[转]RAW FileSystem Recovery

• In the partition table (MBR, sometimes referred to as a legacy-style partition) or in the LDM database (when dynamic disks are used).
• In the volume boot sector.

Three significantly different combinations are thus possible.

• Both partition table and volume boot sector provide consistent information about the filesystem type. This is how the things are supposed to be when the volume is online and operational.
• Only one of these places contains proper information, or the information is contradictory (e.g. partition table lists the volume as NTFS, while the boot sector indicates it is the FAT32).
• Neither partition table nor volume boot sector contain filesystem type information (the partition table will in this case indicate the special filesystem type of zero, i.e. unused volume). This can happen during normal operation and is pretty legal configuration state. It appears when you create a volume (e.g. using Disk Management applet) but do not format it at the same time. You can even assign a drive letter to this unformatted volume, as illustrated below (notice the underlined "H:" drive which has no filesystem type defined).

If the volume filesystem type information is unavailable, attempting CHKDSK against the volume will result in the following message:

The type of the filesystem is RAW.
CHKDSK is not available for RAW drives.

Sometimes, the volume fails in such a way that it becomes RAW. In most cases the failure will be associated with a sudden reboot (per power failure or the STOP error). Several causes are possible: partition table, LDM database, or the volume boot sector corruption, or (on the NTFS volume) when certain records in both MFT and MFT mirror are damaged beyond easy recognition.

"RAW filesystem" recovery expectations

Notice the highlighted volume - it is the same H: volume featured in the earlier screenshot. It has the correct size (128MB) and the correct on-disk location (starting at 200+40+40 = 280MB from the start of disk), but the filesystem type of "Large FAT16" is not a good bet because the volume is in fact NTFS - the filesystem type information in the LDM database got corrupt (yeah, I know because I did it in purpose). This fact will be later discovered by ZAR and the appropriate decision will be made to treat the volume as NTFS, and in this test case an exact recovery is ultimately achieved.

In a real world case, the recovery expectations vary depending on the damage profile and locality. Overall, I'd expect a good yield. Exact recovery is possible if the damage is confined to the boot sector(s) and/or partition table (however there is no easy way to tell if it is). Suggested course of action is thus as usual: to download our data recovery tool (click here for a download page) and try it. Be sure to check this page as well.

TraceBack: http://www.z-a-recovery.com/art-raw-filesystem.htm