Questions
@lcoughey asks are (I am guessing) because RAW tells you nothing else than Windows saying, "I do not recognize file system". It tells you zero about the why. So if this data is important, you do not just assume stuff and you do not just start experimenting with different file recovery tools.
If we make the assumption it's
value is zero to little, then you could arguably take the risk and
use a file recovery tool. My advise would be to invest in a proper tool with a known good track record with regards to file system reconstruction. Pay attention to licensing. A tool like R-Studio which I consider a good tool is one year license and does not allow for providing data recovery services to 3rd parties unless you pay for tech license. ReclaiMe offers life-time licenses and AFAIK has no restrictions with regards to providing data recovery services. DMDE may be more challenging to use, but it's pro license is life time and license allows data recovery services.
If client is keen on getting data back but not enough to pay for data recovery service,
first step should be cloning the drive using something like ddrescue or better; HDDSuperClone. If underlying cause is of a physical nature, cloning using these tools puts less stress on the drive than using file recovery software.
If we can put a monetary value on the data of say $350 or more, then best is to skip any DIY attempts and
send the drive to a data recovery lab. If client does not have the funds right now, put the drive aside. Only time when you should put a time limit on this, is when the drive is flash based. Flash memory 'leaks' data over time and although I have tried finding a reliable answer to the question how much time you have, I haven't found any. It depends on factors like type of NAND memory (SLC, MLC, TLC etc.), and amount of write erase cycles it has gone through.
Now about RAW.
Windows basically tells you RAW if it can not determine file system. It can be a file system it knows that's too corrupt, or a file system that 'alien' to Windows. Assuming it's a known file system, again RAW tells you basically nothing. Someone knowledgeable can use a disk editor and flip a single bit in the right place to produce a RAW file system. A good target area for this is the volume boot record. And indeed if damage is limited to the boot record such damage may even be repairable. DMDE can do this, but we have to consider it's very hard to tell damage is actually limited to this area.
For example, the BIOS Parameter Block in boot record tells the OS the location of the MFT (in clusters). It also tells clustersize. So normally OS can look up start cluster MFT, do cluster to LBA conversion using cluster size and locate the MFT. If we limit ourselves to those we have 3 points of failure which will all prevent Windows from 'parsing' the file system: We have issue in boot record (start cluster MFT and/or clustersize wrong) or the MFT itself is damaged.
If we can be certain one or more of these are 'corrupt' due to some logical issue, we could use a good file recovery tool. But can we be, and should we take the risk? Even only starting R-Studio and pointing it to a simple corrupt FAT volume results in number of reads (captured with DeepSpar USB Stabilizer) and in case of a read problem in any of these areas it would result in multiple re-read attempts:
Successful Read: 0[40]
Successful Read: 249737215[1]
Successful Read: 249737200[15]
Successful Read: 249737088[16]
Successful Read: 128[24]
Successful Read: 512[24]
Successful Read: 40[63]
Successful Read: 162[24]
Successful Read: 34[16]
Successful Read: 546[24]
Successful Read: 249737215[1]
Successful Read: 191[24]
Successful Read: 575[24]
Successful Read: 249737214[1]
Successful Read: 128[40]
Successful Read: 256[24]
Successful Read: 640[24]
Successful Read: 1024[40]
Successful Read: 1152[24]
Successful Read: 1536[24]
Successful Read: 249737214[2]
Successful Read: 2048[40]
Successful Read: 2176[24]
Successful Read: 2560[24]
Successful Read: 264192[21]
Successful Read: 264320[16]
Successful Read: 264336[8]
Successful Read: 264213[19]
Successful Read: 264704[24]
Successful Read: 249737214[1]
Successful Read: 0[8]
(X[Y] - X = LBA, Y = number of sectors)
And again, in case of a physical issue this is not what you want. Now assume the area in which the MFT is stored is bad due to a surface issue which will almost by definition result in multiple read attempts, even so if the file recovery tool can be configured to avoid this!
Anyway, point I am trying to make is:
- RAW file system is a catch all message that tells you nothing.
- Although cause can be of a logical nature, it can als be caused by a physical issue.
- In case of a physical issue you want to avoid subjecting the drive to file recovery software.
