Why is my HDD seen as RAW

[dss_cottage]

I am dealing with a HDD failure and want to use it as a learning experience.

I’m about to reformat the HDD but before I do, I’d like to learn.

I’ve done a lot of research, testing and data recovery but I can’t rationalize why the HDD isn’t working. Can anyone make a suggestion?

My HDD:
WD Passport model WD20NMVW-11EDZS6 (2TB)

The failure:
The HDD was attached to my media server (WDTV Live) and it suddenly stopped being recognized.
I attached it to the computer and File Explorer identified it as Drive E: but couldn't assess the files
Disk Management reported it as a RAW unformatted drive.

Testing and recovery:
• Chkdsk reported The type of the file system is NTFS.
The first NTFS boot sector is unreadable or corrupt.
Reading second NTFS boot sector instead.
The first NTFS boot sector is unreadable or corrupt.
Reading second NTFS boot sector instead.
Unable to determine volume version and state. CHKDSK aborted.
• I used TestDisk to diagnose/repair. It reported that the Boot Sector was bad but the backup BS was OK and replaced the first BS. It reported that both the both the MFT & MFT Mirror were OK
• I used GetBackData and recovered about 60% of my data.

According to the preceding:
• The Boot Sector and MFT are now valid
• Windows File Explorer identifies the HDD but it appears unformatted
• GetBackData is able to read the HDD and recover non fragmented files.

If the HDD can be read and the BS & MFT are valid, what else would cause the HDD to be seen as RAW (unformatted) by Windows?

[Lardman]

If the HDD can be read and the BS & MFT are valid, what else would cause the HDD to be seen as RAW (unformatted) by Windows?

Windows RAW is a generic failure not a specific one. Valid is also a very lose term, things can be valid but useless.

Point something more sensible at the drive like DMDE and see what that makes of it.

[dss_cottage]

I'm looking at DMDE right now.

I should also add that the program HardDiskSentinal reports 100% performance and 99% Health and identifies 2 weak sectors but the HDD still can't be read in Win File Explorer.

[fzabkar]

"RAW" means that Windows found some inconsistency in the file system's metadata. It then reverts to treating the partition as a bunch of bits.

It sounds like GetDataBack may have used a raw scan to recover your [non fragmented] files. Am I right in assuming that they were recovered without their original file names? If so, then the $MFT must be corrupt or invalid.

Can you show us a SMART report with a tool such as CrystalDiskInfo?

[dss_cottage]

"RAW" means that Windows found some inconsistency in the file system's metadata. It then reverts to treating the partition as a bunch of bits.

It sounds like GetDataBack may have used a raw scan to recover your [non fragmented] files. Am I right in assuming that they were recovered without their original file names? If so, then the $MFT must be corrupt or invalid.

Can you show us a SMART report with a tool such as CrystalDiskInfo?

I've now attempted to recover files with four different programs. GetDataBack recovered about 60% of the files and about 80% of those were recovered in the correct directory structure. All files retained their originl file names. I've just finished a recovery scan using DMDE and after a preliminary look it appears that it recovered a larger percentage of files with correct file names in their originl directory structure. There are a lot of files to examine so it will take a litte time to confirm.

After I do this, I'll get CrystalDiskInfo and post the SMART report.

[dss_cottage]

I've installed CrystalDiskInfo but it won't read the HDD. It reports E:/ is not accessable which is the same report I get from Windows File Explorer.

I've also completed the file restoration using DMDE. It worked slightly better than GetBackData. I was able to recover about 65% on my data most with original file names and directory.

Lardman suggested "Point something more sensible at the drive like DMDE and see what that makes of it." I've completed the data restoration but I'm a little out of my depth using the program for HDD repair. I've looked at the manual but don't see how to use the program for repair. I've attached the HDD reports.

Attachments

[fzabkar]

DMDE's Indicators column shows "EBCxx". On a good NTFS volume it should be "EBCF". Usually this means that there is something wrong with the $MFT and $MFTMirr metafiles.

If you d-click $Volume 01, does DMDE show any files under the $Root, or does it want to launch into a file system reconstruction or scan?

[Arch Stanton]

DMDE 'tells' boot sector does not point to valid MFT. This can mean it points to wrong place or pointer is okay and expected structure is corrupt. I suspect the latter as boot sector values look ok.

[dss_cottage]

DMDE's Indicators column shows "EBCxx". On a good NTFS volume it should be "EBCF". Usually this means that there is something wrong with the $MFT and $MFTMirr metafiles.

If you d-click $Volume 01, does DMDE show any files under the $Root, or does it want to launch into a file system reconstruction or scan?

Here is the result of the d-click:

Attachments

[fzabkar]

If there is no MFT start cluster, then why does Testdisk report that the MFT is valid???

Since you're experimenting, you could go directly to the expected location of the MFT and then page-down through the sectors.

The partition starts at sector 2048, and the boot sector is telling you that there are 8 sectors per cluster, and the MFT start cluster is 786432.

Therefore the start sector for the MFT is ...

Code:

2048 + (8 x 786432) = 6293504

In DMDE, select Editor -> Goto Offset, sector = 6293504.

Then select Mode -> MFT Record, or Mode -> Hex/Text, as per your preference.

You can then page-down until you find something interesting.

You could do this on a working volume so that you will know what to expect. DMDE will make you jump through hoops before it will let you write anything, so don't be too concerned.

[Lardman]

If there is no MFT start cluster, then why does Testdisk report that the MFT is valid???

Looking at the OP's post Id say testdisk itself might be the answer to that after it was used to "diagnose/repair". Given the drive has been nuked by chkdsk and testdisk who know what state things are in or where they are or should be.

[fzabkar]

It seems odd to me that the last sector of the NTFS volume is 2048 sectors before the end of the drive (as seen over USB). Is this normal for this model?

[Lardman]

Can't say Id ever noticed, I don't have that model on the shelf but I've just checked the nearest my passport to hand and the MFT is also 2K short. AMPG as to why.

[Arch Stanton]

• I used TestDisk to diagnose/repair. It reported that the Boot Sector was bad but the backup BS was OK and replaced the first BS. It reported that both the both the MFT & MFT Mirror were OK
• I used GetBackData and recovered about 60% of my data.

According to the preceding:
• The Boot Sector and MFT are now valid

Incorrect assumption. AFAIK Testdisk can't tell if an MFT is 'valid', it simply compares MFT to mirror. Keep in mind that mirror is not a complete copy (far from it).

Given that GetDataBack and DMDE recover 60-70% of files, my assumption is large portion of the MFT is actually corrupt.

Can you for example goto LBA Franc gave (In DMDE, select Editor -> Goto Offset, sector = 6293504.) and save, I dunno, 10000 worth of sectors to a file and share it?

[dss_cottage]

• I used TestDisk to diagnose/repair. It reported that the Boot Sector was bad but the backup BS was OK and replaced the first BS. It reported that both the both the MFT & MFT Mirror were OK
• I used GetBackData and recovered about 60% of my data.

According to the preceding:
• The Boot Sector and MFT are now valid

Incorrect assumption. AFAIK Testdisk can't tell if an MFT is 'valid', it simply compares MFT to mirror. Keep in mind that mirror is not a complete copy (far from it).

Given that GetDataBack and DMDE recover 60-70% of files, my assumption is large portion of the MFT is actually corrupt.

Can you for example goto LBA Franc gave (In DMDE, select Editor -> Goto Offset, sector = 6293504.) and save, I dunno, 10000 worth of sectors to a file and share it?

I'm not sure what to upload. When I save the sectors (Tools-> Copy Sector - click destination File) then input the sectors, it only gives me the choice of .bin, .ima, .img file formats. I've tried these as well as .txt but the forum tells me that those file extensions are not allowed. I also tried to look at the files in Notepad but the file looks empty.

What am I doing wrong?

fzabkar also suggested that I look at this area of the HDD and scroll down to see if there is anything interesting. I did this but have to admit that I don't know what I'm looking at.

[Lardman]

Save it as a bin then either rename it or zip it and then post it. You'll need to look at the contents in HEX but even then it may not appear to make much sense.

[Arch Stanton]

Upload using Google Drive or similar (https://gofile.io/welcome) and share URL with us.

[dss_cottage]

Save it as a bin then either rename it or zip it and then post it. You'll need to look at the contents in HEX but even then it may not appear to make much sense.

Here's the zip file.

Attachments

dev7_lba6293504_10000.zip

(6.05 KiB) Downloaded 674 times

[Lardman]

That file is just 0's. Valid data should look a little something like this.

[fzabkar]

Can't say Id ever noticed, I don't have that model on the shelf but I've just checked the nearest my passport to hand and the MFT is also 2K short. AMPG as to why.

Your drive has an NTFS partition which ends on LBA 976707583. That's the last sector of the user area.

The OP's drive has an NTFS partition which ends on LBA 3906961407. The last sector of the user area is 3906963455. That's a difference of 2048 sectors. I just thought that was odd. The last sector of the volume would be the backup boot sector, so I'm wondering whether TestDisk looked for it in the wrong place.

I'm also wondering whether a 2TB drive now normally ships with GPT partitions rather than MBR. If not, then the drive may have been reinitialised with some tool which deletes the boot sector and FS metadata.

For example, let's say your 500GB drive were to be reinitialised and a new 500GB GPT partition created in place of the original MBR partition. The boot sector and FS metadata would be zeroed, and the copy of the boot sector at the end of the volume would be overwritten with GPT metadata.