trusnock
asked on
NTFS drive shows up as RAW in Windows, but all recovery software reads it OK
Hello,
We have a Windows XP Home laptop that failed to boot, showing a blinking cursor after POST. I plugged the HD into a USB-PATA adapter and my Windows 7 desktop initially recognized it OK and I could see all the files.
I had to move the USB-PATA adapter and drive to a different Windows 7 computer to actually work on it, and now it reports as "RAW" in Disk Manager. The Dell recovery partition shows up OK as FAT16 and is readable, but the main partition just has a drive letter, and is recognized as RAW instead of NTFS, and is not accessible in Windows.
I have plugged it into 3 different Windows 7 PCs and a working Windows XP PC, and they all have similar results: They assign a drive letter, report "Healthy" in Disk Manager, but they don't say "NTFS" (the Windows 7 PCs say "RAW"), and no files/folders are visible.
I have looked at the disk with TestDisk and demo versions of Active@ Partition Recovery, GetDataBack, Paragon Partition Manager, and EASUS Partition Recovery. They all find the NTFS partition with no problem, and they all give no indication that they found a problem that their paid version could fix.
I successfully copied all the important data files to a new drive using TestDisk and it had no problems reading them.
I would like to repair the file system on this drive so we don't have to reinstall Windows, and I would gladly purchase the licensed version of any of the above programs if one of them seemed to indicate that it found something to fix. But they are all oddly similar in that they just read the NTFS file system and show all the files/folders without indicating that anything is broken.
I'd feel more comfortable if they all reported "Your NTFS file system is corrupted, click here to buy the full version so I can fix it". But they just show me the files as if nothing is wrong!
In TestDisk, the drive shows up like this:
1 * FAT16 >32M 0,1,1 4,254,63 80262 [DellUtility]
2 P HPFS - NTFS 5,0,1 30400,254,63 488311740 [Laptop]
Indicating that the OS partition is a Primary partition ("P"), not overlapping with with the DellUtility partition, which is a Primary Active partition ("*"). This looks fine to me, and I had TestDIsk write what it found to the partition table, with no change in results.
After much Googling and searching here on EE, I tried a few other things, also with no change:
1. In TestDisk, Toggled partition type to FAT32, disconnected, toggled back to HPFS-NTFS to see if re-writing the partition would fix something. I verified the change with Paragon Drive Backup in between toggling to make sure it was really seen as FAT32.
2. In TestDisk, Re-wrote Boot sector and MBR from backups; regenerated Boot sector, as per TestDisk Wiki.
3. In Paragon Partition Manager, changed the partition label from {blank} to "Laptop" because somebody reported that this was enough to "Wake up" the file system to Windows.
Here is an excerpt from Paragon Drive Backup BioNtLog.txt:
IDSector info: IDE Disk 7, word106 == 0x0
==========================
Disk #7 ( 238472 MB )
Cylinders 76C1, Tracks/Cylinder FF, SectorsPerTrack 3F, BytesPerSector 200, TotalSectors 1D1C4581
Media type: Fixed hard disk
==========================
IDE Information:
Primary Controller - Master drive
CHS: 0x0(0x0), 0x0(0x0), 0x0(0x0)
Total Sectors: 0x00000000(0x00000000)
Model number : WDC WD25
Firmware rev :
Serial number:
GetDriveLayOut ... OK
====== Drive LayOutEx Information ==========================
PartitionStyle MBR
PartEntry# StartingOffSet PartitionLength HidSect PartNumber PT BI Recgnz
---------- -------------- --------------- ------- ---------- -- -- ------
0 7E00 2730C00 3F 1 06 01 1
1 2738A00 3A36177800 139C5 2 07 00 1
2 0 0 0 0 00 00 0
3 0 0 0 0 00 00 0
Here is an excerpt from Paragon Drive Backup stubact.log:
Disk 7 (Basic) Size: 238475 Mb Model: WDC WD25 00BEVE-00WZT0 USB Device Serial:
Online: 1
CHSSectors: 0x000000001D1C4581(4883920
FullSectors: 0x000000001D1C5970(4883971
C: 0x000076C1(30401)
H: 0x000000FF(255)
S: 0x0000003F(63)
PARTITION L SLOT TYPE FSTYPE START END SIZE FS_SIZE USED CLST START_C___H___S END_C___H___S LABEL
Primary E 0 6 FAT16 3F 139C4 13986 13985 2E5C 2 0 1 1 4 FE 3F DellUtility
Primary 1 7 NTFS 139C5 1D1C4580 1D1B0BBC 1D1B0BBB 7A1A88C 8 5 0 1 76C0 FE 3F
I've seen many forum discussions about this RAW issue, and it's clear there are a number of different causes and solutions, but so far I haven't found anything to solve my version of the issue.
Can anyone help?
Thanks,
-Tom
We have a Windows XP Home laptop that failed to boot, showing a blinking cursor after POST. I plugged the HD into a USB-PATA adapter and my Windows 7 desktop initially recognized it OK and I could see all the files.
I had to move the USB-PATA adapter and drive to a different Windows 7 computer to actually work on it, and now it reports as "RAW" in Disk Manager. The Dell recovery partition shows up OK as FAT16 and is readable, but the main partition just has a drive letter, and is recognized as RAW instead of NTFS, and is not accessible in Windows.
I have plugged it into 3 different Windows 7 PCs and a working Windows XP PC, and they all have similar results: They assign a drive letter, report "Healthy" in Disk Manager, but they don't say "NTFS" (the Windows 7 PCs say "RAW"), and no files/folders are visible.
I have looked at the disk with TestDisk and demo versions of Active@ Partition Recovery, GetDataBack, Paragon Partition Manager, and EASUS Partition Recovery. They all find the NTFS partition with no problem, and they all give no indication that they found a problem that their paid version could fix.
I successfully copied all the important data files to a new drive using TestDisk and it had no problems reading them.
I would like to repair the file system on this drive so we don't have to reinstall Windows, and I would gladly purchase the licensed version of any of the above programs if one of them seemed to indicate that it found something to fix. But they are all oddly similar in that they just read the NTFS file system and show all the files/folders without indicating that anything is broken.
I'd feel more comfortable if they all reported "Your NTFS file system is corrupted, click here to buy the full version so I can fix it". But they just show me the files as if nothing is wrong!
In TestDisk, the drive shows up like this:
1 * FAT16 >32M 0,1,1 4,254,63 80262 [DellUtility]
2 P HPFS - NTFS 5,0,1 30400,254,63 488311740 [Laptop]
Indicating that the OS partition is a Primary partition ("P"), not overlapping with with the DellUtility partition, which is a Primary Active partition ("*"). This looks fine to me, and I had TestDIsk write what it found to the partition table, with no change in results.
After much Googling and searching here on EE, I tried a few other things, also with no change:
1. In TestDisk, Toggled partition type to FAT32, disconnected, toggled back to HPFS-NTFS to see if re-writing the partition would fix something. I verified the change with Paragon Drive Backup in between toggling to make sure it was really seen as FAT32.
2. In TestDisk, Re-wrote Boot sector and MBR from backups; regenerated Boot sector, as per TestDisk Wiki.
3. In Paragon Partition Manager, changed the partition label from {blank} to "Laptop" because somebody reported that this was enough to "Wake up" the file system to Windows.
Here is an excerpt from Paragon Drive Backup BioNtLog.txt:
IDSector info: IDE Disk 7, word106 == 0x0
==========================
Disk #7 ( 238472 MB )
Cylinders 76C1, Tracks/Cylinder FF, SectorsPerTrack 3F, BytesPerSector 200, TotalSectors 1D1C4581
Media type: Fixed hard disk
==========================
IDE Information:
Primary Controller - Master drive
CHS: 0x0(0x0), 0x0(0x0), 0x0(0x0)
Total Sectors: 0x00000000(0x00000000)
Model number : WDC WD25
Firmware rev :
Serial number:
GetDriveLayOut ... OK
====== Drive LayOutEx Information ==========================
PartitionStyle MBR
PartEntry# StartingOffSet PartitionLength HidSect PartNumber PT BI Recgnz
---------- -------------- --------------- ------- ---------- -- -- ------
0 7E00 2730C00 3F 1 06 01 1
1 2738A00 3A36177800 139C5 2 07 00 1
2 0 0 0 0 00 00 0
3 0 0 0 0 00 00 0
Here is an excerpt from Paragon Drive Backup stubact.log:
Disk 7 (Basic) Size: 238475 Mb Model: WDC WD25 00BEVE-00WZT0 USB Device Serial:
Online: 1
CHSSectors: 0x000000001D1C4581(4883920
FullSectors: 0x000000001D1C5970(4883971
C: 0x000076C1(30401)
H: 0x000000FF(255)
S: 0x0000003F(63)
PARTITION L SLOT TYPE FSTYPE START END SIZE FS_SIZE USED CLST START_C___H___S END_C___H___S LABEL
Primary E 0 6 FAT16 3F 139C4 13986 13985 2E5C 2 0 1 1 4 FE 3F DellUtility
Primary 1 7 NTFS 139C5 1D1C4580 1D1B0BBC 1D1B0BBB 7A1A88C 8 5 0 1 76C0 FE 3F
I've seen many forum discussions about this RAW issue, and it's clear there are a number of different causes and solutions, but so far I haven't found anything to solve my version of the issue.
Can anyone help?
Thanks,
-Tom
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
The data recovery software showing all files like there is nothing wrong does not mean there is actually nothing wrong.
There are several things recovery software will rebuild during processing without any announcement, and sometimes even without knowing what exactly is missing. This includes boot sector(s) and first records of MFT. Boot sectors can actually be reconstructed and fixed in-place, but missing MFT records cannot be produced with enough reliability.
Also, seemingly valid boot sectors are sometimes rejected, although this is in most cases fixed by just copying the backup boot sector over.
There are several things recovery software will rebuild during processing without any announcement, and sometimes even without knowing what exactly is missing. This includes boot sector(s) and first records of MFT. Boot sectors can actually be reconstructed and fixed in-place, but missing MFT records cannot be produced with enough reliability.
Also, seemingly valid boot sectors are sometimes rejected, although this is in most cases fixed by just copying the backup boot sector over.
OK guys, pay attention! The fact that the drive is reporting as an incomplete model SCREAMS that it is failing. That he was able to backup the files is, itself, a very lucky happenstance.
If you want to prove it, get the free version of http://www.hdtune.com and run the error scan. I'll bet there are red boxes.
Now; if you want tthe best possible outcome, buy a replacement drive ( http://compare.ebay.com/like/170632874004?var=lv<yp=AllFixedPriceItemTypes&var=sbar&_lwgsi=y ),
get RoadKill's RawCopy ( http://www.roadkil.net/program.php?ProgramID=22 ), use it to clone the failing drive, and, afterwards, I'll bet it will be tivial to fix the partition.
If you want to prove it, get the free version of http://www.hdtune.com and run the error scan. I'll bet there are red boxes.
Now; if you want tthe best possible outcome, buy a replacement drive ( http://compare.ebay.com/like/170632874004?var=lv<yp=AllFixedPriceItemTypes&var=sbar&_lwgsi=y ),
get RoadKill's RawCopy ( http://www.roadkil.net/program.php?ProgramID=22 ), use it to clone the failing drive, and, afterwards, I'll bet it will be tivial to fix the partition.
When plug in to orher computer try going to.cmd and typing fdisk /mbr
ASKER
hanccocka: I had tried the Windows-based error checking, and it couldn't deal with RAW, so it didn't even occur to me to try CHKDSK at the command prompt. I ran that and it found and fixed lots of issues, and now the drive is visible in Windows.
I don't know if the original laptop will boot on it yet, but I will try that shortly.
I don't know if the original laptop will boot on it yet, but I will try that shortly.
REPLACE THAT DRIVE ASAP.. You are lucky now.. maybe the next time you will lose everything..
Every drive manufacturer has a free software diagnostic utility you can download to determine the status of the drive. From your description I expect it will show the drive is failing.
time now to backup, with ghost, acronis or drive snapshot - free.
ASKER
I'm now back to the original problem....I just get a black screen with a blinking cursor after BIOS POST. I see there are other posts here for that issue, so I will explore them for a solution to that problem. Thanks everyone for the input. Hanccocka made the suggestion that solved the specific problem that I opened this question for, so I think all the points should go there. Anyone disagree?
MidnightOne: I already copied the important data off the drive with TestDisk, so a backup image isn't necessary at this point (other than to get me back to this point if something I try makes it worse)
DavisMcCarn: HDTune shows all green squares. I'll definitely put the drive through its paces before giving it back to the client though.
ComputerTechie: I don't think fdisk exists in Windows 7 (am I wrong?), but I did rebuild the MBR in TestDisk, and used fixboot and fixmbr in the Windows XP recovery console (didn't help).
Everyone: Yes, I'll replace the drive if I can't be 100% sure it's OK. Thanks for your help.
MidnightOne: I already copied the important data off the drive with TestDisk, so a backup image isn't necessary at this point (other than to get me back to this point if something I try makes it worse)
DavisMcCarn: HDTune shows all green squares. I'll definitely put the drive through its paces before giving it back to the client though.
ComputerTechie: I don't think fdisk exists in Windows 7 (am I wrong?), but I did rebuild the MBR in TestDisk, and used fixboot and fixmbr in the Windows XP recovery console (didn't help).
Everyone: Yes, I'll replace the drive if I can't be 100% sure it's OK. Thanks for your help.
now the drive is toast.. you had your warnings. spinrite (http://www.grc.com/spinrite) might rescue the drive or with regular use may prevent it from happening but it costs money (more than your replacement drive)
I do recommend replacing the drive at this point. It sounds like it staring to generate smart error and will fail soon.
CT
CT
The fact that HDTune gave a clean bill of health says that the drive is (almost undoubtedly) OK. The real tell is on the Health tab and the value for Reallocated Sector(s) which had better be zero; but, HDTune needs an update as it is hit or miss, often displaying a blank Health page.
At this point, the question is what caused the system to stop booting in the first place and, INHO, there is a strong probability of a Trojan. Look in Windows\System32\Config and if SAM and/or SECURITY are 256KB, the probability rises to 90+%. Both should be less than 80KB on most systems. If this is the case, run a complete virus scan on the drive, please.
What O/S was booting on the drive, what model Dell was it in, and, did an AV scan find anything?
At this point, the question is what caused the system to stop booting in the first place and, INHO, there is a strong probability of a Trojan. Look in Windows\System32\Config and if SAM and/or SECURITY are 256KB, the probability rises to 90+%. Both should be less than 80KB on most systems. If this is the case, run a complete virus scan on the drive, please.
What O/S was booting on the drive, what model Dell was it in, and, did an AV scan find anything?
ASKER
"Error-checking" under the tools tab for the drive properties couldn't recognize the drive and was unable to attempt to check it, so it didn't even occur to me to try chkdsk. Thanks for pointing out a simple solution to this problem.
Hmmmm... I have a 160GB drive that windows sees as RAW (though TestDisk and GParted both insist it is HPFS-NTFS), and XP's CHKDSK says it won't run on RAW drives.
Have you taken a look at Ultimate Boot CD to see if there's a Windows XP MBR utility on there? It's been a while since I've had to use it and really just don't remember.