NTFS drive shows up as RAW in Windows, but all recovery software reads it OK

trusnock
trusnock used Ask the Experts™
on
Hello,
We have a Windows XP Home laptop that failed to boot, showing a blinking cursor after POST.  I plugged the HD into a USB-PATA adapter and my Windows 7 desktop initially recognized it OK and I could see all the files.

I had to move the USB-PATA adapter and drive to a different Windows 7 computer to actually work on it, and now it reports as "RAW" in Disk Manager.  The Dell recovery partition shows up OK as FAT16 and is readable, but the main partition just has a drive letter, and is recognized as RAW instead of NTFS, and is not accessible in Windows.

I have plugged it into 3 different Windows 7 PCs and a working Windows XP PC, and they all have similar results: They assign a drive letter, report "Healthy" in Disk Manager, but they don't say "NTFS" (the Windows 7 PCs say "RAW"), and no files/folders are visible.

I have looked at the disk with TestDisk and demo versions of Active@ Partition Recovery, GetDataBack, Paragon Partition Manager, and EASUS Partition Recovery.  They all find the NTFS partition with no problem, and they all give no indication that they found a problem that their paid version could fix.

I successfully copied all the important data files to a new drive using TestDisk and it had no problems reading them.

I would like to repair the file system on this drive so we don't have to reinstall Windows, and I would gladly purchase the licensed version of any of the above programs if one of them seemed to indicate that it found something to fix.  But they are all oddly similar in that they just read the NTFS file system and show all the files/folders without indicating that anything is broken.

I'd feel more comfortable if they all reported "Your NTFS file system is corrupted, click here to buy the full version so I can fix it".  But they just show me the files as if nothing is wrong!

In TestDisk, the drive shows up like this:

1 * FAT16 >32M        0,1,1   4,254,63       80262 [DellUtility]
2 P HPFS - NTFS   5,0,1   30400,254,63   488311740 [Laptop]

Indicating that the OS partition is a Primary partition ("P"), not overlapping with with the DellUtility partition, which is a Primary Active partition ("*").  This looks fine to me, and I had TestDIsk write what it found to the partition table, with no change in results.

After much Googling and searching here on EE, I tried a few other things, also with no change:

1. In TestDisk, Toggled partition type to FAT32, disconnected, toggled back to HPFS-NTFS to see if re-writing the partition would fix something.  I verified the change with Paragon Drive Backup in between toggling to make sure it was really seen as FAT32.
2. In TestDisk, Re-wrote Boot sector and MBR from backups; regenerated Boot sector, as per TestDisk Wiki.
3. In Paragon Partition Manager, changed the partition label from {blank} to "Laptop" because somebody reported that this was enough to "Wake up" the file system to Windows.


Here is an excerpt from Paragon Drive Backup BioNtLog.txt:

IDSector info: IDE Disk 7, word106 == 0x0
 
  =================================================================================
  Disk #7 ( 238472 MB )
  Cylinders 76C1, Tracks/Cylinder FF, SectorsPerTrack 3F, BytesPerSector 200, TotalSectors 1D1C4581
  Media type: Fixed hard disk
  =================================================================================

  IDE Information:
      Primary Controller     - Master drive
      CHS: 0x0(0x0), 0x0(0x0), 0x0(0x0)
      Total Sectors: 0x00000000(0x00000000)
      Model number :  WDC WD25
      Firmware rev :  
      Serial number:  

  GetDriveLayOut ...   OK
  ====== Drive LayOutEx Information ===================================================
  PartitionStyle MBR
  PartEntry#   StartingOffSet   PartitionLength  HidSect  PartNumber  PT  BI  Recgnz
  ----------   --------------   ---------------  -------  ----------  --  --  ------
          0              7E00           2730C00       3F           1  06  01       1
          1           2738A00        3A36177800    139C5           2  07  00       1
          2                 0                 0        0           0  00  00       0
          3                 0                 0        0           0  00  00       0
 


Here is an excerpt from Paragon Drive Backup stubact.log:

Disk 7 (Basic)    Size: 238475 Mb  Model: WDC WD25 00BEVE-00WZT0 USB Device  Serial:

Online: 1
CHSSectors:  0x000000001D1C4581(488392065)
FullSectors: 0x000000001D1C5970(488397168)

C: 0x000076C1(30401)
H: 0x000000FF(255)
S: 0x0000003F(63)

  PARTITION  L SLOT TYPE FSTYPE    START      END     SIZE  FS_SIZE     USED CLST START_C___H___S    END_C___H___S LABEL
  Primary    E    0   6  FAT16        3F    139C4    13986    13985     2E5C   2        0   1   1        4  FE  3F DellUtility
  Primary         1   7  NTFS      139C5 1D1C4580 1D1B0BBC 1D1B0BBB  7A1A88C   8        5   0   1     76C0  FE  3F


I've seen many forum discussions about this RAW issue, and it's clear there are a number of different causes and solutions, but so far I haven't found anything to solve my version of the issue.

Can anyone help?

Thanks,
-Tom
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017
Commented:
can you run chkdsk /f on the raw drive?
Me, I'd use Find and Mount (http://www.findandmount.com/) from Atola and make a copy of the drive to an image file before doing anything.

Have you taken a look at Ultimate Boot CD to see if there's a Windows XP MBR utility on there? It's been a while since I've had to use it and really just don't remember.
Top Expert 2011

Commented:
The data recovery software showing all files like there is nothing wrong does not mean there is actually nothing wrong.

There are several things recovery software will rebuild during processing without any announcement, and sometimes even without knowing what exactly is missing. This includes boot sector(s) and first records of MFT. Boot sectors can actually be reconstructed and fixed in-place, but missing MFT records cannot be produced with enough reliability.

Also, seemingly valid boot sectors are sometimes rejected, although this is in most cases fixed by just copying the backup boot sector over.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

OK guys, pay attention!  The fact that the drive is reporting as an incomplete model SCREAMS that it is failing.  That he was able to backup the files is, itself, a very lucky happenstance.
If you want to prove it, get the free version of http://www.hdtune.com and run the error scan.  I'll bet there are red boxes.
Now; if you want tthe best possible outcome, buy a replacement drive ( http://compare.ebay.com/like/170632874004?var=lv<yp=AllFixedPriceItemTypes&var=sbar&_lwgsi=y ),
get RoadKill's RawCopy ( http://www.roadkil.net/program.php?ProgramID=22 ), use it to clone the failing drive, and, afterwards, I'll bet it will be tivial to fix the partition.
When plug in to orher computer try going to.cmd and typing fdisk /mbr

Author

Commented:
hanccocka: I had tried the Windows-based error checking, and it couldn't deal with RAW, so it didn't even occur to me to try CHKDSK at the command prompt.  I ran that and it found and fixed lots of issues, and now the drive is visible in Windows.

I don't know if the original laptop will boot on it yet, but I will try that shortly.
Top Expert 2016

Commented:
REPLACE THAT DRIVE ASAP.. You are lucky now.. maybe the next time you will lose everything..

Commented:
Every drive manufacturer has a free software diagnostic utility you can download to determine the status of the drive. From your description I expect it will show the drive is failing.
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

Commented:
time now to backup, with ghost, acronis or drive snapshot - free.

Author

Commented:
I'm now back to the original problem....I just get a black screen with a blinking cursor after BIOS POST.  I see there are other posts here for that issue, so I will explore them for a solution to that problem.  Thanks everyone for the input.  Hanccocka made the suggestion that solved the specific problem that I opened this question for, so I think all the points should go there.  Anyone disagree?

MidnightOne: I already copied the important data off the drive with TestDisk, so a backup image isn't necessary at this point (other than to get me back to this point if something I try makes it worse)

DavisMcCarn: HDTune shows all green squares.  I'll definitely put the drive through its paces before giving it back to the client though.

ComputerTechie: I don't think fdisk exists in Windows 7 (am I wrong?), but I did rebuild the MBR in TestDisk, and used fixboot and fixmbr in the Windows XP recovery console (didn't help).

Everyone: Yes, I'll replace the drive if I can't be 100% sure it's OK.  Thanks for your help.


Top Expert 2016

Commented:
now the drive is toast.. you had your warnings. spinrite (http://www.grc.com/spinrite) might rescue the drive or with regular use may prevent it from happening but it costs money (more than your replacement drive)
I do recommend replacing the drive at this point. It sounds like it staring to generate smart error and will fail soon.

CT
The fact that HDTune gave a clean bill of health says that the drive is (almost undoubtedly) OK.  The real tell is on the Health tab and the value for Reallocated Sector(s) which had better be zero; but, HDTune needs an update as it is hit or miss, often displaying a blank Health page.

At this point, the question is what caused the system to stop booting in the first place and, INHO, there is a strong probability of a Trojan.  Look in Windows\System32\Config and if SAM and/or SECURITY are 256KB, the probability rises to 90+%.  Both should be less than 80KB on most systems.  If this is the case, run a complete virus scan on the drive, please.

What O/S was booting on the drive, what model Dell was it in, and, did an AV scan find anything?

Author

Commented:
"Error-checking" under the tools tab for the drive properties couldn't recognize the drive and was unable to attempt to check it, so it didn't even occur to me to try chkdsk.  Thanks for pointing out a simple solution to this problem.
Hmmmm...  I have a 160GB drive that windows sees as RAW (though TestDisk and GParted both insist it is HPFS-NTFS), and XP's CHKDSK says it won't run on RAW drives.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial