A gentleman in Cramond brought us a 4 TB external drive last month in exactly this state. He had copied a holiday’s worth of photos onto it the night before, unplugged it in a hurry without using the Safely Remove option, and when he reconnected it in the morning Windows asked to format it before he could open anything. Disk Management showed the partition in place, same size as before, same drive letter — but the filesystem column now read “RAW”. He had spent the drive back and forth to a work PC in Edinburgh City Centre trying to make it work, and had come very close to accepting the format prompt. He hadn’t, and that is why we got a happy phone call two days later.
The RAW symptom is one of the most common data-recovery jobs we see in Cramond, Davidson’s Mains and across north-west Edinburgh, and the good news is that in most cases the files are still there and intact — what is damaged is only the small bookkeeping structure that tells Windows where to find them. Treated carefully, the drive gives up its contents without a fight. Treated roughly, the same drive can be irrecoverable within minutes. The order below is the one we actually use on the bench.
What “RAW” Really Means
RAW is not a filesystem the way NTFS, exFAT or FAT32 are. It is Windows’ way of saying “there is a partition here, with a size, but the first few sectors do not add up to anything I recognise.” On an NTFS drive the first block Windows looks for is the boot sector and a little further in is the Master File Table (MFT) — the index that says which file lives in which clusters. If the boot sector is zeroed, the magic number is wrong, or the MFT’s main copy is unreadable but the backup in the middle of the drive is intact, the capacity and the partition still show up, but Windows refuses to mount anything and offers to format. That offer is a reflex, not a diagnosis.
The useful mental picture is a library where someone has torn out the card catalogue. Every book is still on its shelf, with every chapter intact; the librarian just cannot find anything without the index. A recovery tool rebuilds that index by scanning the shelves directly, which is almost always possible unless someone has been shelving new books on top of the old ones in the meantime — which is what Format and CHKDSK both do, in slightly different ways.
The First Rule: Stop Writing to the Drive
The moment a drive goes RAW, every write to it chips away at the chance of recovery. That means not formatting, not running CHKDSK with the /f switch, not “repairing” through the Windows error dialog, not running Disk Management’s “Initialise” option, and not pulling it in and out of USB ports hoping for a different answer. If it is the Windows boot drive that has gone RAW on a Cramond laptop, shut the machine down — Windows itself writes to the drive constantly in the background, and a boot drive that was recoverable at 10 a.m. may not be by lunchtime.
Our colleague’s most-regretted job in 2026 was a Portobello customer who ran CHKDSK /f on a RAW external drive on the advice of a help forum; we have written separately about running CHKDSK and finding the files missing, because that outcome is now so common it deserves its own guide. On a RAW drive, CHKDSK does not help — at best it refuses to run, and at worst it writes new filesystem structures over the files you were trying to save.
Clone First, Recover From the Clone
On the bench, the first physical step for any RAW drive is to pull a sector-by-sector image of it to a separate, healthy disk. Nothing that follows is done on the patient — the original drive goes into a write-blocker or a read-only USB adapter and stays that way, and every recovery tool runs against the image file. There are two reasons we do this. First, the drive that went RAW may be dying in a way that has nothing to do with the filesystem — the SMART log often shows reallocated sectors, pending sectors or a growing read-error count — and every unnecessary spin-up of a dying drive is a chance for the next read to fail completely. Second, if a recovery tool misbehaves, the image is still there to try a different one against.
We run that image with ddrescue on Linux rather than a Windows clone utility, because ddrescue handles bad sectors by mapping them and coming back for them later, instead of hanging on the first one and then failing the rest of the clone. The log file it writes as it goes means a two-day-old clone can be resumed where it left off if the drive needs to go back in the fridge to stabilise. That bit of discipline is also what separates most professional data recovery work from a consumer tool — the tool is often similar, but the handling of the drive underneath is not.
The Rebuild: Finding the Lost MFT or Partition
With a clean image in hand, the recovery itself is usually one of two jobs. The first case is a damaged boot sector on an otherwise intact NTFS partition, which is the fast one — the backup boot sector lives at the end of the partition, a tool like TestDisk can copy it back into place in the image, and once it does the volume mounts normally and the files come straight out. We have had Cramond and Granton-Pilton drives recovered this way in under an hour from the time they came onto the bench.
The harder case is a damaged MFT, where the index itself is corrupt. Here the recovery tool has to walk the drive cluster by cluster looking for file headers it recognises — the first few bytes of a JPEG, a DOCX, a PST, a MOV, a Lightroom catalogue — and rebuild a directory from scratch. The files come back with their contents intact but sometimes without their original names, which is more disruptive on a PC of work documents than on a drive of photos where the EXIF data inside each file still carries the date. A longer job, but a reliable one, and it is the path we take on maybe a quarter of the RAW external drives that come through the Cramond collection route.
GPT Header Damage: A Specific Sub-Case
A smaller but recognisable subset of RAW drives is actually a GPT problem, not an NTFS one. On a modern drive the partition table itself lives in two places — a primary GPT header at the start of the disk and a backup at the end — and if the primary is clobbered (an interrupted format, a bad sector in the first few blocks, a Windows installer that was pointed at the wrong drive) the whole disk can read as uninitialised. A clone of the drive, a tool that understands GPT backups, and the partition table restored from the backup copy brings the volume back without touching any of the data clusters. We see this on NAS drives pulled from a dead enclosure more often than on anything else, and it is the specific pattern our earlier guide on NAS drives plugged into a Windows PC warns about — Windows offering to format a NAS drive whose partition table uses a different scheme is not a RAW failure, it is Windows not recognising the layout, and formatting it is the quickest way to lose the whole array.
SSDs Tell a Different Story
Most of what we have described so far assumes a mechanical hard drive, where sectors stay where you left them. On an SSD the drive’s controller shuffles blocks around for wear-levelling, which has two consequences for a RAW failure. If TRIM has been running — the default on Windows — the clusters behind a deleted or corrupted file may already have been wiped by the controller and are unrecoverable at the filesystem layer even if the MFT is intact. And if the controller itself is the thing that failed, the partition appears as RAW to the host but the data is really locked behind a chip that no longer talks on the SATA or NVMe bus. That is a chip-off job rather than a filesystem one, and sits with our microsoldering workflow — the NAND is lifted, read on a programmer, and the controller’s wear-levelling tables rebuilt in software before any files come out. If the SSD was in a modern laptop where the storage is part of the mainboard, our earlier write-up on soldered laptop storage covers the parallel route.
After the Files Are Back
Once the files are safely off and verified against the original directory structure where possible, the drive itself has a decision to make. A mechanical drive that has gone RAW once is usually showing other warning signs underneath — reallocated sectors, slow reads, SMART attributes trending the wrong way — and the honest advice is almost always to replace it rather than put the recovered files back onto the same spindle. That part sits under our hardware upgrades service, often with a move to a modern SSD for the system drive and a larger mechanical drive kept only for bulk archive. Where the drive is still young and the RAW event had an obvious cause — an unsafe eject, a power cut, a USB enclosure that is finally dying rather than the disk inside it — the drive itself can go back into service after a clean format and a filesystem check, usually in a better enclosure than it came from.
The other half of the conversation is whether the backup story needs looking at. A drive that nearly took a holiday’s worth of photos with it is a drive that would have taken them in a slightly unluckier parallel universe, and a quick how-to on backing up a Windows PC or an afternoon of our software troubleshooting time spent setting up File History plus a cloud copy is a much smaller job than the recovery itself. We tend to have that conversation with Cramond and Murrayfield customers when the files are handed back, not before, because it is a lot easier to agree with when the files are safely in hand.
A drive going RAW in Windows is not the end of the story for your files, provided nothing writes to it after the symptom appears. If a Cramond, Davidson’s Mains or Leith PC is showing one of yours as RAW, unplug it, leave it alone, and bring it in to the EH11 workshop or book a collection. The imaging, the filesystem rebuild and the file-by-file verification sit under our data recovery service, and the Cramond collection detail lives on our Cramond data recovery page alongside the other options for getting the drive to us without putting more miles on it than it needs.
Last updated: 5 November 2026