PC with "healthy" NTFS drive but CHKDSK reports RAW

[csimms]

I have a Win XP home PC with 111G NTFS drive that reboots itself about 30 seconds after the desktop loads. This happens in all boot modes except Safe Mode with Command Prompt. The hard disk access light is consistently going on/off every second like clockwork. I ran a complete AVG anti-virus scan the night before this symptom started but that night there were some minor power blips due to weather so my best guess is that a voltage spike got through the APC UPS and corrupted something in NTFS.

When CHKDSK tries to run on reboot it says it cannot because the system is RAW. Diskmgmt.msc reports a healthy NTFS volume but the error-check process stops after a second with no message.

I can access the files on the drive (through command prompt) and have backed up data to a USB external drive. There seems to be no problems with the data files on the drive but I suspect it since CHKDSK won't run at bootup.

I installed ZAR 8.3 (trial) on the external USB drive and ran it overnight choosing all defaults. This morning I see an explorer view containing about 180 folders with 44K files. I know I can only recover 4 folders with the eval version but as far as I can tell, these are all deleted files and fragments that I don't need to recover. I don't see anything that looks like boot sector files. I would attach the logfile.txt but it's over 3M.

I had to move the PC to my work location and thus powered off the PC and now apparently I can't reload the saved ZAR scan info since I am using the eval version. I don't mind paying the $30 for the software if it will fix this problem.

[Alexey V. Gubin]

If you have already backed up your data, then you do not need ZAR.
Just re-format the volume and re-install Windows, and that's it.

ZAR is only useful to retrieve files which are not accessible using by other ("normal") means.

ZAR does not modify disks and cannot perform an "in-place" repair for you.

[wpnsmith]

Originally Posted by Alexey V. Gubin

ZAR does not modify disks and cannot perform an "in-place" repair for you.

Ah, I had a bit of a disconnect here as well. I have a disk that appears to work, but can't do a chkdsk, as AUTOCHECK(?) reports that it's a RAW disk.

in http://www.z-a-recovery.com/download.htm ZAR is reputed to:
Recover "RAW filesystem"
By which you mean you can recover _FILES_ from a filesystem that's so broken that Windows doesn't think it's even formatted.

I (and, I suspect, the OP) are looking for a tool to fix the "it works just fine but won't run CHKDSK because AutoCHK thinks it's RAW and aborts.

Any thoughts on how to fix the above? Run a backup and then a restore?

Thanks!

[Alexey V. Gubin]

If you have an MBR-style partition, then there might be an inconsistency between a filesystem type as listed in MBR and the actual filesystem type.
Theoretically, you can cross-check the types and see if this is the case.

If you have an LDM dynamic disk, then maybe the LDM database got corrupt, but finding out where and why is fairly compilcated.

In all cases, I suggest you backup, delete the volume, re-create it, and restore from a backup. I prefer this option because when you attempt an in-place fix on something, you need to be sure you fixed all the points needed, and this is hard to prove. If you fail to correct all the problems, it is possible that the system would seem normal, but something dormant will bite you one day when you least expect it. Hence, I suggest just to restart clean to be sure everything is in order.

[wpnsmith]

Turns out it was a malware infestation. McAfee, MultiBytes AntiMalware and Super AntiSpyware eventually straightened it out.

Thanks!

[Alexey V. Gubin]

Thank you for coming back with news. This is the first time I heard about malware causing a RAW file system indication.

[Freemark]

I had the exact same issue and was able to run chkdsk after Malwarebytes removed infection in rootkit. I really wouldn't have considered spyware infection to be a cause of the RAW chkdsk issue without this forum post.

[hakhan86]

Just registered to thank you, the same thing worked like a charm for me too, restored access to two of the three partitions that were being shown as Raw.


Thankyou. =]

[Alexey V. Gubin]

Your welcome. Nice to hear things like that.