Question Hot Swapped Hard Drives in Windows, Now Windows Reports the Drive as RAW

[Modify_inc]

I have a quick-release hard drive bay in my W10 PC so I can easily swap hard drives. When swapping them out, Windows will never seem to recognize the new replacement hdd. I have to open Computer Management and rescan the drives, then it will show the correct hdd in File Explorer. If I don't rescan the drives, File Explorer will still show the previous drive as still connected and using the same drive letter. Apparently, Windows keeps a cache of the old drive partition or directory, because if you accidentally open the drive (which I did, accidentally of course), it still shows the files and folders from the previous drive. So, I thought I would try to open a file just to see what it would do. As expected, since the files are actually on the previous disconnected drive, it popped up an error that the file is missing or corrupted. Though surprisingly, it opened text files without issue.

So, after realizing the issue, I rescanned the drives under Computer Management. To my horror, it showed my 2 TB hdd as RAW! ( F: ) 1863.01 GB RAW Healthy (Primary Partition)

This drive was working perfectly 20 minutes earlier before I temporarily swapped it out with a 500 GB drive to transfer some files. The 500 GB drive only had a few files totaling ~200MB, so not even half a GB, so if it wrote over anything, it shouldn't have been much.

Knowing this drive is in great shape, and this sudden change from NTFS to RAW, which likely resulted by me trying to access the drive while Windows still thought the previous drive was connected, what are my chances of fixing this? Has anyone experienced this issue before with hot swapping a drive, and accidentally accessing the drive before Windows rescans and actually shows the correct drive in File Explorer? I have around 1.2 TB of data on this drive I would rather not lose.

I created an image of the 2 TB drive, and it finished this morning (14 hours later). R-Studio shows the one partition as Partition1 Data NTFS 1MB 1.82 TB. Though, when I open Partition1, it shows the directory from the previous 500 GB drive (which remember, only had a few small files totaling ~200 MB). Obviously, Windows somehow wrote the 500 GB directory structure to the 2 TB drive. If it updated the partition, shouldn't it have also changed the 2 TB size to the same size as the 500 GB drive?

 

[Modify_inc]

Also, how do you disable smileys? I had to put extra spaces around the ( F: ) to prevent this from happening: (F

 

[hang-the-9]

Hotwap bays and systems is not the same as using a bay to change them quicker. Make sure your setup is actually setup for hotswap use. To possibly get the data back, I have had good results with Testdisk to get the partitions back on disks with file system issues.

"Can a SATA drive be hot swappable?
Not all SATA drives are hot swappable, but most are hot pluggable. Hot swappable SATA drives require a controller and a compliant power source. What makes a SATA drive hot swappable is its ability to sense the device's presence in a port without turning the SATA hard drive’s power on.
"

 

[USAFRet]

Quick release bay is NOT the same as a hot swap bay.
At all.

It is just easier to physically change drives.

 

[fzabkar]

It would appear that the 2TB drive has partially inherited the NTFS metadata (eg MFT$, Master File Table) from the 500GB drive.

Since you have a clone (good), you could view the clone with a disc editor, eg DMDE (freeware). DMDE will enable you to examine the NTFS metadata at the byte level. R-Studio may be able to do this, but I am not a user of that tool.

Can you show us DMDE's Partitions window (for your clone)? No need for a full scan.

 

[Modify_inc]

It would appear that the 2TB drive has partially inherited the NTFS metadata (eg MFT$, Master File Table) from the 500GB drive.

Since you have a clone (good), you could view the clone with a disc editor, eg DMDE (freeware). DMDE will enable you to examine the NTFS metadata at the byte level. R-Studio may be able to do this, but I am not a user of that tool.

Can you show us DMDE's Partitions window (for your clone)? No need for a full scan.

I was just about to try TestDisk on it, as many have recommended it for repairing/recovering a partition. I don't have DMDE, but I'm installing it now. Wil let you know shortly. Will DMDE open a multi-file image created in R-Studio using their R-Drive Compressed Image format using the .rdr extension? Guess I'll find out shortly.

 

[fzabkar]

I doubt that DMDE will recognise R-Studio's compression.

TestDisk is unsuitable in your case. The free version of DMDE can do anything TestDisk can do, and a lot better.

 

[Modify_inc]

I doubt that DMDE will recognise R-Studio's compression.

TestDisk is unsuitable in your case. The free version of DMDE can do anything TestDisk can do, and a lot better.

R-Studio has a hex editor, though I would need help finding the $MFT file you referenced earlier. Also, since the image I have is a direct clone of the drive, can I not just open the physical drive in DMDE? DMDE seems to open the multi-file images just fine, the problem is , it does not link them together as one complete image, so I can only very one part of the image (1.2 TB) of the 3 parts. That is if it's actually showing it correctly, which it appears it doesn't. It shows the partition as unallocated, which isn't correct, as R-Studio shows the partition just fine, just with the wrong directory of folders.

Here is a snapshot using the actual Physical Drive to display its partition info:

Here it is using the 1st image file of the multi-file images:

 

[fzabkar]

DMDE appears to be treating the .rdr image as an ordinary data file, so that's of no use to me. Sorry.

However, the Indicators column in the other window is showing an underlined "F", which means that DMDE has found an NTFS file system, but something is wrong with it. If you d-click the NTFS volume and expand the $Root, I expect you will see your damaged file/folder tree.

 

[Modify_inc]

DMDE appears to be treating the .rdr image as an ordinary data file, so that's of no use to me. Sorry.

However, the Indicators column in the other window is showing an underlined "F", which means that DMDE has found an NTFS file system, but something is wrong with it. If you d-click the NTFS volume and expand the $Root, I expect you will see your damaged file/folder tree.

It shows the directory structure of the the previous 500 GB drive. I see the metadata details including the $MFT you mentioned. Anything I can do or look for, I'm willing to try since I do have a cloned image I can always recover from.

 

[fzabkar]

If the 500GB $MFT has partially overwritten the 2TB $MFT, then the affected file and folder names would have been lost.

It seems to me that you may be left with a full scan as your only option. You could refine the scan to only look for NTFS metadata. In that way you will find pieces of the 2TB $MFT, if they still exist. I would rather do this on a clone, though.

That said, since you are using R-Studio, you should be able to achieve the same end. An R-Studio scan result will present you with several $MFT options. Perhaps you will find at least some of your files amongst those.

If you need help, several data recovery pros hang out here:

https://ww.reddit.com/r/datarecovery/new/

 

[Modify_inc]

If the 500GB $MFT has partially overwritten the 2TB $MFT, then the affected file and folder names would have been lost.

It seems to me that you may be left with a full scan as your only option. You could refine the scan to only look for NTFS metadata. In that way you will find pieces of the 2TB $MFT, if they still exist. I would rather do this on a clone, though.

That said, since you are using R-Studio, you should be able to achieve the same end. An R-Studio scan result will present you with several $MFT options. Perhaps you will find at least some of your files amongst those.

If you need help, several data recovery pros hang out here:

https://ww.reddit.com/r/datarecovery/new/

Thank you for all your help thus far! I will continue with R-Studio and visit the link you suggested if/when needed.

If or when I find these $MFT files, I'm still at a lost as to knowing which ones to recover, and then how to re import them correctly back into the filesystem. Something tells me, my only real option is likely just going to be trying to recover as many files I can, then just reformatting the drive.

 

[USAFRet]

Something tells me, my only real option is likely just going to be trying to recover as many files I can, then just reformatting the drive.

Almost certainly, yes.
Recover what you can to some other storage device.

Bringing this whole drive and contents back to original condition is unlikely.

 

[fzabkar]

If or when I find these $MFT files, I'm still at a lost as to knowing which ones to recover, and then how to re import them correctly back into the filesystem. Something tells me, my only real option is likely just going to be trying to recover as many files I can, then just reformatting the drive.

I would forget about trying to repair the filesystem. If parts of the old 2TB $MFT have been overwritten, then they are lost forever (?).

I think that the end result will be a combination of files recovered via partial fragments of the old $MFT, if they exist, plus a raw recovery based on file signatures. Raw recovered files will lose their original file names, and the files may be incomplete/corrupt if they were fragmented.

If I understand correctly, R-Studio will estimate success rates and the number of files per $MFT fragment.