We help IT Professionals succeed at work.

Check out this week's podcast, "Dairy Farms to Databases: Community's Hand in Technology"Listen Now

x

NTFS drive shows up as RAW in Windows, but all recovery software reads it OK

16,367 Views
Last Modified: 2012-05-11
Hello,
We have a Windows XP Home laptop that failed to boot, showing a blinking cursor after POST.  I plugged the HD into a USB-PATA adapter and my Windows 7 desktop initially recognized it OK and I could see all the files.

I had to move the USB-PATA adapter and drive to a different Windows 7 computer to actually work on it, and now it reports as "RAW" in Disk Manager.  The Dell recovery partition shows up OK as FAT16 and is readable, but the main partition just has a drive letter, and is recognized as RAW instead of NTFS, and is not accessible in Windows.

I have plugged it into 3 different Windows 7 PCs and a working Windows XP PC, and they all have similar results: They assign a drive letter, report "Healthy" in Disk Manager, but they don't say "NTFS" (the Windows 7 PCs say "RAW"), and no files/folders are visible.

I have looked at the disk with TestDisk and demo versions of Active@ Partition Recovery, GetDataBack, Paragon Partition Manager, and EASUS Partition Recovery.  They all find the NTFS partition with no problem, and they all give no indication that they found a problem that their paid version could fix.

I successfully copied all the important data files to a new drive using TestDisk and it had no problems reading them.

I would like to repair the file system on this drive so we don't have to reinstall Windows, and I would gladly purchase the licensed version of any of the above programs if one of them seemed to indicate that it found something to fix.  But they are all oddly similar in that they just read the NTFS file system and show all the files/folders without indicating that anything is broken.

I'd feel more comfortable if they all reported "Your NTFS file system is corrupted, click here to buy the full version so I can fix it".  But they just show me the files as if nothing is wrong!

In TestDisk, the drive shows up like this:

1 * FAT16 >32M        0,1,1   4,254,63       80262 [DellUtility]
2 P HPFS - NTFS   5,0,1   30400,254,63   488311740 [Laptop]

Indicating that the OS partition is a Primary partition ("P"), not overlapping with with the DellUtility partition, which is a Primary Active partition ("*").  This looks fine to me, and I had TestDIsk write what it found to the partition table, with no change in results.

After much Googling and searching here on EE, I tried a few other things, also with no change:

1. In TestDisk, Toggled partition type to FAT32, disconnected, toggled back to HPFS-NTFS to see if re-writing the partition would fix something.  I verified the change with Paragon Drive Backup in between toggling to make sure it was really seen as FAT32.
2. In TestDisk, Re-wrote Boot sector and MBR from backups; regenerated Boot sector, as per TestDisk Wiki.
3. In Paragon Partition Manager, changed the partition label from {blank} to "Laptop" because somebody reported that this was enough to "Wake up" the file system to Windows.


Here is an excerpt from Paragon Drive Backup BioNtLog.txt:

IDSector info: IDE Disk 7, word106 == 0x0
 
  =================================================================================
  Disk #7 ( 238472 MB )
  Cylinders 76C1, Tracks/Cylinder FF, SectorsPerTrack 3F, BytesPerSector 200, TotalSectors 1D1C4581
  Media type: Fixed hard disk
  =================================================================================

  IDE Information:
      Primary Controller     - Master drive
      CHS: 0x0(0x0), 0x0(0x0), 0x0(0x0)
      Total Sectors: 0x00000000(0x00000000)
      Model number :  WDC WD25
      Firmware rev :  
      Serial number:  

  GetDriveLayOut ...   OK
  ====== Drive LayOutEx Information ===================================================
  PartitionStyle MBR
  PartEntry#   StartingOffSet   PartitionLength  HidSect  PartNumber  PT  BI  Recgnz
  ----------   --------------   ---------------  -------  ----------  --  --  ------
          0              7E00           2730C00       3F           1  06  01       1
          1           2738A00        3A36177800    139C5           2  07  00       1
          2                 0                 0        0           0  00  00       0
          3                 0                 0        0           0  00  00       0
 


Here is an excerpt from Paragon Drive Backup stubact.log:

Disk 7 (Basic)    Size: 238475 Mb  Model: WDC WD25 00BEVE-00WZT0 USB Device  Serial:

Online: 1
CHSSectors:  0x000000001D1C4581(488392065)
FullSectors: 0x000000001D1C5970(488397168)

C: 0x000076C1(30401)
H: 0x000000FF(255)
S: 0x0000003F(63)

  PARTITION  L SLOT TYPE FSTYPE    START      END     SIZE  FS_SIZE     USED CLST START_C___H___S    END_C___H___S LABEL
  Primary    E    0   6  FAT16        3F    139C4    13986    13985     2E5C   2        0   1   1        4  FE  3F DellUtility
  Primary         1   7  NTFS      139C5 1D1C4580 1D1B0BBC 1D1B0BBB  7A1A88C   8        5   0   1     76C0  FE  3F


I've seen many forum discussions about this RAW issue, and it's clear there are a number of different causes and solutions, but so far I haven't found anything to solve my version of the issue.

Can anyone help?

Thanks,
-Tom
Comment
Watch Question

VMware and Virtualization Consultant
CERTIFIED EXPERT
Fellow
Expert of the Year 2017
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
Me, I'd use Find and Mount (http://www.findandmount.com/) from Atola and make a copy of the drive to an image file before doing anything.

Have you taken a look at Ultimate Boot CD to see if there's a Windows XP MBR utility on there? It's been a while since I've had to use it and really just don't remember.
Top Expert 2011

Commented:
The data recovery software showing all files like there is nothing wrong does not mean there is actually nothing wrong.

There are several things recovery software will rebuild during processing without any announcement, and sometimes even without knowing what exactly is missing. This includes boot sector(s) and first records of MFT. Boot sectors can actually be reconstructed and fixed in-place, but missing MFT records cannot be produced with enough reliability.

Also, seemingly valid boot sectors are sometimes rejected, although this is in most cases fixed by just copying the backup boot sector over.
CERTIFIED EXPERT

Commented:
OK guys, pay attention!  The fact that the drive is reporting as an incomplete model SCREAMS that it is failing.  That he was able to backup the files is, itself, a very lucky happenstance.
If you want to prove it, get the free version of http://www.hdtune.com and run the error scan.  I'll bet there are red boxes.
Now; if you want tthe best possible outcome, buy a replacement drive ( http://compare.ebay.com/like/170632874004?var=lv<yp=AllFixedPriceItemTypes&var=sbar&_lwgsi=y ),
get RoadKill's RawCopy ( http://www.roadkil.net/program.php?ProgramID=22 ), use it to clone the failing drive, and, afterwards, I'll bet it will be tivial to fix the partition.
When plug in to orher computer try going to.cmd and typing fdisk /mbr

Author

Commented:
hanccocka: I had tried the Windows-based error checking, and it couldn't deal with RAW, so it didn't even occur to me to try CHKDSK at the command prompt.  I ran that and it found and fixed lots of issues, and now the drive is visible in Windows.

I don't know if the original laptop will boot on it yet, but I will try that shortly.
David Johnson, CDSimple Geek from the '70s
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
REPLACE THAT DRIVE ASAP.. You are lucky now.. maybe the next time you will lose everything..

Commented:
Every drive manufacturer has a free software diagnostic utility you can download to determine the status of the drive. From your description I expect it will show the drive is failing.
Andrew Hancock (VMware vExpert PRO / EE Fellow)VMware and Virtualization Consultant
CERTIFIED EXPERT
Fellow
Expert of the Year 2017

Commented:
time now to backup, with ghost, acronis or drive snapshot - free.

Author

Commented:
I'm now back to the original problem....I just get a black screen with a blinking cursor after BIOS POST.  I see there are other posts here for that issue, so I will explore them for a solution to that problem.  Thanks everyone for the input.  Hanccocka made the suggestion that solved the specific problem that I opened this question for, so I think all the points should go there.  Anyone disagree?

MidnightOne: I already copied the important data off the drive with TestDisk, so a backup image isn't necessary at this point (other than to get me back to this point if something I try makes it worse)

DavisMcCarn: HDTune shows all green squares.  I'll definitely put the drive through its paces before giving it back to the client though.

ComputerTechie: I don't think fdisk exists in Windows 7 (am I wrong?), but I did rebuild the MBR in TestDisk, and used fixboot and fixmbr in the Windows XP recovery console (didn't help).

Everyone: Yes, I'll replace the drive if I can't be 100% sure it's OK.  Thanks for your help.


David Johnson, CDSimple Geek from the '70s
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
now the drive is toast.. you had your warnings. spinrite (http://www.grc.com/spinrite) might rescue the drive or with regular use may prevent it from happening but it costs money (more than your replacement drive)
I do recommend replacing the drive at this point. It sounds like it staring to generate smart error and will fail soon.

CT
CERTIFIED EXPERT

Commented:
The fact that HDTune gave a clean bill of health says that the drive is (almost undoubtedly) OK.  The real tell is on the Health tab and the value for Reallocated Sector(s) which had better be zero; but, HDTune needs an update as it is hit or miss, often displaying a blank Health page.

At this point, the question is what caused the system to stop booting in the first place and, INHO, there is a strong probability of a Trojan.  Look in Windows\System32\Config and if SAM and/or SECURITY are 256KB, the probability rises to 90+%.  Both should be less than 80KB on most systems.  If this is the case, run a complete virus scan on the drive, please.

What O/S was booting on the drive, what model Dell was it in, and, did an AV scan find anything?

Author

Commented:
"Error-checking" under the tools tab for the drive properties couldn't recognize the drive and was unable to attempt to check it, so it didn't even occur to me to try chkdsk.  Thanks for pointing out a simple solution to this problem.
CERTIFIED EXPERT

Commented:
Hmmmm...  I have a 160GB drive that windows sees as RAW (though TestDisk and GParted both insist it is HPFS-NTFS), and XP's CHKDSK says it won't run on RAW drives.
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.