Monday, December 31, 2012


CHKDSK: "RAW filesystem" message

Symptoms
Sometimes a damaged volume may look like it lost its filesystem type. Various error messages may appear, most common beingThe volume X: is not formatted. Do you want to format it now?
The disk in drive X: is not formatted.

There was an error accessing drive X:. The disk is not formatted.
Also a CHKDSK tool will complain that it is unable to perform a RAW filesystem recovery.
The type of the filesystem is RAW.
CHKDSK is not available for RAW drives.
How to recover data from RAW filesystem
ZAR data recovery software will in most cases handle such a situation pretty well. Please refer to the tutorial for step-by-step instructions.
Technical details
To know how to deal with it, we need to discuss the basics first. The filesystem type is recorded at least in two separate places
  • In the partition table (MBR, sometimes referred to as a legacy-style partition) or in the LDM database (when dynamic disks are used).
  • In the volume boot sector.
Three significantly different combinations are thus possible.
  • Both partition table and volume boot sector provide consistent information about the filesystem type. This is how the things are supposed to be when the volume is online and operational.
  • Only one of these places contains proper information, or the information is contradictory (e.g. partition table lists the volume as NTFS, while the boot sector indicates it is the FAT32).
  • Neither partition table nor volume boot sector contains filesystem type information (the partition table will in this case indicate the special filesystem type of zero, i.e. unused volume). This can happen during normal operation and is pretty legal configuration state. It appears when you create a volume (e.g. using Disk Management applet) but do not format it at the same time. You can even assign a drive letter to this unformatted volume, as illustrated below (notice the underlined "H:" drive which has no filesystem type defined).
RAW filesystem - undefined filesystem type in Disk Manager
If the volume filesystem type information is unavailable, attempting CHKDSK against the volume will result in the following message:
The type of the filesystem is RAW.
CHKDSK is not available for RAW drives.

Sometimes, the volume fails in such a way that it becomes RAW. In most cases the failure will be associated with a sudden reboot (per power failure or the STOP error). Several causes are possible: partition table, LDM database, or the volume boot sector corruption, or (on the NTFS volume) when certain records in both MFT and MFT mirror are damaged beyond easy recognition.
"RAW filesystem" recovery expectations
The data recovery should not be complicated because the volume location info is still available. Be advised that some arbitrary filesystem type may be associated with the volume when you attempt to identify it amongst the list of the available volumes.
RAW filesystem volume errorneously interpreted as FAT16
Notice the highlighted volume - it is the same H: volume featured in the earlier screenshot. It has the correct size (128MB) and the correct on-disk location (starting at 200+40+40 = 280MB from the start of disk), but the filesystem type of "Large FAT16" is not a good bet because the volume is in fact NTFS - the filesystem type information in the LDM database got corrupt (yeah, I know because I did it in purpose). This fact will be later discovered  and the appropriate decision will be made to treat the volume as NTFS, and in this test case an exact recovery is ultimately achieved.
In a real world case, the raw partition recovery expectations vary depending on the damage profile and locality. Overall, I'd expect a good yield. Exact raw partition recovery is possible if the damage is confined to the boot sector(s) and/or partition table (however there is no easy way to tell if it is). Suggested course of action is thus as usual: to downloadnd try it.

No comments:

Post a Comment