ReFS Shows RAW. Don't CHKDSK or Format It.

Written and maintained by the Desert Data Recovery lab team. · Updated September 28, 2026

We already wrote about CHKDSK /f on a volume Windows can still name, about Initialize Disk, about Startup Repair on a machine that will not boot, and about Delete Pool when Storage Spaces will not assemble. This page is the other screen: a ReFS volume — Server data disk, Storage Spaces virtual disk, backup target, or a disk you formatted ReFS — that Disk Management and Explorer now call RAW.

What ReFS is, in the sentence that matters

ReFS is the Resilient File System. Microsoft shipped it with Windows Server 2012. It is a data filesystem. The Windows boot volume stays NTFS. If the PC is sitting on Preparing Automatic Repair, that is the Startup Repair post, not this one.

Where this volume usually lives:

• Windows Server data volumes and file shares, including disks large enough that someone chose ReFS on purpose.
• Storage Spaces. The stack is physical disks, then a pool, then a virtual disk, then NTFS or ReFS. Server pools are often ReFS. A lot of Windows 10 and 11 desktop pools are NTFS. The pool-failed click is the Storage Spaces page. RAW on the filesystem is this one.
• A backup target formatted ReFS so the backup software can use the volume. Formatting that disk "so the share comes back" replaces the repository.
• A single disk that was formatted ReFS, including a Windows 11 Dev Drive. No pool is required for this screen to appear. Delete Pool is not your dialog if there was never a pool.

ReFS checksums its own metadata. File data can be checksummed too, when integrity streams were turned on. Updates go to a new copy, and the consistent tree is a checkpoint, instead of editing the old metadata in place the way a classic NTFS repair does. That design is why a power cut is often survivable. It is also why a repair that salvages the namespace, or a format that writes a new filesystem, spends the map a lab reads first.

Integrity streams are a detector. On a Storage Spaces mirror they can prefer the copy that matches the checksum. They are not a second backup of the volume. They do not reconstruct a virtual disk you deleted, and they do not make a RAW status mean the files were erased. The public case log has no ReFS job. We will not invent one. This post is what the status means and what not to click.

RAW is a mount status

In Disk Management the file system column says RAW. There may still be a drive letter. Explorer then offers to format the disk before you can use it. The reported size is often still the size you remember. Sometimes the letter is missing and the partition still shows, and sometimes the next refresh flips the same disk to Unallocated or Not Initialized. Photograph which of those you actually have. They are different dialogs.

RAW means Windows will not mount a filesystem it trusts. It looked at the volume, did not accept it as ReFS (or as NTFS, or as anything else it will attach), and stopped. The checkpoint, the directory trees, and the file extents can still be on the media. Windows is refusing to hand them to Explorer. It is not reporting that a format already finished.

A disk that does not appear in Disk Management at all is a different failure — the bridge, the controller, firmware, or a drive that is not enumerating. Start with not recognized or SSD not detected if there is no disk to point at. A disk that appears as Unknown / Not Initialized is the Initialize Disk wizard. People reach that wizard because RAW did not "fix," and they confirm both in one sitting.

What not to click

chkdsk /f, /r, /x, and Error Checking "Scan and repair." On NTFS those are the write in the CHKDSK post. On a letter Windows has already marked RAW, chkdsk commonly prints that the filesystem is RAW and that CHKDSK is not available. People read that as "the filesystem is gone, so format it." The message means this tool cannot see a filesystem to check. It does not mean the sectors were wiped. If a still-identified ReFS volume accepts the repair, the repair writes. Do not stack the switches because a thread said RAW needs /f /r.

Repair-Volume. That is the PowerShell repair for a volume Windows will still attach, including ReFS. Scan, spot-fix, and offline repair are writes to the namespace. A prompt does not make it a diagnostic.

refsutil salvage. This is the ReFS-specific tool, and it is the one the NTFS posts do not cover. Salvage scans a volume that will not mount and copies what it can recover to a folder you name. It is a long read of a disk that already failed. If that folder is on the same disk, the copy overwrites the patient. In-place salvage — what a mount repair does when ReFS decides data is corrupt — removes that data from the namespace. Integrity streams tell ReFS what failed the check. They do not keep the old directory entry for you.

Format. The Explorer dialog, Disk Management Format, and format at a command prompt write a new empty filesystem over the volume. The UI is telling you the truth about one thing only: Windows will not use this volume until something it trusts is there. Replacing ReFS is how you get that. It is not how you read the tree that was already written.

Initialize Disk. Unknown, Not Initialized, then a GPT or MBR choice. That writes a partition table. It is a different dialog from Format, and people do both. The write-up is Initialize Disk. diskpart clean, convert gpt, and convert mbr are the same job with less warning.

Delete Volume, then Create Simple Volume. Delete Volume drops the partition entry Disk Management is showing you. The file data may still sit further in. The map a casual tool reads first is gone. Creating a new simple volume and formatting it spends another write on top.

Repair-VirtualDisk, Optimize, Delete Pool, Reset-PhysicalDisk when this letter is a Storage Spaces virtual disk. Those write pool metadata or reconstruct slabs. RAW does not tell you the pool is the layer that broke. Do not delete the pool so the Server Manager banner goes away. That screen is Don't delete the pool.

Force Online. A hardware RAID controller offering Force Online, Import, or Clear Foreign after a power cut can commit or drop write-back cache. That is the RAID battery post. On Storage Spaces, clearing read-only so you can repair is the pool page. Disk Management → Online, on a single disk that is simply marked Offline, is a host flag. Do not follow it with Initialize, Format, or a repair.

Why those writes spend the map

File contents on a ReFS volume often sit further in than the structures Windows gave up on. What a lab reads first from an image is the metadata ReFS itself checksums: the checkpoint, the allocation information, and the directory trees. A repair that "almost mounts" advances that metadata. A format replaces it. Neither one leaves you the previous tree as a side file you can hand someone.

Salvage drops what it will not trust. When ReFS is asked to repair and no good copy exists, it can remove the corrupt data from the namespace and keep going. That is a metadata write. The checksum did its job as a detector. It is not an undelete. We will not claim a given pass deleted specific files. You are not shown a list and asked to confirm it.

A checkpoint is not a shadow copy you can restore from the UI. ReFS uses the checkpoint so a crash does not tear the tree. Windows does not put "roll back to the previous checkpoint" on the RAW dialog. After salvage or a format, do not assume an older checkpoint is still the one a mount will choose. That is a question for an image, not for another repair pass.

Heads that are already weak. Scan and repair, a salvage scan, and an overnight chkdsk /r keep a mechanical drive seeking. RAW plus clicking is a media problem the filesystem tool will not stop for. Power it off. See clicking and grinding.

A drive that drops mid-write. USB or SATA that disappears while Format or a repair is updating metadata can tear the new structure and the old one. The next boot then offers the same buttons against a worse copy. Unplug it. Do not move it to another dock so the wizard can finish.

SSDs do not give you a long undo window. A metadata write on NAND is a write. TRIM and garbage collection can drop the old blocks faster than people expect from a hard drive. Do not format a ReFS SSD "so Disk Management shows NTFS and I can run recovery software on the letter." See SSD failure signs.

This screen is not the other Windows dialogs

The CHKDSK /f post is a volume Windows will still treat as a filesystem, usually NTFS: Error Checking, autochk at reboot, /f rewriting the MFT and indexes. Read that page for those switches. Do not treat this page as a second copy of it. On ReFS the repair path has its own name — Repair-Volume, salvage, integrity — and RAW means Windows may not even start chkdsk.

Initialize Disk is the partition table, after the disk looks Unknown or Not Initialized. Format is the filesystem write that often comes next. Delete Volume sits between them. If the screenshot says RAW and the button says Format, you are on this page. If it says Not Initialized, you are on that one. Do not confirm both while you are deciding.

Startup Repair runs before Windows loads, against the boot volume, which is NTFS. It writes the BCD, boot files, and registry. A ReFS data disk that shows RAW in Disk Management after the server booted is not that blue screen. Do not "fix" the data disk by booting install media and choosing Repair your computer.

Storage Spaces is the pool and the virtual disk: Failed, Offline, Read-only, Delete Pool, Reset. ReFS can be the filesystem on top of that virtual disk. A RAW letter does not identify which layer failed. If you are looking at Delete Pool, stop and use that post. This page does not redo the resiliency types, and it does not tell you to repair a mirror because the filesystem column says RAW.

A controller that wants the array forced online after the battery died is the BBU post. A BitLocker or Device Encryption prompt on the way to the volume is image first and Device Encryption. The key does not make Format read-only. Bring the key with the disk. Do not spend it on a repair pass.

What to do right now

Do not run chkdsk. Do not accept Scan and repair. Do not run Repair-Volume or refsutil salvage. Do not format. Do not initialize. Do not delete the volume. Do not delete a pool or force an array online to make the RAW status change.

1. Stop. Cancel the format dialog. If a check, a salvage, or a format is already running and the disk is clicking, grinding, or the machine is frozen on that volume, power it down. Extra uptime is more retries you do not get back.
2. Photograph Disk Management and the Explorer prompt before the next refresh changes the words. RAW versus Unallocated versus Not Initialized, the drive letter, the reported size, GPT or MBR if it is shown, and the exact format text. If this is Server Manager or Storage Spaces, photograph the pool and the virtual disk too: resiliency, status, NTFS or ReFS if it still says. Screenshots help. They are not a diagnosis.
3. If the volume is Storage Spaces, hardware RAID, or any multi-disk set, label every member before anything is unplugged. Bay, slot, or port, matching the photos. Keep the disk marked Failed. Member identity is part of the configuration. A single ReFS disk still should not move from dock to dock so a different PC "sees it as NTFS."
4. Write down what you remember: Server, Spaces, backup target, or Dev Drive; whether integrity was something you turned on; whether anyone already ran chkdsk, Format, Initialize, Delete Volume, Repair-Volume, or refsutil; whether a BitLocker key was entered. Encryption without the key is still encryption.
5. Leave the original alone. Do not save recovered files onto it. Do not create a new volume "temporarily." Copying off is only reasonable when the disk is quiet, stays online, and the volume actually mounts — in which case you are not looking at RAW. If it is RAW, clicking, or dropping, that is an evaluation, not a copy.

Pack a loose disk the way you would any failed drive — how to ship a failed drive safely. A server whose members you cannot pull cleanly can come in as a chassis. Do not open a hard drive on a table to look.

How a lab handles it

We do not run chkdsk, Repair-Volume, or refsutil salvage on your disk to see if the letter comes back. We do not format RAW into a filesystem Windows likes. We do not initialize the disk, delete the volume, or delete a Storage Spaces pool.

The disk is imaged write-blocked first — as much of it as the heads or the controller will still give us, including a drive that only reads in pieces. Work happens on the copy. Imaging uses the lab tools already named on this site, including the ACE Lab PC-3000 and DeepSpar Disk Imager. ReFS metadata is read from that image: the checkpoint and the directory trees, not a repair pass that advances them on the original. If integrity streams were in use, the checksums are evidence about which copies match. They are not a reason to salvage the patient in place.

If the RAW volume is a Storage Spaces virtual disk, each member is imaged before anyone reconstructs the pool. That layout work is the Storage Spaces page, and we do not repeat it by repairing the virtual disk inside Windows. A wrong guess about a checkpoint, or about member order on a pool, costs a copy. The same guess on the original does not.

What imaging cannot do: put back a filesystem a format already wrote, a partition table Initialize already replaced, or directory entries an in-place salvage already removed from the namespace. We will tell you if the data is not there. There is no ReFS case in the public case log, and we will not invent one.

The closest published filesystem cousin is a laptop drive, and it is NTFS. DDR-2026-0012: a 320 GB Toshiba MK3259GSX with failed heads and a damaged translator. Cleanroom head swap, translator rebuild, then an image and an NTFS rebuild. The client's critical folders and files came off that image. The write-up does not mention ReFS, RAW, or refsutil. If the disk in front of you is a multi-disk set rather than a filesystem Windows will not mount, the closest published array jobs are a Synology four-drive RAID 5 (DDR-2026-0003) and an HPE SmartArray RAID 6 + RAID 5 (21607). Those are a NAS and a hardware controller. They are not a ReFS volume, and they are not a Storage Spaces pool. Those outcomes belong to those drives. They are not a rate, and they are not a prediction about the RAW letter on your server. We don't advertise a success rate.

If the button is Scan and repair on a letter Windows still calls NTFS, start with CHKDSK /f. If Disk Management wants to initialize, that is Initialize Disk. If the banner is Delete Pool, that is Storage Spaces. If it is clicking, start with power it off. For the work itself, see hard drive, SSD, or RAID data recovery.