External USB drive not properly ejected - now RAW fformat

I'm doing fabbo with Win10 /s

Because of some annoyances - hopefully fixed in the RTM Version - my USB drives cannot be ejected safely from their controller in Win10. So I eject them with the hardware release mechanism from the external enclosure. Windows usually doesnt like that but apart from resetting (I think) that USB connection, nothing happens.

That is until today. After putting a 2TB disk back in the enclosure, Win10 insisted it needed to format the disk. Chkdsk insists that the NTFS boot sector is damaged and the backup one is no use either. The FS shows as RAW.

With tools like EaseUS Data Recovery I can actually see all files, the complete folder structure and the file properties (such as sizes) but when I extract them, they're corrupted. They look fine but they're unplayable (all Video files).
I read somewhere that those tools basically just find the beginning of the file in the allocation table and then use the size to extract the file in a continuous block. If the disk was fragmented however, that approach results in useless files.

I'm running a deep scan with Testdisk to find all partitions and get the RAW files, but it takes forever.

What I wanted to know is, can it really be, that something minuscule like detaching a drive unsafely (while there is no apparent drive activity and all my tasks have finished) gets Windows to f#°@ up the boot sectors and MFT so badly that the drive is basically useless? Isnt there a quick fix, like restoring the boot sector and MFT (chkdsk wont do it)?

Cant believe we havent come further in data and drive protection.

You can't "restore" the MFT. The MFT is a map of all files on your system, and if the backup is bad then there's nothing that can be done. In addition, small files can be stored entirely in the MFT, so if that is corrupt, so too are those files.

The reason that ejecting disks can corrupt them is because Windows uses write-through caching by default, thus when you save files to disk, the OS may not actually write them to disk at that exact moment, and may wait a period of time before flushing that cache. If the last write was inconsistent, or partial, then ejecting the disk ends up with partial writes to the disk. That's what the whole "eject safely" thing is about.

You can fix this, by turning off the write cache.. however, this will reduce the performance of the writes to disk as they won't be able to be fire and forget anymore. Each write will have to wait for the disk to fully finish before the app can continue on.

loungebob said:

I'm doing fabbo with Win10 /s

Because of some annoyances - hopefully fixed in the RTM Version - my USB drives cannot be ejected safely from their controller in Win10. So I eject them with the hardware release mechanism from the external enclosure. Windows usually doesnt like that but apart from resetting (I think) that USB connection, nothing happens.

That is until today. After putting a 2TB disk back in the enclosure, Win10 insisted it needed to format the disk. Chkdsk insists that the NTFS boot sector is damaged and the backup one is no use either. The FS shows as RAW.

With tools like EaseUS Data Recovery I can actually see all files, the complete folder structure and the file properties (such as sizes) but when I extract them, they're corrupted. They look fine but they're unplayable (all Video files).
I read somewhere that those tools basically just find the beginning of the file in the allocation table and then use the size to extract the file in a continuous block. If the disk was fragmented however, that approach results in useless files.

I'm running a deep scan with Testdisk to find all partitions and get the RAW files, but it takes forever.

What I wanted to know is, can it really be, that something minuscule like detaching a drive unsafely (while there is no apparent drive activity and all my tasks have finished) gets Windows to f#°@ up the boot sectors and MFT so badly that the drive is basically useless? Isnt there a quick fix, like restoring the boot sector and MFT (chkdsk wont do it)?

Cant believe we havent come further in data and drive protection.

See if Minitool Partition Wizard helps.
Use the Partition Recovery feature: How to Make Partition Recovery | MiniTool Partition Wizard Tutorial

The free home edition works well - or download the ISO and burn it to a bootable CD (it's small)

Slartybart said:

See if Minitool Partition Wizard helps.
Use the Partition Recovery feature: How to Make Partition Recovery | MiniTool Partition Wizard Tutorial

The free home edition works well - or download the ISO and burn it to a bootable CD (it's small)

Trying that too, thanks mate!

loungebob said:

Trying that too, thanks mate!

Partition Wizard (PW) has been good for other members with similar drive troubles. If PW can read the disk, there's a good chance to recovery the partition, which is different from file recovery. The structure is intact and all folder/filenames are as they were - no cryptic names.

Good luck.

Still, I could cry.

Write-cache is always disabled on my side. The smallest file on that disk ist around 100MB, the largest a few gigs.

Googling reveals it's just not an option for a lot of users to safely eject, be it a driver or an OS locking issue, it's all just sad really.

Considering how much we rely nowadays on (USB attached) external storage to exchange or store data, I still think it's ridic how little effort MS puts into safety and integrity there.
It cant be that hard to build in a couple of (more/better) safeguards to protect our data.

But then again, there's a whole industry of safety/recovery/restoration tools, hdd and flash drive manufacturers and whatnot out there that needs feeding.

loungebob said:

Still, I could cry.

Write-cache is always disabled on my side. The smallest file on that disk is around 100 MB, the largest a few gigs.
.....

Yeah, there are some processes that 'lock' a volume or the drive. Indexing might be one (search gatherer, windows crawl....). Sometimes, I can hit safely remove a second time and it works, other times if I wait a few minutes and try again it works. I think it's a matter of timing rather than a technical issue - whatever is stopping the eject has to let go.

Some processes aren't always active (set to run only when the system idle) - but they retain the 'lock'. I agree with you that if it's a MS process, then the eject process should occur in timely manner, not wait for the process to wake up and let go.

I've just become resigned to the fact that the only sure way to remove a ext HDD is to power down, then disconnect.

Bill
.

Use testdisk (or dd_descue if drive is physically damaged). Yes it takes forever, it's a 2 TB drive. I think testdisk can rebuild the MFT or MBR.

Slartybart said:

Yeah, there are some processes that 'lock' a volume or the drive. Indexing might be one (search gatherer, windows crawl....). Sometimes, I can hit safely remove a second time and it works, other times if I wait a few minutes and try again it works. I think it's a matter of timing rather than a technical issue - whatever is stopping the eject has to let go.

Some processes aren't always active (set to run only when the system idle) - but they retain the 'lock'. I agree with you that if it's a MS process, then the eject process should occur in timely manner, not wait for the process to wake up and let go.

I've just become resigned to the fact that the only sure way to remove a ext HDD is to power down, then disconnect.

Bill
.

I know what you mean. My new go-to method too. But....INACCEPTABLE!

Jools said:

Use testdisk (or dd_descue if drive is physically damaged). Yes it takes forever, it's a 2 TB drive. I think testdisk can rebuild the MFT or MBR.

TestDisk is on it's 2nd try. I can get all the files to show and copy but the result is totally corrupted. Let's see what happens in the 2nd run.