I had to move the USB-PATA adapter and drive to a different Windows 7 computer to actually work on it, and now it reports as "RAW" in Disk Manager.  The Dell recovery partition shows up OK as FAT16 and is readable, but the main partition just has a drive letter, and is recognized as RAW instead of NTFS, and is not accessible in Windows.

I have plugged it into 3 different Windows 7 PCs and a working Windows XP PC, and they all have similar results: They assign a drive letter, report "Healthy" in Disk Manager, but they don't say "NTFS" (the Windows 7 PCs say "RAW"), and no files/folders are visible.

I have looked at the disk with TestDisk and demo versions of Active@ Partition Recovery, GetDataBack, Paragon Partition Manager, and EASUS Partition Recovery.  They all find the NTFS partition with no problem, and they all give no indication that they found a problem that their paid version could fix.

I successfully copied all the important data files to a new drive using TestDisk and it had no problems reading them.

I would like to repair the file system on this drive so we don't have to reinstall Windows, and I would gladly purchase the licensed version of any of the above programs if one of them seemed to indicate that it found something to fix.  But they are all oddly similar in that they just read the NTFS file system and show all the files/folders without indicating that anything is broken.

I'd feel more comfortable if they all reported "Your NTFS file system is corrupted, click here to buy the full version so I can fix it".  But they just show me the files as if nothing is wrong!

In TestDisk, the drive shows up like this:

1 * FAT16 >32M        0,1,1   4,254,63       80262 [DellUtility]
2 P HPFS - NTFS   5,0,1   30400,254,63   488311740 [Laptop]

Indicating that the OS partition is a Primary partition ("P"), not overlapping with with the DellUtility partition, which is a Primary Active partition ("*").  This looks fine to me, and I had TestDIsk write what it found to the partition table, with no change in results.

After much Googling and searching here on EE, I tried a few other things, also with no change:

1. In TestDisk, Toggled partition type to FAT32, disconnected, toggled back to HPFS-NTFS to see if re-writing the partition would fix something.  I verified the change with Paragon Drive Backup in between toggling to make sure it was really seen as FAT32.
2. In TestDisk, Re-wrote Boot sector and MBR from backups; regenerated Boot sector, as per TestDisk Wiki.
3. In Paragon Partition Manager, changed the partition label from {blank} to "Laptop" because somebody reported that this was enough to "Wake up" the file system to Windows.


Here is an excerpt from Paragon Drive Backup BioNtLog.txt:

IDSector info: IDE Disk 7, word106 == 0x0
 
  =================================================================================
  Disk #7 ( 238472 MB )
  Cylinders 76C1, Tracks/Cylinder FF, SectorsPerTrack 3F, BytesPerSector 200, TotalSectors 1D1C4581
  Media type: Fixed hard disk
  =================================================================================

  IDE Information:
      Primary Controller     - Master drive
      CHS: 0x0(0x0), 0x0(0x0), 0x0(0x0)
      Total Sectors: 0x00000000(0x00000000)
      Model number :  WDC WD25
      Firmware rev :  
      Serial number:  

  GetDriveLayOut ...   OK
  ====== Drive LayOutEx Information ===================================================
  PartitionStyle MBR
  PartEntry#   StartingOffSet   PartitionLength  HidSect  PartNumber  PT  BI  Recgnz
  ----------   --------------   ---------------  -------  ----------  --  --  ------
          0              7E00           2730C00       3F           1  06  01       1
          1           2738A00        3A36177800    139C5           2  07  00       1
          2                 0                 0        0           0  00  00       0
          3                 0                 0        0           0  00  00       0
 


Here is an excerpt from Paragon Drive Backup stubact.log:

Disk 7 (Basic)    Size: 238475 Mb  Model: WDC WD25 00BEVE-00WZT0 USB Device  Serial:

Online: 1
CHSSectors:  0x000000001D1C4581(488392065)
FullSectors: 0x000000001D1C5970(488397168)

C: 0x000076C1(30401)
H: 0x000000FF(255)
S: 0x0000003F(63)

  PARTITION  L SLOT TYPE FSTYPE    START      END     SIZE  FS_SIZE     USED CLST START_C___H___S    END_C___H___S LABEL
  Primary    E    0   6  FAT16        3F    139C4    13986    13985     2E5C   2        0   1   1        4  FE  3F DellUtility
  Primary         1   7  NTFS      139C5 1D1C4580 1D1B0BBC 1D1B0BBB  7A1A88C   8        5   0   1     76C0  FE  3F


I've seen many forum discussions about this RAW issue, and it's clear there are a number of different causes and solutions, but so far I haven't found anything to solve my version of the issue.

Can anyone help?

Thanks,
-Tom
trusnockAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
can you run chkdsk /f on the raw drive?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MidnightOneCommented:
Me, I'd use Find and Mount (http://www.findandmount.com/) from Atola and make a copy of the drive to an image file before doing anything.

Have you taken a look at Ultimate Boot CD to see if there's a Windows XP MBR utility on there? It's been a while since I've had to use it and really just don't remember.
ReclaiMeCommented:
The data recovery software showing all files like there is nothing wrong does not mean there is actually nothing wrong.

There are several things recovery software will rebuild during processing without any announcement, and sometimes even without knowing what exactly is missing. This includes boot sector(s) and first records of MFT. Boot sectors can actually be reconstructed and fixed in-place, but missing MFT records cannot be produced with enough reliability.

Also, seemingly valid boot sectors are sometimes rejected, although this is in most cases fixed by just copying the backup boot sector over.
 Acronis Global Cyber Summit 2019 in Miami

The Acronis Global Cyber Summit 2019 will be held at the Fontainebleau Miami Beach Resort on October 13–16, 2019, and it promises to be the must-attend event for IT infrastructure managers, CIOs, service providers, value-added resellers, ISVs, and developers.

Davis McCarnOwnerCommented:
OK guys, pay attention!  The fact that the drive is reporting as an incomplete model SCREAMS that it is failing.  That he was able to backup the files is, itself, a very lucky happenstance.
If you want to prove it, get the free version of http://www.hdtune.com and run the error scan.  I'll bet there are red boxes.
Now; if you want tthe best possible outcome, buy a replacement drive ( http://compare.ebay.com/like/170632874004?var=lv<yp=AllFixedPriceItemTypes&var=sbar&_lwgsi=y ),
get RoadKill's RawCopy ( http://www.roadkil.net/program.php?ProgramID=22 ), use it to clone the failing drive, and, afterwards, I'll bet it will be tivial to fix the partition.
ComputerTechieCommented:
When plug in to orher computer try going to.cmd and typing fdisk /mbr
trusnockAuthor Commented:
hanccocka: I had tried the Windows-based error checking, and it couldn't deal with RAW, so it didn't even occur to me to try CHKDSK at the command prompt.  I ran that and it found and fixed lots of issues, and now the drive is visible in Windows.

I don't know if the original laptop will boot on it yet, but I will try that shortly.
David Johnson, CD, MVPRetiredCommented:
REPLACE THAT DRIVE ASAP.. You are lucky now.. maybe the next time you will lose everything..
veedarCommented:
Every drive manufacturer has a free software diagnostic utility you can download to determine the status of the drive. From your description I expect it will show the drive is failing.
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
time now to backup, with ghost, acronis or drive snapshot - free.
trusnockAuthor Commented:
I'm now back to the original problem....I just get a black screen with a blinking cursor after BIOS POST.  I see there are other posts here for that issue, so I will explore them for a solution to that problem.  Thanks everyone for the input.  Hanccocka made the suggestion that solved the specific problem that I opened this question for, so I think all the points should go there.  Anyone disagree?

MidnightOne: I already copied the important data off the drive with TestDisk, so a backup image isn't necessary at this point (other than to get me back to this point if something I try makes it worse)

DavisMcCarn: HDTune shows all green squares.  I'll definitely put the drive through its paces before giving it back to the client though.

ComputerTechie: I don't think fdisk exists in Windows 7 (am I wrong?), but I did rebuild the MBR in TestDisk, and used fixboot and fixmbr in the Windows XP recovery console (didn't help).

Everyone: Yes, I'll replace the drive if I can't be 100% sure it's OK.  Thanks for your help.


David Johnson, CD, MVPRetiredCommented:
now the drive is toast.. you had your warnings. spinrite (http://www.grc.com/spinrite) might rescue the drive or with regular use may prevent it from happening but it costs money (more than your replacement drive)
ComputerTechieCommented:
I do recommend replacing the drive at this point. It sounds like it staring to generate smart error and will fail soon.

CT
Davis McCarnOwnerCommented:
The fact that HDTune gave a clean bill of health says that the drive is (almost undoubtedly) OK.  The real tell is on the Health tab and the value for Reallocated Sector(s) which had better be zero; but, HDTune needs an update as it is hit or miss, often displaying a blank Health page.

At this point, the question is what caused the system to stop booting in the first place and, INHO, there is a strong probability of a Trojan.  Look in Windows\System32\Config and if SAM and/or SECURITY are 256KB, the probability rises to 90+%.  Both should be less than 80KB on most systems.  If this is the case, run a complete virus scan on the drive, please.

What O/S was booting on the drive, what model Dell was it in, and, did an AV scan find anything?
trusnockAuthor Commented:
"Error-checking" under the tools tab for the drive properties couldn't recognize the drive and was unable to attempt to check it, so it didn't even occur to me to try chkdsk.  Thanks for pointing out a simple solution to this problem.
Darr247Commented:
Hmmmm...  I have a 160GB drive that windows sees as RAW (though TestDisk and GParted both insist it is HPFS-NTFS), and XP's CHKDSK says it won't run on RAW drives.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Disaster Recovery

From novice to tech pro — start learning today.