Quick Answer

When a file system becomes corrupted, the data on your disk is in most cases still physically present; what is lost is the address book that describes where each file begins and ends. In NTFS this address book is the $MFT (Master File Table); in FAT32 and exFAT it is the FAT (File Allocation Table). When these structures are damaged, Windows cannot read the disk, the drive appears as RAW, and you get the error "You need to format the disk before you can use it." At this point the correct action is not to format; instead, you should avoid writing to the disk, take a read-only image, and then either rebuild the file system structures or relink files using residual metadata. With the right intervention, data loss is usually minimal.

What Is a File System and Why Is It Critical for Data?

A disk physically consists of millions of sectors (typically 512 bytes or 4 KB). On their own, these sectors are a meaningless pile of bytes. A file system is the accounting layer that organizes this raw space and answers questions like "which sectors belong to which file", "what is this file's name, size and date", and "which areas are free".

The content of a file (the pixels of a photo, the frames of a video) sits in the disk's data area. But for the computer to find that photo, it needs management information called metadata: which sector the file starts at, how many fragments it is split into, where it hangs in the folder tree. When this metadata is damaged, the content remains perfectly intact on the disk while the computer becomes unable to see it. This is the essence of data recovery: most of the time we recover not the data, but the map that leads to it.

The recovery approach depends on which file system you are dealing with, so you need to understand the structure of NTFS, FAT32 and exFAT separately.

NTFS: Windows' File System and the Role of $MFT

NTFS (New Technology File System) is the standard file system of Windows; internal disks, most SSDs and large external drives use it. The heart of NTFS is a database called the $MFT (Master File Table).

The $MFT keeps at least one record (typically 1 KB) for every file and folder on the disk. This record contains the file's name, permissions, timestamps and, most critically, the data run information describing which clusters of sectors the file occupies. Very small files (under roughly 700 bytes) are embedded directly inside the $MFT record; in that case the file and its metadata live in the same place.

A strength of NTFS is journaling: a log called $LogFile records pending operations and helps return the file system to a consistent state after a sudden shutdown. Even so, if the $MFT itself, $MFTMirr (a backup copy) or the boot sector is damaged, Windows cannot open the partition.

The advantage in NTFS recovery is that the $MFT often remains partially intact. An expert engineer can rebuild the folder tree and file names from healthy $MFT records, meaning files return with their original names and folder structure. When the $MFT is entirely destroyed, file carving (explained below) takes over.

FAT32: Old but Still Widespread USB Standard

FAT32, in use since 1996, is a simple and extremely common file system. Older USB drives, memory cards, game consoles and many devices are still formatted with FAT32 because almost every operating system can read it.

FAT32 has two important limits: a single file can be at most 4 GB, and partition size is practically limited. This is why large video files do not fit on FAT32.

The structure of FAT32 comes from its name: the FAT (File Allocation Table). This table is a chain map listing all clusters on the disk. When a file spans multiple clusters, the FAT table builds the chain by saying "after this cluster comes that cluster". For safety, two copies of the FAT are kept on disk; if one is damaged, the other can step in.

A typical result of corruption in FAT32 is a broken FAT chain. In that case, even if the file's first cluster is found, its continuation may be lost; fragmented files especially become difficult. Fortunately the second FAT copy often saves the day during recovery. Also, because FAT32 directory entries hold the file name and starting cluster, files can return with their names if the directory structure is intact.

exFAT: Modern Card and USB System

exFAT (Extended File Allocation Table) is the modern system Microsoft developed to overcome FAT32's limits. SD cards, SDXC cards, action cameras, drones and large USB drives mostly use exFAT because it has no 4 GB file size limit and supports large capacities.

exFAT also uses a FAT table, but unlike FAT32 it includes an extra structure: the allocation bitmap, which quickly shows which clusters are used and which are free. In addition, for contiguous (unfragmented) files, exFAT can mark the file as stored end-to-end without even using the FAT chain; this is a big advantage for recovery because the entire file can be found as a single block.

The weak point of exFAT is the absence of journaling. If the device is still writing when you pull the card out of a camera, or the battery dies suddenly, the FAT table and bitmap can be left inconsistent; the result is usually the card saying it "needs to be formatted". This is the most common scenario for photographers and camera users, and most of the data is still on the card.

Why Do File Systems Get Corrupted?

The root causes of corruption are similar across all three systems:

  • Unsafe removal: If a USB drive or card is pulled before the operating system finishes writing, the FAT or $MFT is left half-written.
  • Power loss: Losing power during a write causes table and bitmap inconsistency.
  • Bad sectors: If the physically worn regions of a disk coincide with the sectors holding metadata, the file system becomes unreadable.
  • Malware: Some malicious or ransomware programs deliberately corrupt the boot sector, the $MFT or the FAT table.
  • Faulty formatting or partitioning: A format applied to the wrong drive or a corrupt partition table makes the file system inaccessible.

Why Does a Disk Appear as RAW and Say "You Need to Format"?

When Windows tries to open a disk, it first reads the boot sector and the file system signature. If this structure is unrecognized (corrupt boot sector, unreadable $MFT or FAT), Windows cannot determine the file system and marks the disk as RAW, meaning unknown type. RAW does not mean "there is nothing on the disk"; it means "I cannot read the disk's map".

In this state Windows offers formatting as the only logical solution, because formatting writes a fresh, clean file system. But this is a trap for the user: accepting the format writes a new empty table over the old metadata and severely complicates recovery. The correct response is to close the error window and write nothing to the disk. Our guide on my disk became RAW and won't open explains the format-free recovery steps in depth.

The Difference Between Formatting and Deleting

Users often think "I formatted it" and "I deleted it" are the same, but for data recovery they differ:

  • Deletion: The file's $MFT record or FAT directory entry is marked as "unused", but the content and usually residual metadata remain on disk. If no new data was written over it, the recovery rate is very high.
  • Quick format: A new, empty file system table is written; the old content is not erased but the map is reset. Files can be recovered via carving rather than by name.
  • Full format: On modern Windows this writes zeros to all sectors; this effectively destroys the content too and makes recovery very difficult.

We examined the formatted-disk recovery scenario in detail in our article on data recovery from a formatted disk.

NTFS, exFAT and FAT32 Comparison

Feature NTFS exFAT FAT32
Typical use Windows disks, SSD SD card, camera, large USB Old USB, small cards
Management structure $MFT (Master File Table) FAT + allocation bitmap FAT (two copies)
Journaling Yes ($LogFile) No No
Maximum file size Practically unlimited Practically unlimited 4 GB
Chance of recovering file names High ($MFT residue) Medium (directory entry) Medium (directory entry)
Most common corruption cause Bad sector, $MFT damage Unsafe removal, power loss Broken FAT chain

The Recovery Approach for Each File System

Recovery strategy is thought of in three layers, each kicking in when the previous one fails:

1. Table / Metadata Rebuild

The first and best method is to repair the map from the surviving parts of the file system. In NTFS the $MFT and $MFTMirr are scanned; in FAT systems the second FAT copy and directory entries are scanned. If this method succeeds, files return with their original names, folder structure and dates. Thanks to the rich metadata in the $MFT, NTFS is the luckiest system here.

2. Relinking Using Residual Metadata

When the table cannot be fully repaired, the record fragments scattered across the disk are scanned. Individual $MFT records or directory entries are found, and files are re-matched with their names and correct sizes as far as possible. This is not as clean as a full tree, but gives far better results than carving.

3. File Carving (Signature-Based Recovery)

If no metadata remains, the last resort is file carving. This method ignores the file system entirely; it scans the disk from start to end looking for type-specific signatures (for example FFD8FF for JPEG, %PDF for PDF) and extracts the data between the start and end markers as a single file. Carving is powerful but comes at a cost: file names and folder structure are lost, files are named like file001.jpg, and fragmented files (especially large videos) may come out incomplete or corrupt. This is why carving is always used as the last option.

You can also find the general logic of recovery in our data recovery guide.

Why Is the Situation Different on an SSD?

On classic hard drives, deleted data or data remaining after a format stays on disk until something is written over it. On SSDs, however, the TRIM command changes everything. When the operating system deletes a file or formats a partition, it sends the SSD a signal (TRIM) saying "these clusters are now empty". The SSD controller then physically erases these blocks in the background so future writes are fast.

The result: on an SSD, data after deletion or formatting can be lost irreversibly within minutes; the "it survives unless overwritten" comfort of classic disks does not apply to SSDs. Therefore, when NTFS or exFAT corruption occurs on an SSD, it is critical to power off the device immediately and bring it to an expert without turning it on again. By contrast, if the file system is only logically corrupted (TRIM was not triggered), the data may still be intact.

File System Recovery with DSET

DSET has been providing data recovery services since 2003 at Ankara Hacettepe Teknokent, Beytepe, Çankaya. We work on every file system scenario, including NTFS $MFT rebuilding, FAT32 and exFAT table repair, and file carving when necessary. Our method is to first take a read-only image of the disk and then perform all recovery on that image; we never write to the original media.

The initial diagnosis is free, and if no data is recovered there is no charge. Our success rate is around 99.4%. For a disk showing as RAW, a card giving a format warning or a USB drive that won't open, you can reach us at +90 536 662 38 09. Our most important advice: the moment you notice corruption, do not write to the device and do not accept the format.

Frequently Asked Questions (FAQ)

My disk appears as RAW and Windows asks me to format it, should I accept? No. Formatting writes a new empty table over the old file system map and complicates recovery. Close the window, write nothing to the disk, and consult an expert.

With NTFS corruption, will my files come back with their names? Usually yes. The NTFS $MFT structure holds file names, dates and the folder tree; if these records are partially intact, files can be recovered with their original names. If they are completely destroyed, file carving takes over and names are lost.

My exFAT SD card is no longer readable after using it in a camera, is the data gone? Probably not. Because exFAT has no journaling, unsafe removal corrupts the FAT table, but the photo and video content is usually still on the card. Stop using the card and bring it in for recovery.

I had a file over 4 GB on FAT32, why did it get corrupted? FAT32 supports at most 4 GB per single file. Larger files cannot be saved correctly in the first place, and corruption is often related to pushing this limit or a broken FAT chain. exFAT is more suitable for such media.

I formatted my SSD, can I recover it right away? If possible, power off the device immediately. On SSDs the TRIM command can physically erase blocks marked as empty, and data can be lost irreversibly within minutes. The earlier the intervention, the higher the chance of success.

Sources