What is this Raw File System
Sometimes a damaged volume may look like it lost its file system and CHKDSK tool will complain that file system is raw
The type of the file system is RAW.
this is a curious issue as seen here
what the hell is a RAW file system?—
what the hell is a RAW file system?—is easy enough to answer. It's simply a disk partition that has not been
formatted with an NT file system, neither FAT nor NTFS.
so what is this raw or as said raw file system, it is nothing but a system supplied file system driver that is the
"last resort" for all I/O requests requiring file system support. When the I/O manager calls active file systems
to mount a volume, RAW is always called last because it supports all disk and tape media.
However, RAW supplies very primitive file handling capabilities. That is, it does not impose any on-disk file
structure or metadata structures for the information about the media; it simply allows read/write access
to the logical blocks on the physical disk. For example, it treats the whole disk as a single file and supplies
physical-disk-level access to the disk.
If a device is being driven in raw mode, it has no function driver and no upper or lower-level filter drivers.
All raw-mode I/O is done by the bus driver and optional bus filter drivers.
Note, however, that a bus driver does not handle read and write requests for the devices on its bus.
Read and write requests to a device are handled by the device's function driver only. Only if the device
is being used in raw mode does the parent bus driver handle reads and writes for the device.
ok the above extract is from DDK ...now lets see where can i see this happening
here you see that it is for rawtape, rawcdrom, rawdisk (I am using device and driver explorer here )
so how can i reproduce this issue--raw file system reported by chkdsk --we can use dskprobe from https://technet2.microsoft.com/WindowsServer/en/library/006902f1-bae9-4055-9ad2-123ea19006b71033.mspx
and repro this issue ( please do not try this on a production or home machine -you may loose data)
There are two places where we store file system information as seen below
1 MBR partition Table
2 Volumes' boot sector
When the file system information provided on these 2 sectors of disk is not good you may see chkdsk reporting raw file
system (though the data is still there)
A Raw volume is a volume that was never formatted and does not contain a File System
so just to play i did same on my test machine and removed OEM ID string on D drives Volume boot sector and yes this is
my production machine containing lots of data, Now when i try to access D drive it asks do you want to format it...
..Of course NOT
As if we format we will lose all the data on D drive.
I tried running Chkdsk and you can see results below. It says, type of File System is raw. Chkdsk is not available for raw drives.
I reversed my changes using dskprobe again (added NTFS IN OEM ID string) and Yes my data is back and D drive is accessible.
This posting is provided "AS IS" with no warranties, and confers no rights.