Posted on 2007-07-11 09:09
tanzek 閱讀(1694)
評論(0) 編輯 收藏
To know how to deal with it, we need to discuss the basics first. The filesystem type is recorded at least in two separate places
- In the partition table (MBR, sometimes referred to as a legacy-style partition) or in the LDM database (when dynamic disks are used).
- In the volume boot sector.
Three significantly different combinations are thus possible. - Both partition table and volume boot sector provide consistent information about the filesystem type. This is how the things are supposed to be when the volume is online and operational.
- Only one of these places contains proper information, or the information is contradictory (e.g. partition table lists the volume as NTFS, while the boot sector indicates it is the FAT32).
- Neither partition table nor volume boot sector contain filesystem type information (the partition table will in this case indicate the special filesystem type of zero, i.e. unused volume). This can happen during normal operation and is pretty legal configuration state. It appears when you create a volume (e.g. using Disk Management applet) but do not format it at the same time. You can even assign a drive letter to this unformatted volume, as illustrated below (notice the underlined "H:" drive which has no filesystem type defined).
If the volume filesystem type information is unavailable, attempting CHKDSK against the volume will result in the following message: The type of the filesystem is RAW.
CHKDSK is not available for RAW drives. Sometimes, the volume fails in such a way that it becomes RAW. In most cases the failure will be associated with a sudden reboot (per power failure or the STOP error). Several causes are possible: partition table, LDM database, or the volume boot sector corruption, or (on the NTFS volume) when certain records in both MFT and MFT mirror are damaged beyond easy recognition. |
|
|
?
|
|
|
|
|
|
The data recovery should not be complicated because the volume location info is still available. Be advised that some arbitrary filesystem type may be associated with the volume when you attempt to identify it amongst the list of the available volumes.
Notice the highlighted volume - it is the same H: volume featured in the earlier screenshot. It has the correct size (128MB) and the correct on-disk location (starting at 200+40+40 = 280MB from the start of disk), but the filesystem type of "Large FAT16" is not a good bet because the volume is in fact NTFS - the filesystem type information in the LDM database got corrupt (yeah, I know because I did it in purpose). This fact will be later discovered by ZAR and the appropriate decision will be made to treat the volume as NTFS, and in this test case an exact recovery is ultimately achieved. In a real world case, the recovery expectations vary depending on the damage profile and locality. Overall, I'd expect a good yield. Exact recovery is possible if the damage is confined to the boot sector(s) and/or partition table (however there is no easy way to tell if it is). Suggested course of action is thus as usual: to download our data recovery tool (click here for a download page) and try it. Be sure to check this page as well.
TraceBack: http://www.z-a-recovery.com/art-raw-filesystem.htm |
注：今天本來想查點RAW FileSystem的資料，無意中找到這篇關于RAW FileSystem恢復的，還算得上是一篇資料文章哦，所以就轉貼過來了！~