The question presumes that if a data recovery tool can 'work' with a volume, Windows should be able to do so as well. It ignores the point that data recovery tools are designed to work with partitions that Windows can no longer access.
But idea of file recovery tools is that they can accept partial data and can ignore corrupt file system meta data where Windows expects the file system to be intact.
The idea can be simply demonstrated by for example assume the first 100 records of the $MFT being corrupt: Windows will not be able to work with such a file system, while a file recovery tool simply parses the rest of the 500000 $MFT records and will thus be able to show an almost complete file system. As an example .. :
.. this file recovery tool detected a chunk of MFT records that starts at the 24th record which suggests 0 - 23 are missing. Windows could never mount such a file system and designate it as RAW while the file recovery tool happily reconstructs a nearly complete folder tree.
In addition to that, a file recovery tool may simply designate a volume as NTFS just because the partition table does so. The RAW file system that Windows shows is not because it can not read the partition table and reach that same conclusion, it is due to it having tried 'mounting' the file system and having failed during that process.
You're basically comparing apples to oranges.
Important: RAW file system can be result of inability to access key sectors which in turn can be the result of a physical issue with the drive. This should always be investigated first. Assume the worst first, then go from there.
If there are any signs of physical issues then:
- Avoid in place repairs
- Avoid scanning the drive using file recovery tools
Instead clone/image the drive using a tool like ddrescue or HDDSuperClone
RAW file system:
A (according to Windows) RAW file system is any file system which Windows can not determine. So this may be a foreign file system which is 100% valid but it simply doesn't know or a file system that is corrupt.
File system corruption knows many forms, causes and whatnot, so RAW file system is basically a 'catch-all' that tells us nothing specific. One flipped bit at the 'right' place is all that's needed while it can also be true that a significant part of the file system is corrupt.
DMDE is a tool that can help us get some additional info, see what we're dealing with. I'll ignore file systems Windows will not recognize anyway.
To determine the file system Windows needs to 'walk' a chain of structures:
- Partition entry points to boot sector
- Boot sector points to file system structures, for example the NTTS boot sector points to first cluster of the $MFT and provides parameters such as cluster size which we need to convert the cluster address to an actual LBA address.
- Windows then parses the $MFT
DMDE does some quick checks:
It checks partition entry (E), boot sector (B), backup boot sector (C) and file system (F).
So, RAW file system can theoretically be caused by any of those:
If E does NOT point to valid boot sector (B) OS will be looking at non boot sector > unrecognized = RAW file system.
If boot sector is corrupt (B) Windows may not find correct pointer to rest of file system. F will not be found.
If E and B are intact and valid DMDE should be able to locate MFT structure (assuming NTFS), if not, F is absent, or it appears corrupt F is red.
E, B, F can be absent (not found) or red (contain nonsense, for example uneven cluster size).
In this example:
E (partition entry), B (boot sector), C (backup boot sector) are okay, both the MFT and MFT mirror are not found/corrupt (xx).
In-place Repair:
I advise you first create a disk image, a sector by sector backup of the drive!!
DMDE offers some repair options, examples:
For example IF B is absent or red while C is present and green you can repair the boot sector using it's backup.
If B, C and F are present while E is absent you can add the partition to partition table.
Verify if the entry you want to repair resolves to a file system! Select the entry and click 'Open Volume'. If DMDE does not resolve the directory tree then repairing the entry is of little use. You'll be repairing a volume that you will not be able to access after the repair.
So, after 'Open Volume' you should see a directory tree sort of as you expect it to be:
I advise you first create a disk image, a sector by sector backup of the drive!!
To make repairs, tick 'advanced mode' first. Now right click menu for an item
has an 'Edit' item. None of these repairs make sense after chkdsk was run.
File Recovery alternative
This is the safest approach!! For any volume you can try option 'Open Volume' and DMDE will try parsing the file system as-is.
'Full Scan' will ignore existing file system and build a virtual file system. Many tools exist that offer similar functionality, I am simply using DMDE as an example to illustrate multiple roads to recovery of your data.
GParted
on it and check for errors. Later you may wantfdisk
to change the file system type to NTFS (again, rewrite MBR). Don't try to create file system on partition!fsck
on the file system? What error does Windows show? The event log usually helps in this case. There is a host of utilities which may show you more than thediskmgmt.msc
, e.g.fsutil
. If you have reason to suspect a failing disk, avoid power cycles at all cost and use some SMART-enabled too to read out the health state of the disk.