Monday, May 27, 2019

mbr - How to fix a partition detected as RAW, when Chkdsk correctly reads it as NTFS?


My external HDD suddenly started reporting as "931.51 GB RAW (Primary)" in Windows disk management.


I tried using DiskInternals Partition Recovery, which indeed reported the drive being only seen as RAW, easily found a partition at sector 2048, spanning the full size of the disk, detected an NTFS system on it... and then it completely failed to find any files.


DISKPART sees the partition as RAW.


ChkDsk H:, however, DOES detect it as NTFS and checks the filesystem (finding indexing errors in file descriptor 5, which is root folder ".", so thus far I only ran it in read-only mode out of caution).


MiniTool, another recovery program, immediately noticed the disk, with a correct volume label and explorable contents, even without running a recovery pass, but the free version doesn't let me copy files.


Finally, TestDisk is able to read the disk's contents without any problems, without running a specialized recovery pass - it accesses the NTFS system as if everything was fine.


Reading the disk in hex mode, I see the MBR area is completely empty (all zeroes) except for a serial number and one, seemingly correct, partition entry:


0000000000: 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00
....
00000001A0: 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00
00000001B0: 00 00 00 00 00 00 00 00 │ 39 72 8E 13 00 00 00 20 <- serial, part.type
00000001C0: 21 00 07 FE FF FF 00 08 │ 00 00 AC 65 70 74 00 00 <- partition 1
00000001D0: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
00000001E0: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
00000001F0: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 55 AA <- magic
....
00000FFFF0: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0000100000: EB 52 90 4E 54 46 53 20 │ 20 20 20 00 02 08 00 00 <- NTFS

The partition is of type 07, so it's NTFS, starts at sector 2048, and actually the filesystem is still there - at offset 0x100000 (2048*512 sector size) a nice NTFS system starts. So it seems all to be there.


From the looks of it, I'd expect Windows to see the disk as an NTFS partition and maybe require a filesystem check - not see it as not formatted at all.


Does that mean that the disk is readable and fine, but somehow Windows can't access it? Or did Windows cache the MBR (as I have not rebooted the machine yet)? Or maybe I don't even need an MBR, since this is not a bootable drive, merely an external USB storage unit?


What should I do to make Windows recognize the NTFS partition, if it's all there, intact and apparently healthy enough to be read without sector-by-sector recovery passes? Should I let chkdsk H: /f run and maybe try to fix it? (I haven't tried yet, as I heard chkdsk destroys data in some fringe cases)


(This is not a generic "how do I recover my data?" question, recovery wasn't that big of an issue in this case, as there was no unique data on that disk - it's more of a "what's missing, why doesn't it work, can it be fixed instead of recovered?" question. Most "RAW partition" trouble reports involve CHKDSK refusing to operate on a RAW partition; here, CHKDSK works fine, oddly enough.)


Answer



In the end, after I used TestDisk to copy all the important files off the disk, I finally risked running chkdsk /f and it didn't detect any problems, but apparently removed the "requires checking" flag set after a careless disconnection, and so afterwards the disk was perfectly fine.


I felt a bit silly afterwards, having gone all PhD on the disk, when all it needed was a routine check, but maybe the disk-salvage tools should be able to recognize the "requires checking" flag...


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...