Displays as RAW but I can see NTFS partition with programs

[cashby]

I have windows 7 on my computer. I plugged in my 2Tb HDD, used it, then unmounted it. During the unmount it told me that the drive was in use a couple times, then it unmounted. I plugged it back in later and now my computer shows it as "Local Disk". I opened Computer Manager, went to Disk Management, and the HDD shows as RAW. Using the program Active@UNDELETE I view my HDDs and the HDD displays as two partitions, the small unallocated partition and the Primary NTFS that looks perfectly normal like it should. Then I noticed that under Logical Drive Capacity it says that the HDD is full, it's is not even close to being full. I then scanned the HDD with Active@UNDELETE and I can see all my files. I have looked for an answer but I am not asking Professor Google the right question to get the answer I am looking for. So am I correct in thinking that my partition table is corrupted? If so, how do I correct the issue? I'm not sure if my Hirens disk has anything on it that will help me. I don't have Partition magic but could download it or Active@Partition Recovery. Any help will be much appreciated. Thanks

Attachments

[einstein9]

this is Smartware hdd
if u used the utility to format it, then its all gone my friend
chances are below zero

[northwind]

But OP says they can see the files.
If you can see the files using active undelete why don't you just recover them to another drive?

[cashby]

I have recovered the files. I would like to fix the issue rather then format. I would also like to figure out why this happened. Corrupted partition table or what? What gets me is that the program sees the HDD as it should be, right when it starts up, without me scanning for any problems. Shows a excellent, healthy, NTFS drive like I would expect to see if it was working. Im going to continue looking for an answer as opposed to formating.

[Vulcan]

I have recovered the files.

So assuming you don't mind if you now make things worse and potentially end up having to re-format, then...

I would like to fix the issue rather then format.

The utility you probably need to try to "fix" the issue if, as I suspect, this situation is the result of filesystem damage (caused during unmount), is "chkdsk". Be sure that you understand the potential consequences of using this (see first comment above).

Corrupted partition table or what?

Based on your comments so far, this seems unlikely IMHO, but I haven't seen you explain the original partition layout before "the problem" happened, to then compare with the partition layout now. As I mention above, I suspect filesystem damage, based on the info supplied so far.

[cashby]

chkdsk will not run because my computer sees the drive as a RAW drive. The Active@Delete picture above shows how everything was before the issue, it's the same as it is now. The program sees it properly but I cant seem to get a computer to see it that way. I do see that the boot sector shows all 0s

[Vulcan]

chkdsk will not run because my computer sees the drive as a RAW drive. [...] I do see that the boot sector shows all 0s

Assuming you're referring to the partition boot sector (a.k.a. volume boot record etc.), then that explains why Windows report it as a raw filesystem, and why chkdsk won't run. I believe that leaves you having to do manual filesystem analysis & editing (with all the risks & requirements that has), to achieve your aim of not formatting that partition - I can't think of any other options for you, within the limits you have set.

Since you say you've already recovered the files, I don't understand your reluctance about reformatting the affected partition, but I wish you good luck in your challenge of avoiding that!

[cashby]

I've formatted thousands of drives. I'd rather take the time to learn why something happened and how to fix it, getting a better knowledge and understanding of how the devices that I am using work. If I run across this again in the future and it's a HDD with programs and an OS then I might be able to fix it as opposed to recovering all the files and having to reload the software. Since it looks like it is the partition boot sector, any suggestions on how I go about fixing that? Are there any programs that will help? I came across a couple places that were explaining it while I was digging for an answer, I'm going to start looking again for them, sounds like I might be in for a lot of work. Any help in that department would be appreciated as well. Thanks for all the answers and suggestions so far.

[Vulcan]

I've formatted thousands of drives. I'd rather take the time to learn why something happened and how to fix it

Unfortunately fixing this current situation (symptom) does not tell you exactly why it happened (cause). Obviously something unusual happened during your attempt to unmount the filesystem, and from what you've said, the partition boot sector (as a minimum) got overwritten, but fixing this doesn't explain exactly why that overwriting occurred.

If I run across this again in the future and it's a HDD with programs and an OS then I might be able to fix it as opposed to recovering all the files and having to reload the software.

There's no guarantee that exactly the same result will occur again and so this effort may not be reusable, but it's your time, your data, your choice

Since it looks like it is the partition boot sector, any suggestions on how I go about fixing that? Are there any programs that will help?

I don't use Windows (if I can avoid it), but on WinXP, you may be able to use MS "fixboot" - MS has a KB article on that. I don't know what the Win7 equivalent is. Also TestDisk has some useful functionality for NTFS boot sector problems.

However, the partition boot sector may not be the only affected part of the filesystem - if you're lucky and it is only this, then great! If not, then you're back into manual examination, chkdsk, and all that...

Good luck!

[loki]

chkdsk will not run because my computer sees the drive as a RAW drive. The Active@Delete picture above shows how everything was before the issue, it's the same as it is now. The program sees it properly but I cant seem to get a computer to see it that way. I do see that the boot sector shows all 0s

I just had a external drive that showed as RAW & yes chkdsk will not run. What I used was testdisk:

Sorry for the basic intructions but some people like a walk through.

Run testdisk
Press enter
Select your disk & press enter
Select Intel & press enter
Select Advanced & press enter
Select partition with the * & press enter
Testdisk then showed that the drives boot sector & backup boot sector didnt match
Testdisk then gives the option to rebuild the boot sector from the back up
Unplug the drive & then reconnect it & i then had access to the files

Remember that its up to you if you try DIY & so is the risks.


Loki

[fzabkar]

I'd just like to add that before you unleash any data recovery software on any drive, I'd first examine its critical file system areas with a hex editor.

HxD - Freeware Hex Editor and Disk Editor:
http://mh-nexus.de/en/hxd

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

First examine the MBR at LBA 0. The partition table will tell you where the volume boot sectors are located. Then examine each boot sector.

Here is my favourite resource on the subject:
http://thestarman.pcministry.com/asm/mbr/index.html

Often you can manually reconstruct a damaged MBR or VBR. IMHO it's much safer and much more satisfying to do it this way.

[loki]

I'd just like to add that before you unleash any data recovery software on any drive, I'd first examine its critical file system areas with a hex editor.

Hi fzabkar,

I checked to see if FTK Imager could list & access the files ok which it did & it also showed the partition as FAT32. I then spent 7 hours imaging the drive & then 5 mins to repair it using test disk. I could of went straight to test disk but if something went wrong it would only make matters worse.

My number one rule is always make a sector by sector image first before any attempt of repair


Loki