A Buffalo MiniStation portable drive was unplugged without ejecting, and afterwards Windows insisted it needed formatting — the volume had gone ‘RAW’, with family photos and documents locked behind it. That format prompt is a trap: the files were still there, described by file-system records the interrupted write had damaged. We imaged the drive, rebuilt those records, and got everything back — without ever formatting it.
A Buffalo MiniStation had been pulled straight out of a laptop without being ejected — something almost everyone has done. This time the drive came back changed: it still appeared in Windows, but every attempt to open it produced “You need to format the disk in drive before you can use it”, and Disk Management showed the volume as RAW rather than NTFS. On it were the only copies of years of family photos, home videos and personal documents. Sensibly, the owner didn’t click Format — they set the drive aside and sent it to us, which is exactly the right call.
“RAW” isn’t a type of file system — it’s what Windows shows when it can’t identify one. Every formatted volume begins with a boot sector that declares what the file system is (NTFS, exFAT, FAT32) and where its key structures live. Windows reads that sector to decide how to mount the drive. If the boot sector or the index it points to is damaged or unreadable, Windows can no longer tell what the file system is, so it labels the volume RAW and — unhelpfully — offers the one action almost guaranteed to lose your data: format it. Critically, RAW describes a broken description of the data, not the loss of the data itself. The files are usually still sitting on the platters exactly where they were.
Writing to a drive isn’t instant, and it isn’t a single step. The operating system buffers writes and updates several file-system structures — the boot sector, the Master File Table (MFT) that indexes every file, the free-space map — and ‘eject’ exists precisely to flush all of that and leave the file system in a consistent state before power is removed. Pull the drive mid-update and those structures are left half-written: an MFT record part-updated, a boot sector not fully committed, the volume marked dirty. On a small portable drive with no cache protection, that is enough to leave the file system unidentifiable — RAW — even though the actual file contents were never touched.
Clicking Format doesn’t repair anything — it writes a brand-new, empty file system over the top of the old one. A quick format lays down a fresh boot sector and an empty MFT, discarding the damaged-but-recoverable index that still described where all your files were. The data underneath often survives a quick format and can still be carved back, but you have thrown away the very roadmap that would have brought the files back with their names and folders. That is why the golden rule with a RAW drive is simple: don’t format it, stop using it, and get the data off first.
The drive was first cloned sector by sector to healthy storage through a write blocker, with imaging tools set to work around the handful of bad sectors that had developed in the metadata area — retries capped, weak zones read gently — so nothing further was stressed. Everything after that happened on the image. NTFS is deliberately redundant, and we used that: the damaged primary boot sector was rebuilt from the backup copy NTFS keeps at the end of the partition, and the corrupt MFT was reconstructed from its mirror ($MFTMirr) and by parsing intact file records directly out of the raw MFT area. With the boot sector and MFT restored, the volume was no longer RAW — it presented as NTFS again, with its directory tree and file records in place.
With the file system readable, the photos, videos and documents were extracted with their original names and folder structure, and any records that couldn’t be rebuilt from the MFT were recovered by signature carving as a safety net. Recovered images and videos were opened and documents checked to confirm they were whole before sign-off, and the complete set was returned on a fresh drive — a full recovery, no formatting required. We passed on the two habits that prevent a repeat: always eject before unplugging, and keep a second copy of anything irreplaceable, because a single portable drive is a convenience rather than a backup.
Sector imaging with write blocker and bad-sector handling · NTFS boot-sector rebuild from backup · MFT reconstruction from $MFTMirr and raw records · signature carving as a safety net · verification of photos, video and documents. All work in-house at our Belfast lab.
Don’t format it — that’s the one step that makes a RAW drive harder to recover. Unplug it and send it to us for a free, no-obligation diagnostic. We’ll tell you what can be recovered and put a fixed price in writing before any work starts, and on most jobs it’s no fix, no fee. Post it in from anywhere in the UK, or drop it to us in Belfast.
No — and you’re far more likely to lose data if you do format it. A “format this drive” prompt with a RAW volume almost always means the file system’s index is damaged, not that your files are gone. They’re usually still on the disk. Formatting writes an empty file system over them, so the safe move is to leave it unformatted and recover the data first.
It means Windows can’t read the structure that tells it what file system the drive uses, so it can’t mount it. That structure — the boot sector and the MFT on NTFS — can be damaged by an interrupted write or a bad eject. Because NTFS keeps backup copies of both, a RAW volume can very often be rebuilt and the files recovered with their names intact.
Yes. Eject exists to finish pending writes and leave the file system consistent before power is removed. Unplug mid-update and key structures can be left half-written, which is enough to make the volume unreadable — even though the file contents themselves are untouched. Ejecting first is a genuinely worthwhile habit.