The Drive Shows as RAW

The decode

RAW is Windows admitting it cannot read the filesystem, not a statement that the disk is empty. Every formatted volume carries structures that identify its type and map its files. When those structures are damaged, Windows can no longer tell what format the drive uses, so it falls back to calling it RAW — unformatted. The files remain where they were; it is the label describing them that has been lost, which is a very different and far more recoverable thing than the files being gone.

The damage is usually confined to a small, critical region. The structures that define a filesystem occupy a tiny fraction of the disk near its start. Corruption there — from an unclean disconnect, a failing write, or a developing fault — makes the whole volume unreadable while leaving the vast data area behind it untouched. That asymmetry is why RAW recoveries so often return nearly everything.

Filesystems keep backup copies of exactly these structures, which is the primary route in. Boot sectors and file tables are mirrored elsewhere on the volume precisely so a single point of damage need not be fatal. Recovery locates the intact backup copy and reads the volume through it, restoring files with their original names and folder organisation rather than as a nameless heap — the outcome his mixed documents and media need to be usable.

The dangerous move is the one Windows itself suggests. A RAW drive prompts Windows to offer formatting it — and accepting would write fresh empty structures over the volume, burying the recoverable files under a real format. Repair utilities pose the same risk by writing their corrections to the patient. Nothing that writes to the drive should touch it; everything is done on a write-blocked image, and his not having attempted a repair yet is what keeps the recovery clean.

His file types are favourable on both recovery routes. Images, video, Office documents and PDFs all carry strong signatures, so where the filesystem rebuilds they come back organised, and where structures are missing they carve cleanly from the data area by signature. Running both approaches and reconciling them maximises the result — named files where possible, carved files everywhere else.

Physical health is confirmed first, because RAW has more than one cause. Most RAW presentations are purely logical, but a developing hardware fault can produce the same label. The drive's condition is checked at the outset, and if bad sectors are present the imaging adapts accordingly — so the honest prognosis rests on whether the fault is logical alone or physical underneath, established before the work.

On the bench

The drive was imaged under a hardware write-blocker before anything interpreted it, its physical health checked on PC-3000 UDMA and imaged on DeepSpar Disk Imager where bad sectors appeared. Filesystem structures were parsed from the image in R-Studio, backup boot sector and file-table copies located and compared, and PhotoRec carving run for anything the damaged structure no longer referenced. Recovered files were validated by rendering and separated by condition.

The outcome

Write-blocked image, structures rebuilt from their backup copies, the data area carved for the remainder, and files returned with their organisation. The assessment is free and the quote is a single fixed figure inclusive of VAT; if the data cannot be recovered, there is nothing to pay. The decode: RAW means Windows lost the label, not that the disk is empty. Your files sit intact behind a damaged structure — rebuilt from the volume's own backup copies, they come back as files with names, not fragments.

Our case files are written up from genuine enquiries our lab has handled for customers across Staines, Surrey and the surrounding area, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.