Skip to content
DataForensics Book an AppointmentBook Now

Case Study

A drive gone RAW overnight. 100% of the data back by lunchtime.

A Western Digital Scorpio 750GB drive, running as an external disk, suddenly stopped mounting and showed up as RAW in Windows 10. The drive itself was sound — bad sectors had hit exactly the wrong spot.

I.

Case Study

An external drive turned RAW overnight.

The drive was a Western Digital Scorpio 750GB, in use as an external hard drive. Without warning, Windows 10 stopped recognising it as a working volume and reported it as RAW.

Every drive that reaches the lab has its own set of challenges, and this one looked worse than it was. The good news came quickly: initial testing and diagnostics found the drive itself mechanically sound. Whatever had gone wrong was not a head or motor failure.

II.

What failed

Bad sectors, in exactly the wrong place.

Closer inspection found bad sectors sitting in the area of the disk holding the partition information. With that data unreadable, neither Windows nor OS X could identify a valid file system on the drive — hence the RAW status. The rest of the drive's surface, and the data on it, was untouched.

This is a common but deceptive failure: the drive looks catastrophic from the outside, showing as an unreadable blank volume, when the actual damage is confined to a small but critical region.

III.

The Recovery

Imaging around the damage.

  1. 01

    Specialist hardware imaging

    Standard software tools stall or fail outright on bad sectors. Specialist hardware imaging solutions were used to work around the damaged areas and pull a good, consistent read from the rest of the disk.

  2. 02

    Full sector-by-sector image

    A complete image of the drive was made, taking around three hours. The bad sectors themselves were clearly visible on the imaging hardware's scan map, marked out from the healthy media around them.

  3. 03

    NTFS structure reconstruction

    With a full image secured, the existing NTFS file structure was reconstructed from it — restoring the folders and files that the missing partition information had made invisible.

IV.

The Result

All the data back inside 24 hours.

The drive arrived at the lab on a Friday morning. By lunchtime the same day, 100% of the data had been recovered. The customer was given access to his most important business files that afternoon, and the full data set was returned to him before the day was out.

Start to finish — post to recovered data in hand — took less than 24 hours, at a total cost of around £220.

Diagnosis first
Drive showing up as RAW or unreadable?

Stop using it and don't run repair software on it. Send it in for a proper diagnosis and a fixed quote before anything else is attempted.