Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


NTFS Partition Changes to RAW - Solution

  • Please log in to reply
2 replies to this topic

#1 samgoober


  • Members
  • 1 posts
  • Local time:12:20 AM

Posted 13 February 2011 - 10:16 PM

We had a customer bring in a PC infected with a rootkit, MBR virus, and a myriad of malware. After cleaning the drive, we found the data was totally inaccessible. Windows XP and Windows 7 both reported the drive type as RAW (drive was originally NTFS-Windows XP Home).

Using a disk editor I looked at Sector 0 of the drive, as well as the first sector of the former NTFS partition. Both were gibberish. I tried fixmbr, fixboot, mbrfix, all the normal Windows tools. None of these worked. I tried several tools that claimed to be able to recover problems like this. None of them worked (including the one that ended up working).

In retrospect, probably any of the packaged (non-Windows) tools I tried (Partition Magic, Partition Tools, and other similar programs) would probably have worked had I tried this. All of these tools have a "partition recovery" feature. Running these natively wouldn't work - they all saw the RAW partition as a "real" partition. I presume for all they knew, the RAW partition was as it was supposed to be. These tools and wizards were built to recover deleted partitions and put them back like they were before they were deleted.

I was ready to format the drive and reinstall Windows, when I had a thought - what if I actually deleted the RAW partition? At this point, I had nothing to lose - I was gonna format it anyhow right? So I deleted the RAW partition. Afterward, I told the tool I was using (which happened to be Partition Tool free edition (http://partition-tool.com/personal.htm), but as I mentioned, most-likely Partition Manager or other similar tools would have done the same thing), to recover the deleted partition. I kind of expected it to put it back as a RAW partition. To my surprise (and utter delight) it recovered the partition as NTFS! All the user's data and programs were there, intact and working (which was good because he has some archaic programs on there that I don't think can be obtained anymore.)

I wouldn't probably recommend this as a first choice unless you know you have a good copy of your data. It worked for me when nothing else would. And I was ready to format/reinstall, so there was nothing to lose at this point.

Hope this helps someone.
CSI Computer Service
Logan IA

Edited by hamluis, 14 February 2011 - 08:42 AM.
Moved from XP forum to All Other Applications.

BC AdBot (Login to Remove)


#2 AustrAlien



  • Members
  • 6,772 posts
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:20 PM

Posted 14 February 2011 - 08:33 AM

Hello Sam, and :welcome: to the BC forums.

A nifty little maneuver ...

Thanks for the post: I have stashed it in my treasure trove of potentially useless useful info.
Google is my friend. Make Google your friend too.

Posted Image

#3 hamluis



  • Moderator
  • 56,541 posts
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:20 AM

Posted 14 February 2011 - 08:41 AM

Some of are very familiar with the Easeus utility you linked to, but your comments re the Recovery Wizard were news to me.


Your comments may provide useful information to those who encounter damaged or otherwise troublesome partitions.

Thanks, happy computing :).


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users