Change the file system of the raw flash drive. RAW file system: how to return NTFS

Let us describe the process of manual data recovery in the case of deleted files or files from damaged partitions of the NTFS system when working in Windows NT. The problem is that this OS does not have the appropriate software tools. Third-party NTFS data recovery programs, unfortunately, do not always use all recovery options. The situation is exacerbated by the lack of complete documentation of the low-level structure of NTFS control blocks.

What to do if at one fine moment it turns out that a computer with Windows NT is no longer bootable, or some NTFS logical partitions have suddenly become inaccessible?

First you need to clarify what the malfunction is related to: physical damage to the disk, controller failure, or destruction of the NTFS file system.

Disk problems

Hard drives have a limited lifespan, usually a few years. Device failure can sometimes be identified by characteristic clicks at the time of initialization. The disk may click and die down several times without spinning up. During initialization, the BIOS will notify you of this problem. In such a situation, one should hard repair disk. If the cost of the lost information significantly exceeds the cost of the disk itself, you should contact the specialists, which, however, is not cheap.

Repair is carried out as follows. If the electronics located outside the sealed space of the disk fails, then the corresponding board is replaced or repaired. To do this, you often have to disassemble another disk of exactly the same type.

In the event that the parts located inside the disk case are damaged, there will be more problems. First of all, you need to disassemble a broken disk in the so-called "clean room", where the absence of dust is guaranteed. Then you should replace the electronics board by removing it from another disk. The repaired disk is closed, after which it remains only to copy the information to the third disk by sector.

So if it's broken HDD with valuable information, get ready to sacrifice another one for repairs and find a third one to copy the recovered data.

If there is a suspicion that the disk controller is malfunctioning, try replacing it. Also check the connecting cable.

File system issues

After making sure that the disk, controller and connecting cable are working, do not rush to use the NT Repair Disk created during OS installation or run the file recovery program. chkdsk systems- the result can be disastrous. Also, don't try to find the "magic" NTFS recovery program in Norton Utilities for Windows NT - it's not there yet. If the information written on the disk is of particular value, you must first analyze the state of the control blocks of the NTFS file system using the disk editor.

Such work requires a fairly high qualification. In particular, you need to understand the formats of the control blocks of the file system. If you are unable to do it yourself, it is best to call a specialist and not attempt to repair NTFS yourself.

To check the control units, you need to connect two disks to the computer: the first, a working boot disk, and the second one, the one from which information needs to be restored.

First, only the first disk is connected and Windows NT is installed. This disk will be used to save files recovered from damaged partitions. Next, the Disk Probe editor, which is part of the Windows NT Resource Kit, is installed. Although this editor is far from perfect, it is he who will do all the work of recovering lost files.

After making sure that everything is in order with the first disk, turn off the computer and connect the second, damaged disk to it.

Determining the LUN Geometry

For successful data recovery, you should determine the cluster size and boot sector address. The first value can be obtained from the boot sector of the NTFS partition (if, of course, its contents have been preserved).

Launch Disk Probe. Select Physical Drive from the Drive menu. In the Open Physical Drive panel that appears on the screen, specify the PhysicalDrive1 device by double-clicking the corresponding line of the Available Physical Drives list with the left mouse button. Then press the Set Active button, leaving the Read Only switch on, and close the panel with the OK button.

As a result, Disk Probe will have read access damaged disk. After that, try to read the contents of the master boot record of the disk, located in the first sector on the zero track of the zero cylinder. To do this, select the Read line from the Sectors menu. The Read Sector panel appears. In the Starting Sector field, specify the number of the first sector, equal to zero, and in the Numbers of Sectors field, set the value to 1. Then click the Read button.

The program reads the contents of the first sector into RAM and displays it in hexadecimal form. Select the Partition Table line from the View menu to format the disk partition table, and then navigate to the desired partition using the Go button. If necessary (when recovering files from an extended partition), repeat this procedure several times.

Having reached the boot record of the partition you need, select the NTFS Bootsector line from the View menu.

But what if the master boot record or boot record of the desired partition is destroyed?

This situation is severe, but not fatal. A detailed mapping table of NTFS LUN capacity and number of clusters can be found on MSDN. For example, if the capacity is in the range of 1025 - 2048 MB, the cluster size will be 4 sectors, and if it is in the range from 8193 to 16384 MB, then there will be 32 sectors in one cluster. Note, however, that by taking care in advance of the possibility of subsequent recovery of the disk in case of damage, it is possible to facilitate such work when the need arises. You need to determine and record the cluster size immediately after installing the OS, while the NTFS boot sector is still intact.

In the event that the cluster size remains unknown, it will have to be determined indirectly or by selection.

MFT table

The internal structure of the NTFS file system is fundamentally different from FAT, which is well known to most. Without going into details, we will present only the information that is necessary to carry out restoration work in it.

File FAT system(and its variant FAT32) stores information about files in several locations on the logical device. A file descriptor containing its name, size, creation date, and the number of the first cluster allocated to it is located in the directory. The File Allocation Table, from which the name of the FAT file system comes from, stores linked list all clusters allocated to the file. And finally, the file itself can be sprayed into clusters.

Such an organization greatly complicates the recovery of files in case of any failures. The integrity of the FAT table is especially critical: if this table is lost or its contents are partially destroyed, information about the clusters allocated to the file disappears. As a result, a file can be assembled with great difficulty from separate clusters, only knowing its contents. In addition, this work requires a lot of time. Therefore, in practice, the disappearance of the FAT table and its copy means a complete loss of files.

The loss of directories makes it impossible to determine the number of the first cluster allocated to a file, its name, and the exact size. In this case, the consequences are not so catastrophic, since "ownerless" chains of clusters remain in the FAT table, which can be easily turned into files. The names of files obtained in this way usually consist of numbers. Note that when crashing directories containing thousands of files, it will be difficult to find the desired file after recovery, unless its contents are at least approximately known.

In the NTFS file system, all information about files is stored in the so-called Master File Table (MFT). The MFT table entries contain sets of descriptors with information about files such as name, creation and modification dates, security attributes, and, most importantly, lists of clusters allocated to files. If the file is small, then it can be stored directly in the MFT table entry.

Therefore, the ability to recover files from damaged NTFS partitions is largely determined by the integrity of the MFT table and its copy.

How to find the MFT table?

Finding the MFT table is quite easy if the boot sector of the NTFS partition is preserved. Click the Go button next to the Clusters to MFT or Clusters to MFT mirr field in the panel shown in fig. 2. To view the contents of the first sector of the table, select the Bytes line from the View menu of the Disk Probe program.

Pay attention to the FILE line located at the very beginning of the sector. The table entries describing the files begin with it. There are also entries for directories, index entries, and others that we won't cover.

The string $.M.F.T. is at offset D2. This is the name of the system file containing the MFT table in Unicode. Thus, the first entry in the $MFT file describes the file itself. Looking through the table, you can find entries for other system files, such as $MFTMirror, $LogFile, $Volume, $AttrDef, etc.

If the boot sector is corrupted, the start of the MFT table is easy to find with Disk Probe. To do this, select the Search Sector line in the Tools menu, set the switches to the position shown in fig. 4, and after filling in the Enter characters to search for field, press the Search button. Be patient, as the search process can take a lot of time.

Note that in a similar way you can find entries in the MFT table for those files that need to be restored. Since filenames are stored in Unicode encoding, you should set the radio button to Unicode characters when searching. In addition, Exhaustive search and Ignore case must be enabled.

Analysis of MFT records

Unfortunately, the Disk Probe program does not contain any means for formatting the contents of MFT records. Moreover, the exact format of this entry is not available in Microsoft's public documentation. However, much can be found on the Internet by querying keywords NTFS Documentation. For example, we managed to find information collected by the developers of modules for the operating Linux systems. Analyzing the source codes of the module for mounting the NTFS file system in Linux, one can understand the purpose of individual fields of MFT records (the authors are grateful to Maxim Sinev for his help in "decrypting" MFT records).

An MFT record consists of an initial fragment of a fixed size and a set of attributes that are generally of variable size. To recover files, you only need to know the exact format of the data attribute. As for other attributes, it is enough to be able to determine their location and size.

The first four bytes in the entry describing the file form the word FILE. On fig. 3 are highlighted in red. The next two bytes (highlighted in blue) are the offset of the so-called Fixup area. In this case, the offset value is 002A (taking into account the reverse order of bytes in the word). Here and below we will use hexadecimal numbers.

The Fixup area is used in the process of detecting read or write errors. It consists of words of two bytes in size. The number of words is stored in the MFT record at offset 0006. In fig. 3, the Fixup area size field is highlighted in purple. The value 0003 is stored there, so the Fixup area starts at offset 002A and extends to 002A+(2*0003)=002F.

Attribute fields begin immediately after the Fixup area. The offset of the first attribute is 0030.

The first four bytes of the attribute area define the type, and the next four bytes define the size in bytes. For example, the Fixup area at offset 0030 is followed by an attribute with type 10. In fig. 3, the type of this and the following attribute is highlighted in red (the size of the attribute is highlighted in blue). The attribute is 48 bytes, so the next attribute (of type 30) will start at offset 0078.

In this way, all attributes in the MFT record can be distinguished. At the end of the last one, the value FFFFFFFF is written - a sign of the end of the attribute chain.

For file recovery, attributes of type 30 and 80 are of most interest. The first of these stores the file name. Use it to look for an MFT entry describing the file being restored. The second attribute with type 80 stores the list of clusters allocated to the file, or the file itself. We will tell you more about him.

As can be seen from the figure, the attribute type equal to 80 is stored in the MFT record at offset 0160. In total, the data attribute occupies D8 bytes, since this value is located in a four-byte field with an offset of 4 relative to the start of the attribute.

The byte at offset 8 from the beginning of the data attribute indicates that the file is resident. If its value is 1, the MFT record only stores the list of clusters allocated to the file (as in the described case), and if it is 0, the file is inside the MFT record itself. As a rule, records contain only small files.

Let's first consider the case of a non-resident file location. In this case, four bytes at an offset of 30 store the length of a file located somewhere on the disk. In this example, the $MFT file is B7B000 bytes long.

In order to determine the exact location of a non-resident file on a disk, one needs to trace the chain of so-called Virtual Cluster Number (VCN) blocks, or simply VCN blocks. The offset value of the start of this string is stored in a two-byte field that has an offset of 20 bytes from the start of the data attribute. In the described case, this indicator is equal to 40, and the offset of the VCN block area relative to the beginning of the MFT record is equal to 01A0. On fig. 5, this area is marked with a bold green vertical line.

Analysis of the area of ​​VCN blocks

A file written to an NTFS partition can be segmented. It consists of one or more fragments called extents. The size and location of each extent is described in the VCN block. Depending on whether the file is fragmented or not, the VCN area may contain one block or a set of them. VCN blocks have a variable size, determined by the first byte.

The block format should be shown with a specific example. Take the first VCN block, which in this example has an offset of 01A0 relative to the beginning of the MFT record:

The tetrads of the first byte with the value 31 define the sizes of the two fields of the VCN block. The first field, which is one byte long, stores the number of clusters allocated to the extent of the file. The second field of three bytes contains the number of the first cluster. In this case, 20 clusters are allocated to the first extent of the $MFT file, and the first cluster number for the first extent is 0286D9. This determines the size and location of the first extent of the file.

The second VCN block is located immediately after the first:

In order to determine the first cluster of the second extent, the offset specified in the second VCN block (signed) must be added to the address of the first extent. In this case, the second extent is located in cluster number 0286D9+21=286FA. The length of the second extent is 0824 clusters.

By analyzing the rest of the VCN blocks, you can determine the size and location of all the extents of the file. The list of VCN blocks is closed with a null byte.

Resident files

Small files are placed directly in the MFT entry describing the file to reduce access time. If the byte at offset 8 from the beginning of the data attribute contains a null value, then the VCN block chains do not need to be traced. This means the file is inside a data attribute.

In this case, the offset of the resident data, i.e., the file, is written in a two-byte word with an offset of 14 relative to the beginning of the data attribute, and the size is in a two-byte word with an offset of 10.

Let's take a small example. To illustrate the format of an MFT record containing a resident data attribute, we have prepared a small file named Small.txt containing the text string "This is a small text file.". Then, using the Disk Probe program, we found the MFT table entry created for this file (Figure 6).

As can be seen from fig. 6, the bytes of the Small.txt file (highlighted in yellow) are inside the MFT record at an offset of 18 from the beginning of the data attribute, and the file size is 1A bytes.

How to recover files?

Now, armed with the above knowledge about the internal structure of NTFS system blocks, you can start recovering files from a damaged partition of this file system.

When the names of the files to be restored are known, it is necessary to find the corresponding entries in the MFT table. This can be done using the Disk Probe program, using the Search Sector line from the Tools menu. The next step is to find the data attribute in this entry and determine if it is resident or not.

If the data attribute is resident, then the sector containing the MFT entry must be saved as a file on a healthy hard disk or floppy disk. This can be done using the Save as line of the Disk Probe's File menu. After that, you should cut out the desired part of the data and save the result in a new file. Such an operation is easy to perform, for example, in the Norton Disk Editor for MS-DOS.

In the case of a non-resident attribute, there will be much more work.

By tracing the VCN block chain, you need to determine the location and size of the extents of the file being restored. Next, use the Disk Probe application to read the extent data and then save it to a file on a healthy disk. Also remember that the Disk Probe program specifies the number of sectors to read or write, and the VCN block specifies the number of clusters allocated to the extent. Therefore, an appropriate recalculation must be performed.

After restoring all extents, merge them into a single file (for example, using the COPY command with the /B option). Then set the correct file length obtained from the offset 30 field of the data attribute. In the FAT partition, such an operation can be performed using the same Norton Disk Editor program.

Unfortunately, in practice, restoration a large number files are time consuming. The hardest part is the manual processing of VCN block chains, which can be very long. You have to work for hours with a calculator, converting decimal numbers to hexadecimal and vice versa, as well as performing various arithmetic operations necessary to determine the size and location of the extents of the files to be restored. Therefore, we usually use a small home-made NTFS Explorer program that performs the most time-consuming operations in a semi-automatic mode.

I go to my working disk ...
Stop. Actually, I'm trying to access
your working disk ... and disk E:
no :(. Empty instead
unallocated space

From the memories of Horrific
Xakep v.11.01(35) p.27

Even great gurus happen
troubles of this kind. Not from them
no one is safe. I'll try to tell
How can I recover data in such
situations. After all, most likely, the data is nowhere
did not go away, as they were, and remained on the disk.
Service area just corrupted
section. So let's try to figure it out
how it is arranged, and having understood, we will work out
action algorithm.

Information about the structure of NTFS is rather scarce,
and, due to the closed nature of the main
specifications for it, obtained as
called method. Like other file systems, NTFS
divides the disk surface into clusters. The size
clusters has a fixed size,
selectable from an interval of 512 bytes (1 sector)
up to 64 KB (128 sectors). Commonly used
cluster size of 4 KB (8 sectors). Each
file system element, including
service (which is commonly called
metafiles), is a file.
The metafiles are in the NTFS root directory
section and start with the name character "$",
Main service file - $MFT (Master File Table) -
list of absolutely all files stored in
section, including the MFT. Again
formatted NTFS partition looks like
in the following way:

The place for the MFT file is allocated immediately and with
a large margin, usually 12.5% ​​(but may be
25%, 37.5% and 50%) of the volume of the section. Remaining
place for storage
file contents. However, the OS
necessary, can reduce space,
allocated to an MFT file when space is under
the contents of the files are full. For this, in
current versions of NTFS, remaining free
the space allocated for the MFT file is decreasing
doubling, thereby increasing the space,
dedicated to posting content
files. And when the OS informs about the free
place, then this is the sum of free space in both
parts of the partition (reserved for MFT
file and dedicated content storage
files). But files are not only added to
section, but are removed from it. And in this
case, it is possible to increase the space again,
assigned to the MFT file. At the same time, in the office
area may contain the contents of files,
which will remain there. MFT file will start
be fragmented, although this is not good.
Once again, what has been said refers to
newly formatted partition. When I
with help Partition programs Magic added
unallocated space before NTFS
partition to NTFS partition (F :), then I have MFT
starts at cluster 1731201, although the usual
value - 4.

The MFT itself is divided into fixed
size of 1 Kb (2 sectors) each. First 24
records are service files, and the first
the MFT itself is on the list. Due to the special importance
MFT file, copy of the first four records
stored in the $MFTMirr file somewhere around
the middle of the section. Also in the last sector
partition (for Win "2k / XP) a backup is stored
boot sectors. So for
partition recovery must be found and
copy to the beginning of section 4 first
MFT entries from backup and possibly self
boot sector.

To work, we need any disk
editor. The main thing is that he can see everything
your disk space. Can
use DiskEdit from Uncle Norton from
Norton Utilities package
2002 or regular disk editor Win "2k -
Disk Probe, what you need with Windows distribution from
folder Support\Tools install additional
tools, including Disk Probe. Also
you will need the PartitionInfo program from the Partition package
Magic. First, let's find out the physical
the boundaries of the required NTFS partition. It's possible
done with the PartitionInfo program from
Partition Magic package.

In my case the NTFS partition starts with 5060538
disk sectors. (also available in the lower window
information in C:H:S format) Now we get
information about the number of the last sector and about
location of the MFT and its copy, for which
press the Boot Record button ...

So, the last sector of the partition is 5060538 +
3341456 = 8401994 (first sector of the partition + Total NTFS Sectors),
MFT starts with 8x4=32 sectors (MFT start cluster * Sectors
per cluster), MFT Mirr - c 417682 x 4 = 1670728 sectors (MFT Mirror start
cluster * Sectors per cluster). Specify the size of a separate
entries in the MFT file, for which by running
Partition Magic program by selecting the desired partition,
by clicking the right mouse button, select the item
Properties In the window that appears, select
NTFS Info tab. As it should be, the size
records in an MFT file (File Record Size) is 1 Kb (2
sectors).

Launch a disk editor, such as Disk
Probe, and select menu items - volume>. In the window that appears, double-click
mouse over the required section (in my case
this is G), press the Set buttons in sequence
Active and OK. Now let's go to the sector
containing a copy of the MFT. For this we choose
menu item - and in the opened
window, enter the sector number 1670728 and the number
required sectors (16) and press the Read button.
Now let's rewrite these sectors in place
MFT locations, with 32 sectors. For this
select menu item - .
We answer in the affirmative to the question of change
operating mode from Read Only to Read/Write, in
in the window that appears, indicate the sector, with
to be recorded (in our
case it is 32) and press the Write it button.
We confirm our desire again and MFT
restored.

Now you need to copy to your
place boot sector. For this
select menu item - Then set active
required physical disk. It's similar
what we have done for the logical
disk. Now we need to go to the last one.
sector of the partition being restored. Across
menu - enter the value 8401994
then write this value to the sector
5060538. Be especially careful
since you are working with the whole disk and not
limited to damaged
section!

It remains to run the chkdsk e: / f utility, which
find and fix just huge
number of errors, then congratulate
yourself with the saved partition.

PS: Since all operations are potentially
dangerous, do not be too lazy to make a backup copy
partitions on the same physical
disk as the partition being restored.

Generally speaking, there is no RAW file system. In the Windows operating system, RAW means that the file system type simply was not determined correctly. This can happen for various reasons:

• because the disk is not formatted;
• the disk is faulty or there is damage to its file system;
• correct disk access is not defined.

In this case, the operating system reports a corresponding error and offers to reformat the disk again. Of course, all data on it will be lost.

Naturally, this raises the question: if the flash drive has a raw file system, how to fix the situation? And this can be done both by regular means of the Windows OS itself, and with the help of third-party utilities.

Restoring the file system using Windows

• call the command line with the key combination - ;
• in the window that opens, type the command: cmd;
• the management console will open, where you will need to type the command: CHKDSK / F. The name of the disc may be different. For example: /C, /A, /I, etc.

A special service program will start, which will not only check the disk partitions for errors, but also try to eliminate them.

You may also need to restart your computer before checking.

After the program has completed its work, you will need to call another one - to scan errors in real time:

• the management console is called as described above;
• enter the command: sfc /scannow.

Thus, the problem can be solved: if the hard disk is raw, how to fix it?

Restoring the file system using utilities

Restoring the file system of a flash drive without losing data is also possible using third-party utilities. They have various additional functionality and differ in the organization of the interface, but their general purpose is the same: to restore a damaged disk file system, but not to lose a single bit of data.

Here are just a few of these programs:

• RS Partition Recovery;
• Mini Tool Power Data Recovery;
• Test Disk (this utility does not work with file names written in Cyrillic);
• win hex;
• Get Data Back for FAT/NTFS (only for FAT and NTFS systems).

The hard drive of a normally working computer device is always formatted with the NTFS or FAT file system. If one of the HDD partitions starts to work incorrectly, an entry appears in the properties of the disk about converting its format to RAW. This means that the standard file system is corrupted and needs to be repaired. In practice, you can find out about such damage as follows. When accessing the disk, the latter does not open, and a message appears on the monitor about the need to format it.

What does this message mean:

• The structure of the used file system is destroyed.
• There is no access to the contents of the hard drive.
• Writing invalid or corrupted data to the disk boot sector.

When opening the properties of the hard disk, you will notice that the partition allegedly does not contain any information. In any case, it is necessary to restore the file system in order to recover the data on the disk.

What might cause a crash?

The reasons for such a failure may be:

• The impact of a virus that has entered the computer.
• Critical failure operating system.
• An incorrectly working program that replaces the original system files with its files. This also includes "crooked" drivers.
• User errors when shutting down the computer. So often the file system on flash media is damaged.
• External factors, as a result of which the file system may be damaged. In particular, frequent power outages can cause a similar problem.

How can I restore the file system and information on the hard drive?

Despite the fact that the operating system will prompt you to format the damaged partition, it is better not to agree with such actions. However, if you hurried up and gave the command to format, all is not lost. True, in this case, it will be much more difficult to completely restore the contents of this section. First, you should restore all the information available on the faulty partition, and then restore the file system itself.

It is recommended to restore data and health of a logical partition using the RS Partition Recovery program.

This program allows:

• Restore files from an HDD where the file system has been changed. That is, with RAW.
• Recover data from a hard drive that you have formatted.
• Obtaining the most complete information from the logical partition that has been deleted.
• Complete recovery of damaged partitions.
• Copying data from damaged partitions to other media.
• The program perfectly copes with the tasks set on any medium.

Working with RS Partition Recovery

The program interface is quite simple. The main menu is divided into three main parts. On the left you can see the list hard drives and logical partitions. In the center, the disks are filled with information, as well as data on the sizes of all disks. The files we have selected appear in the right column. The program even displays hidden files, as well as partitions managed by other operating systems.

It's time to move on to direct data recovery using this wonderful program. To do this, simply click on the top left button labeled "Wizard". The wizard's menu will open before the user. The selected disk will be analyzed.

The program divides all partitions into three categories: logical, removable and hard drives. To recover data, you must select the appropriate partition. Specify it and then click Next. You will be prompted to select the type of analysis.

The choice consists of two options:

• Fast Scan.
• Full analysis.

• 1 filter will detect NTFS system files. Most internal partitions work in this space.
• 2 filter will process files belonging to the FAT system. Such formatting is more typical for removable media, but such files are also found on a computer's hard drive. Linux also works with the FAT system.
• Deep analysis works independently of the file system. In the course of its work, the program simply finds on the disk all the files that were once there or are currently available. However, deep analysis alone is undesirable, since some information may be lost. It is best to analyze a section using all three filters.

When choosing a quick scan, some files will simply not be found. There are only whole files, without any signs of damage.

After the analysis is completed, the program will tell you how many folders and individual files found in this section.

To view all the files found during the analysis, you must go to the main menu of the program by clicking the "Finish" button.

In the center of the program window, a folder with the name "Deep analysis" will be visible. Double-clicking on it will open the contents of the folder. In order to restore the selected files, you need to select them in this folder, and then click the "Restore" button on the top panel. This will offer the following choice of where to save them:

• To hard drive.
• To removable media.
• Mounting the image.
• Uploading to the Internet via FTP protocol.

In this window, you should select the location for saving files, the option to restore the structure remote folders, as well as restoring file streams to NTFS. After that, the "Restore" button is pressed. All found files will be restored to the location you specified.

recoverit.ru

How to recover NTFS from RAW file system without data loss?

What is the RAW file system and how to return the NTFS format without data loss - in this article we will consider these issues in detail, as well as recovery methods.

It often happens that after an incorrect shutdown of the computer, for example, if you unplugged the cord from the outlet or the power went out unexpectedly in your house, or your computer survived a virus attack, an unpleasant situation may occur. The disk file system on your computer or laptop changes its format to RAW, and for the device to work correctly (as a rule, you want to do this as quickly as possible), you need to return it to the NTFS format.

What is a RAW disc

So, the RAW file system type, let's see what it is. The RAW system is a non-existent system. If the computer indicates that the media has this format, then the drivers cannot determine the type of its file system (FAT, FAT32 OR NTFS).

If the media received the RAW format, Windows 10, although it will display it among the partitions of the hard drive, but any actions with it will be impossible, and defragmenting, and checking for errors, and, of course, viewing the data lying on the disk. The computer will constantly give an error, and offer to format the disk, and the inscription “RAW” will appear in the “properties of the logical disk” line. So how do you recover a file system from RAW format to NTFS on a hard drive?

File system recovery from RAW to NTFS

The system will offer you the easiest way - to format the disk. But do not rush to do this, because your data is not lost, now there is simply no access to it. If you format a RAW drive to convert the file system back to NTFS, then it will take a long time to recover data from the media using special programs. We offer several ways to recover a drive from RAW to NTFS without data loss.

Restoring a file system to NTFS from RAW without formatting

Method 1: Windows Tools

Mainly, to change the file system from RAW to NTFS, the standard utility from the chkdsk operating system helps. Do the following:

• Right click on "Start" and select "command prompt"
• Type chkdsk target_disk_letter: /f
• The computer will start a check, after which it will repair the damage and NTFS system in problem area

Chkdsk will help even if it is damaged system disk. To do this, you need a flash drive or boot disk.

Here are your steps:

• Start the computer from a USB flash drive or disk, and then select "Recovery"
• Then open "advanced options", and then "command line". There, type chkdsk target_disk_letter: /f

During recovery, partition letters may differ from disk names. In order not to make a mistake in your work, open the list of computer partitions in the command line, then enter diskpart, then list volume and you will see which disk is the system disk. This will be listed.

In addition, you can try to restore the system from previously saved backups.

Method 2: Using special programs

And here's how to make NTFS from the RAW file system using third-party programs.

First of all, we recommend using free program testdisk. This is a utility that interacts with hard disk partitions. She will help fix the situation. The disadvantage of working with the Testdisk program is that it does not work with Russian names and they may not be displayed correctly.

Here's how to convert RAW to NTFS using Testdisk:

RAW format on your flash drive

Reasons for conversion:

1. When the USB flash drive is connected, the computer is not turned off correctly or there is a voltage drop
2. crash Windows work
3. Banal viruses
4. External damage to the flash drive, from impact or fall

How to change the wrong system format to the correct one:

Good result gives converter MiniTool Power Data Recovery. The principle of its operation is that the program does not convert RAW to desired format, but makes all the files on your flash drive visible, making it possible to work with them. The disadvantage of the program is that only a trial version is free, which works with files no larger than 1 GB.

How to work with the program:

Also on our website you can find the following topics:

• Merge hard drive partitions on Windows 10
• How to change hard disk partitions
• How to change the swap file in Windows 10

windows10x.ru

Restoring the HDD file system with saving all data

The problem with the advent of the RAW file system can befall not only removable media, but also a hard drive with data or a separate hard drive partition. If the malfunction is of a software nature, then it can be corrected using formatting. However, changing the format using standard Windows tools is fraught with the appearance of deleted data.

If the file system of your hard drive is defined as RAW, and the system insistently prompts you to format it, then it is better to refuse this procedure. Turn off the hard drive, do not carry out any more operations with it in order to avoid accidental overwriting.

Important: if the hard drive is physically damaged, then you should not try to repair it yourself.

If during inspection you find that the hard drive is physically intact, then first try restoring the file system with the CHKDSK utility. This will help to avoid subsequent time-consuming recovery of deleted files.

Using the CHKDSK utility

The CHKDSK utility is a built-in hard drive diagnostic and recovery tool. The problem is that if the file system is corrupted, then you won't be able to start the system. Therefore, the CHKDSK utility will have to be run using the installation disk:

A parameter in the command syntax means to start searching and fixing errors. The letter "d:" indicates the drive that will be scanned. If the operation is successful, errors are detected and fixed, then you will again receive a working disk with a normal file system and without deleted important data.

Extracting files with R-Studio

If the TestDisk program did not help get rid of the RAW format, and you did not return the NTFS or FAT32 file system, then you will have to go the other way. You will need:

• Another computer with scratch disk and installed system.
• R-Studio program.

Remove the HDD with RAW file system and connect it to another computer. To avoid the appearance of deleted files, run the R-Studio program. Here you need:

You need to save the files to a different drive, not the one from which they were just extracted. The format of the hard drive will not change - it will remain RAW. To restore the HDD, format it as suggested by the system. The format will change, but there will be no more problems with deleted files, since you previously “pulled them out” from the damaged media.

Formatting to NTFS

If you need to format your hard drive to the NTFS file system without losing information, you can try to do it through the command line. This will not solve the RAW format problem; you can not use this method to change to FAT32. But if you need to change the format of a disk or partition from FAT32 to NTFS, then try the following steps:

Enter the command "convert G: / FS: NTFS / X". Instead of “G”, there should be a letter of the hard drive you connected, the partition format of which you want to change from FAT32 to NTFS. Running this command will help you avoid data loss i.e. deleted files you don't have to restore, because formatting is not required.

easyrecover.com

How to restore the file system of a hard drive

The situation in which the hard drive needs to be repaired can happen to every PC user. It may be needed for various reasons. One of them is file system corruption.

If the disk is used for its intended purpose, it has the FAT or NTFS file system. These formats indicate that it works well and does not require restoration. But sometimes it turns into RAW. How to understand that a failure has occurred? If you accessed the disk, but it did not open and a message appeared about the need to format it, it means that a failure has occurred.

This message may mean the following:

1. The structure of the used file system has been destroyed;
2. There is no clear access to the content;
3. Wrong data was written to the boot sector.

1. To start recovery, you must click "Wizard". After that, the work menu will appear. The hard drive will be analyzed.
2. In the program, all sections are divided into 3 categories: hard, removable and logical drives. In order to start data recovery, you will need to select the desired partition. After that click "Next". You will be prompted to select the type of analysis: online scan or full analysis.
3. It is better to immediately conduct a full analysis. With it, 3 filters are processed immediately. The first filter will calculate NTFS systems. The second one will process the files that belong to this system. Deep analysis will work regardless of the file system.
4. If you choose the first option, then some of the files simply cannot be found. In this case, files that do not show signs of damage can be found.
5. After that, you can start scanning. The larger the volume of the disk being checked, the longer the process will be.
6. After the analysis is completed, you will find out how many folders are in this section.
7. In order to get acquainted with all the files found during the analysis, you need to go to the main menu and click "Finish".
8. The Deep Analysis folder will appear in the center of the window. Next, you will need to select them in this folder, and then click "Restore". It remains to choose a place to save them.
9. In this window, you will need to choose where to save the data, the option to restore the folder structure that was deleted, and restore file streams to NTFS. After that, you need to click the "Restore" button.

Key points for the day

News aggregator 24SMI

joke of the day

At the age of 7, my father took me to a school for gifted children. To show what kind of son he wanted.

More "

planet-today.ru

RAW HDD format: how to fix it in NTFS using Windows tools or third-party software

Most often, the disk file system changes to RAW after the computer was turned off incorrectly, when the lights were turned off, or the user saved time and pulled out the power cord system block from the outlet. Another reason is viruses that change NTFS to RAW HDD format. How to fix this problem, read this article.

What is a RAW file system?

If the disk has received the RAW format, Windows will display it among other partitions of the hard drive. But when you try to open the computer, it will give an error and offer to format it. In addition, any actions with this volume will not be available: checking for errors, defragmenting, etc. (it is useful to read “How to check the integrity of system Windows files 10 and restore them?").

As such, the RAW file system does not exist. If the drive receives this format, it means that the computer drivers are not able to determine the type of its file system - NTFS, FAT or FAT32. In practice, this happens in several cases:

• the file system structure is corrupted;
• the partition has not been formatted;
• there is no correct access to the contents of the volume.

If the OS volume is corrupted, "Reboot and select proper" warnings will appear when the computer boots. boot device" or " operating system not found".

Recovery

If the problem occurs on a non-system drive, but it contains important information that will be lost during formatting, use the standard Windows tools or third party programs to fix an error.

Basically, the standard chkdsk utility helps to fix problems with formatting in RAW.

After checking, the computer will repair bad sectors and the NTFS file system on the problematic volume.

Important! This method is effective if the flash drive or hard drive has been formatted in NTFS.

Also, the chkdsk utility will help when the system disk is damaged. But for this you need a boot disk or flash drive.

1. Start the computer from a bootable USB flash drive or disk → Select "System Restore".
2. Additional options → command line → type chkdsk target_disk_letter: /f.

In the recovery environment, partition letters are different from logical drive names. In order not to make a mistake, open the list of computer partitions in the command line.

Enter diskpart → list volume → the list will indicate which disk is the system disk.

Good to know! If these methods did not help, try restoring the system from previously saved backups.

There are third-party programs that help restore the NTFS file system if for some reason it was reformatted to RAW. They do not damage the user information stored on the volume, in contrast to the chkdsk utility, which can “hurt” them during the recovery process.

MiniTool Power Data Recovery

Important! This method is most effective if the RAW file system appeared on the flash drive.

The utility does not restore the desired format, but makes all files stored on the media visible. Therefore, you can work with them. The main disadvantage of MiniTool Power Data Recovery is that it is shareware. Trial version works with files up to 1 GB in size (also read "Recovering information on disks using Disk Drill for Windows").

Test Disk

It's multifunctional free utility, working with hard disk partitions using a large number of options. The program is presented in portable version and therefore does not require installation. The main disadvantage of TestDisk is that there is no Russified interface.

An alternative way to restore NTFS formatted partition is presented in the video.

Read about the causes of a RAW disk, as well as how to convert it to NTFS. What are ways to restore access to a "RAW" disk and how to recover data from it. Is the file system on the disk defined as "RAW" ? Do you want to get back "NTFS" partition after data loss? I can’t format a disk in the “NTFS” file system, do I need a program to change “RAW” to “NTFS”? You can find answers to these and other questions in our review article.

Our interaction with each other is based on information, we use it in our professional activities (economic, financial, scientific, social, cultural, etc.), we use it for entertainment and leisure activities.

Various computer devices help us to control and manage the ever-increasing flow of information, as well as store and have instant access to it. One of the main types of such devices are stationary personal computers and laptops. Thanks to the advanced elements of information processing and storage used in them, they easily cope with the tasks assigned to them and facilitate the process of information control for users.

The main role in the management of a computer device, as well as the collection, processing and storage of information, is played by software that exercises full control over the activity of the device and information flows.

The most well-known software that fully meets the stated requirements is the operating system Windows from a corporation Microsoft. The internal system shell, which allows you to instantly process huge amounts of data, perform many different processes simultaneously without compromising the overall performance of the device, which has an attractive user interface, allowed the operating system Windows acquire wide world fame, which led to extraordinary popularity. Separately, it should be noted the high threshold of resistance to the occurrence of various system problems and errors, which significantly increases the overall security of the operating system as a whole, and also increases the attractiveness of its use.

Along with advanced software that is responsible for the full and correct functioning of a computer device, the data storage is also of great importance, which is used primarily to store all information. Internal hard drives and drives, external attached storage, USB drives and other devices are used each to solve certain problems, but the main requirements imposed by users on them are safe use and storage various information, with the ability to quickly access it at any time.

And the situation when a user finds an empty unallocated space on a storage device instead of their data can cause feelings of despair and fear that all stored information is lost forever. The current situation is always unpleasant, but not critical. All data stored on such a storage device remained in place, but the system cannot recognize the internal structure of the disk and provide access to it. However, the user can correct the file system format represented as "RAW", and bring it to the original version, and return your data back. In this article, we will look at the top seven causes for this problem and offer you some solutions to fix it.

General concept "RAW"

Before proceeding to the description of the problems of the appearance of the format "RAW" on your storage device and possible ways to solve them, you should elaborate on its explanation.

concept "RAW" is intended to denote the indefinite file system of a volume (a portion of a computer's long-term memory taken as a single whole storage area for ease of use).

Each volume or entire disk space has a specific file system that represents a specific order and defines a specific way of organizing, storing and labeling data on storage media in computers and other electronic devices.

The system component is built into the kernel "RAWFS", whose main function is to notify any applications of the volume size and file system version, when prompted. If the file system cannot be determined, the symbol appears "RAW". In other words, this means that the file system name of the disk partition cannot be recognized by any of the file system drivers installed and available in the operating system. Windows, for whatever reason.

In practice, this indicates that the partition is not marked for a specific format, the file structure of the system is broken, or there is a reason that results in no access to the internal contents of the partition (disk). Further in our article, we will present a list of the main reasons for the appearance of the format "RAW".

Seven main causes "RAW"

There are many symptoms when hard section disk becomes "RAW format". As we already described in the previous section, the reasons for not recognizing the file system name of a disk in a partition can be different. Additionally, the system may require you to perform certain actions before allowing you to use a disk partition whose file system is displayed as "RAW". For example, operating system Windows shows an error message prompting you to perform the following procedure: “To use a disc in a drive, first format it. Do you want to format it?". In this case, you will not be able to access the disk partition and all the information located on it until you fulfill the requirement of the operating system.

In this case, formatting the disk partition can help you get rid of the problem. "RAW" format. But such a process will destroy all the data that is stored in this partition. Therefore, we suggest that you familiarize yourself with the main causes and tips for eliminating them without losing data.

Note: Sometimes the disc or drive is displayed as "RAW", if the file system specified on it is not supported by the current version of the operating system installed on your computer device. In such a case, steps must be taken to open the drive on the operating system it was originally designed for and that supports that file system.

1. Bad sectors

If there are bad sectors in a key area of ​​the hard drive, then the drive is definitely not working properly, which can corrupt the file system and cause it to be displayed in the format "RAW".

2. Structural damage to the file system

The main system-forming reason for the occurrence of problems and the display of disk partitions or individual drives in the format "RAW" is related to the health of the file system, which can be corrupted for other reasons than the presence of bad sectors. Therefore, if the file system suffers from internal structural corruption, then the partition may become formatted "RAW".

3. Partition table corruption

The next, no less important, cause of the format problem "RAW" in a disk partition, the partition table may be corrupted. For example, incorrect values ​​in the table "MBR", which contains data and a code fragment, as well as special signatures necessary for correct loading, may be one of the reasons.

4. Reinstalling the operating system Windows

When you upgrade an old operating system to its newer advanced version, the file system of the system partition can also be changed to new version system (for example, switch from version FAT to the file system "NTFS"). In this case, the file system may not be identified by the new operating system, and as a result, it will be displayed as "RAW" format.

5. Attack of viruses and malware

One of the most common reasons for displaying a disk partition in file system format "RAW" is a virus and malware attack. Such a malicious impact on the system can damage the part of the partition table, which indicates the beginning and end of the partition, and contains other additional information, change or delete important hard disk settings. As a result, it will become impossible to determine the boundaries of the affected partition and its file system, as a result of which, having undergone a malicious virus attack, the disk partition will be displayed, when accessed, in the format "RAW".

6. Damage to cables or connectors

In some cases, a hard drive or drive may appear as an undefined file system "RAW" if the connection cable is damaged or there is poor contact in the connection connector.

Usually the cable connecting hard drive rarely fails, but be aware of this as a possible reason for the system to identify the drive as "RAW", necessary. Especially in the case when power surges or other mechanical damage occurred. More often, problems arise with the drive connector, which gets damaged with repeated use, or has a weak connection level that is insufficient for the correct display and operation of the drive.

7. Incorrect partition access permission

One of possible causes assigning a format section "RAW" may serve as an incorrectly configured access permission to the section, which is directly related to local settings security policies. As a result, the system may restrict your access to the disk partition and display it as an undefined file system.

Ways to restore access to "RAW" disk

Depending on the reasons that have arisen that affected the display of a disk partition or the entire drive in the format "RAW", you will need to perform a certain procedure aimed at correcting the current situation. The following steps must be performed in sequence until the disk mapping problem is resolved. After each action, you need to check if the problem is resolved, and move on to the next one if the result is negative.

1. Check the integrity of the cables or connection connectors

If there has been a power surge, then it is necessary to check the cables and connectors for possible damage. Replace the cable with another, working cable, and retest your drive. Or, connect your drive to another connector that you are sure is working and try to access it again. Perhaps these actions will be quite enough to completely eliminate the problem.

2. Change security settings in section properties

From the point of view of setting access permissions to sections, you can change the necessary security settings in the section properties window. Open file explorer Windows and find your partition or drive in the format "RAW". Click on it right click mouse and, in the pop-up context menu from the list of possible actions, select the section "Properties".

Then in the new dialog box that opens, click the tab "Safety" where you can remove useless users and any messy codes, and add a local user to resume disk access.

3. Change security settings in section properties

If for some reason it was not possible to allow access to the desired partition, then you can change the security settings using the internal tool of the operating system. You can open the Local Policy Tool window different ways. For example, Click on the button "Start" located on "Dashboards" in the lower left corner of the desktop, and open the main user menu Windows. Using the scroll bar, slide the slider down the list of installed applications, and find the section "Facilities Windows Administration» . Click on it once and open the submenu. Select the section from the list of presented system tools.

In the window that opens, in the left pane, select the section « Local Policies» , and then in the right pane, double-click the section "Security Options" or right-click on it and select section from the pop-up menu "Open".

In the right pane of the security settings window, all the main types of policies will be presented with the settings for each of them. Use the scrollbar to move the slider to the bottom of the list and find the policy "Network access: model public access and security for local accounts". Double-click on it with the left mouse button to access the policy properties window. Or right-click on it and open the pop-up menu, in which select the section "Properties".

In the properties window of the network access policy that opens, in the tab "Local Security Option" in the center cell, open the pop-up menu, and change set parameter on the value "Normal - local users authenticate as themselves".

Then press the buttons "Apply" and "OK" for your changes to take effect.

4. Convert "RAW" to the file system "NTFS" through the disk format process

If when you turn on your computer or when you connect a drive to it, the operating system detects your disk, then a message will always be displayed in which you will be asked to format the disk to resume access to it, and install the correct version of the new file system on it. In the event that information stored on such a disc, the format of which is defined as "RAW", is not important for the user, you can immediately click on the button "Format disk" and start the file system setup process.

However, if the information is of paramount importance, then refrain from formatting the disk and go to the next section. "5" our article to get your data back. The formatting process will not be able to completely erase all the information on the "RAW" disk, but can significantly complicate the subsequent data recovery process and reduce the total number of usable and usable whole files.

If the message is not displayed, then you can format the disk from the application "Disk Management". You can open the app different ways. For example, right click on the button "Start" located on "Dashboards", or press the keyboard shortcut together Windows+X, and open the pop-up menu. Select, among the available applications, a section "Disk Management" to access it directly.

In the application window that opens, click on "RAW" right-click the disk and select a partition from the pop-up menu "Format".

In the new window, set the required formatting options and click the button "OK" to start the process.

You can also format "RAW" disk from file explorer Windows. Right-click on the disk name and call the pop-up context menu. Select a section from the list of available actions "Format".

Set the required file system and others additional settings, if necessary, and press the button "To begin", thereby starting the formatting process.

At the end of your "RAW" the disk will have a new file system and is completely ready for further use.

5. Recover files from disks in the format "RAW" using data recovery software

If you are interested in saving all information located on "RAW" disk, then you will have to use a data recovery program that allows you to perform such operations. One of such programs, which have received wide popularity and high user rating for the results achieved in recovering lost data, is a program from the company Hetman Software. It fully meets the requirements of users in the situation of indefinite partition "RAW", has a nice and comfortable user interface, most similar to appearance operating system Windows, is quite easy to use and has high rates of final recovered files.

The big advantage is the fact that the program has a preview function of recovered files, which prompts users to view or listen to the contents of any files before saving them. This approach allows you to be completely confident in choosing and saving the best versions of recovered documents.

Download the installation file of the program from the official website of the company and install it on your computer or laptop. The process of installing the program will not take you much time and will not cause any particular difficulties thanks to the step-by-step installer wizard. Follow its instructions and the installation of the program will be successful.

Open the program and find your Raw disk or partition.

Double-click it and, in the window that opens, select the required type of analysis. Check box "Full analysis" to search for all available information and restore the disk file system.

After setting the scan options, click the button "Further" and start the process of analyzing and recovering possible information. It may take from several minutes to several hours, depending on the original size of the disk, the degree of file system corruption, and other additional criteria. For user's convenience, the scanning mode will be displayed in real time.

When finished, press the button "Ready" and go to the preview window to select the recovered files and then save them. By clicking on each file, you can view its contents and choose the option that suits you best.

After selecting all the necessary files, click the button "Restore", with a lifebuoy depicted on it, and located on the main ribbon of the window.

The program will offer you a choice of several options for saving the marked files: saving to a hard disk, writing to "CD/DVD", create a virtual image ISO or upload by FTP. Depending on your preferences or need at any given moment, set the indicator in the appropriate box next to the selected save method, and then click the button "Further" to continue.

In the next window, check the required additional options, for example, specify the path to save files or use the suggested option, and click the button "Restore" to complete.

Now that you have recovered all the files that are important to you, you can format your disk or partition in the format "NTFS" for subsequent application, using the method described earlier in the section "4".

Conclusion

Information is of paramount importance and requires safe ways its storage. The reasons why access to a disk with important user information may be lost can be completely different. However, almost all of them can be eliminated using the internal tools of the operating system. Windows or thanks to third party data recovery software.