How To Fix: External Disk Drive Suddenly Became RAW

 How To Fix: External Disk Drive Suddenly Became RAW

DISCLAIMER: These example use techniques that I actually employ once to recover a drive from a raid 1 bay where both drive where bad. This tutorial might be wrong or dangerous or inefficient. If you try yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that his provide.

A common and befuddling problem with computers is the sudden and seemingly inexplicable disappearance of an external hard drive that has been functioning properly. It can be a breathtaking experience to suddenly be told that your data, often irreplaceable pictures and documents, might be gone forever.

This can even happen on a pair of Raid 1 hard drive because maybe you purchased them as a pair at the same store and they both went down at the same time. I think it is almost better to buy them at different store location or to make sure they were not manufactured at the same time :)

As with many similar situations in life the appropriate response is “Don’t panic”. When approached sensibly and carefully, the situation can be resolved and the data saved more times than not.

Error Messages

Common error messages associated with the sudden inability to access an external hard disk drive.

Windows XP

	Windows 7
DO NOT FORMAT THE DRIVE

When attempting to access the drive in Windows you may see a message asking you to format the drive DO NOT FORMAT THE DRIVE

You need to format the disk in drive before you can use it.
Do you want to format it?

Another error that you may see when trying to access the drive in Windows from a program or the command line is…

This volume does not contain a recognized file system. Please make sure that all required file system drivers are loaded and that the volume is not corrupted.

Attempting to run chkdsk in an attempt to repair the problem will give an error also…

chkdsk can not be run on the drive
The type of the file system is RAW.
CHKDSK is not available for RAW drives.

The Disk Management window shows the partition as either RAW or without a filesystem type.

Windows XP

Windows 7

Properties of the drive show that both used and free spaces are 0 byte in size for the raw drive

What does RAW partition mean

A RAW filesystem simply means that it is a filesystem that is not recognized by Windows. Therefore all the available filesystem drivers are unable to mount the filesystem as a drive. This often happens when the records determining the filesystem type or location on the disk are damaged or corrupted, usually the partition table or the boot sector.

Since Windows sees no filesystem in the partition, it prompts you to format it in order to create a filesystem on it. DO NOT FORMAT IT. 

Why does it happen and how to avoid it

The most common cause of external hard drives suddenly becoming RAW drives is if they are disconnected from a computer without using the “Safely Remove Hardware” option. This can happen in many ways such as a power failure, unplugging the drive from the USB port or from its AC adapter, a problem with the computer that causes it to temporarily disconnect the USB hubs and many more circumstances can lead to this occurring.

Always use “Safely remove hardware” to disconnect the drive. Left click the icon on the taskbar, select the device from the menu, and wait for the confirmation message.

Before proceeding beyond this point, you need to be aware of the risks involved. If the problem with the drive is not simply a logical error but is a manifestation of physical damage then the more you use it and try to repair, the worse the damage may become. To minimize the risks, the drive can be taken to a professional who is experienced in this type of repair. The drive should not be making strange clicking or beeping noises. That means that there is definitely physical damage and it should be sent to a facility with the proper tools and environment to repair/recover it since trying to repair it as described in this post can make that situation worse. If you wish to continue on your own there are three important rules to remember.

1. Computer problems are variable. You may very well come up with a different situation than I outline below. Make sure that you stop and think things through carefully when the process becomes different than I describe.

2. You DO NOT WANT TO WRITE ANYTHING TO THE RAW DRIVE except for the repaired MBR and repaired Boot Sector if necessary. Any other writing can overwrite data on the drive that you would want to keep.

3. This repair does not apply to solid-state drives (SSD). They are very different than normal drives and can erase important data on a RAW partition just by connecting power to them. 

Accessing and Assessing a Hard Drive’s S.M.A.R.T. Data to Determine if There is Physical Damage

Being able to effectively analyze the S.M.A.R.T. data on a hard disk drive (HDD) enables you to quickly identify problems that can aid you in recovering all of the data from it before it becomes irretrievable or requires significant expense to retrieve.

S.M.A.R.T. stands for Self-Monitoring, Analysis and Reporting Technology and is the hard drive’s record of its internal diagnostic monitoring and usage statistics packaged for being accessed externally. The primary purpose of S.M.A.R.T. is to alert us to an impending failure of the drive while there is still time to save the data. When a hard drive reports that the S.M.A.R.T. health is FAILED you must get the important data off of it immediately and not use the drive anymore.

IT IS IMPORTANT TO UNDERSTAND THAT DIFFERENT MANUFACTURERS AND DIFFERENT DRIVE MODELS CAN STORE AND DISPLAY DIFFERENT SUBSETS OF S.M.A.R.T. DATA AND CALCULATE VALUES AND TOLERANCES DIFFERENTLY.

S.M.A.R.T. data is best used as a general guide. For specifics, the hard drive’s technical documentation must be consulted. Sometimes that information is difficult to come by and can be proprietary. For example, the formulas for how some manufacturers calculate normalized values for attributes can be very difficult to find.

Wikipedia entry for S.M.A.R.T.

Proper analysis of S.M.A.R.T. data

• Can help determine if the problem is physical damage or just logical damage.
  • With logical damage, the drive can be trusted and continue to be used after being repaired.
  • With physical damage, you want to get any important data off of the drive and replace it.
• Helps you choose the best method for recovering all of the data from the drive.
• Prevents you from accidentally doing things that may make matters worse.

In order to check the S.M.A.R.T. data on a HDD

• The drive should not be making strange clicking or beeping noises. That means that there is definitely physical damage and it should be sent to a facility with the proper tools and environment to repair/recover it.
• The drive needs to be accessible by the computer’s BIOS during POST (responds to the ATA command IDENTFY_DEVICE). In other words, the drive should be visible in Windows.
• In the case of external drives connected via USB they need to be detected by the computer’s Plug and Play software (responds to the ATA command IDENTFY_DEVICE).

After making sure that the connection between the drive and the computer is correct and its quality is the best it can be, you need to check the health of the drive itself. Then you can rule out physical damage that requires repair with specialized tools in a controlled environment.

What We Are Looking For

·        Does the drive make noises that it did not make before?

o   Loud clicking or a periodic beeping sound may indicate mechanical damage. Physical damage may require the drive to be sent to a facility with the proper tools and equipment to recover the data.

·        Does S.M.A.R.T. show any errors or bad attribute values?

o   We look at the Raw Value of S.M.A.R.T. attributes with ID#s 5, 191 and 197.

·        Does it pass the S.M.A.R.T. Short Self-Test?

o   We run the S.M.A.R.T. Short Self-Test.

If it does not pass any of these tests, you need to take it to a data recovery lab and have it professionally recovered otherwise you risk making things worse.

View S.M.A.R.T. data with GSmartControl

Get a copy of GSmartControl for Windows
http://sourceforge.net/projects/gsmartcontrol/files/0.8.7/gsmartcontrol-0.8.7-win32.zip/download
Unzip it and run gsmartcontrol.exe
Double-click your drive and click the ATTRIBUTES tab.

• If ID #05 Reallocated Sectors Count is listed and has a RAW VALUE greater than 5 then there is physical damage in the form of bad sectors.
• If ID #191 G-sense Error Rate is listed and has a RAW VALUE greater than 0 then that means the drive has been dropped or bumped hard.
• If ID #197 Current Pending Sector Count is listed and has a RAW VALUE greater than 5 then there is physical damage in the form of bad sectors.

Next, click on the PERFORM TESTS tab and execute the SHORT TEST. If it does not pass the test then there is physical damage.

If there is no indication of physical damage then you can continue. In order to repair the most common problems that cause an external disk to suddenly become RAW we will use TestDisk.

Download Testdisk
http://www.cgsecurity.org/wiki/TestDisk_Download
and run testdisk_win.exe

TestDisk is a console application so you have to use your keyboard to interact with it instead of your mouse. Won't work without a keyboard on most tablet as most on screen touch keyboard are lacking down/up arrow This is the case for  Samsung tablet

If you want to recover your data I recommend to buy a sabrent dual 3.5 HDD external enclosure where you can snap the bad disk in. Before you proceed. Purchase a disk of the same size and format it. The disk can be used to copy your data when possible using TestDisk

Run testdisk_win.exe as admin

Choose Create log if you want to document your steps 

Select the disk that you can't access - make sure the disk is online and that you identify clearly the disk you will use to recover/copy data onto vs your bad disk.

select that disk. Make sure that your external disk is highlighted

Choose Proceed and hit enter 

in Partition Table Type selection. most tutorial recommend to move the cursor from None to Intel. In my case and certainly with recent version of testdisk for NTFS disk, I just left the selection at None and just press Enter. Then TestDisk immediately found the NTFS partition.

Select Analyse and hit enter

The partition data looks incorrect (an explanation of why is beyond the scope of this article)
Select Quick Search and hit enter

When the Quick Search completes, we see one partition (if you only see the option to CONTINUE at the bottom of the screen press ENTER one time to continue to the screen that you need to be at).

Assuming that the partition was shown correctly (Structure:OK) 

Lets look at the data on that partition press
P
and you should see a list of files/folders in the partition.

If none were shown, I would assume there was none to show or Test Disk was unable to do the job :(

Hmmm… This looks like a bunch of diagnostic tools but not our missing data. We’ll need to look further. This means that you probably have more than one partition on that disk Press
Q
to go back a screen and then press
enter

To get to this screen, select DEEPER SEARCH and press enter.

Naturally, the Deeper Search takes longer than the Quick Search

When the Deeper Search completes we now see two partitions. The one we saw after the quick search and maybe another one.

Select the new partition and press
P
to see the files/folders and now we see the data we want to make visible again.

You can browse the FAT select parent folder by moving pointer to it use .. to move up etc...

pres a to select all from top folder this will select all folders and sub folders and files

press c to copy

now select target drive. The drive MUST BE a different drive than the damage drive.

Be patient it will take a while.... The file count will increase in green some might be bad meaning lost forever. At least you recover some of your data!