Q: Fixing missing Bootcamp partition after Mavericks rewrote wrong GPT

This link - http://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_type_GUIDs seems to have pretty good information for PartitionType GUIDs.

I will try and run testdisk again and try the "Deeper Search" option. I've tried this before, and you're right, this takes a long time so I stopped it.  I really don't want to write off the data as a loss bc I goofed and didn't back any of it up.

I'll report back once testdisk is complete with the scan and see if I can make sense of the results. I've been trying lots of different things from these forums so it is possible that I've manually messed something up.

I'm confused about my Bootcamp partition showing up but when you enter "p" in testdisk I don't see any of my files. That leads me to believe that it isn't the correct partition. Thoughts?

Also, when I go to Bootcamp Assistant it doesn't recognize an installed windows directory and will not allow me to do any resizing. So I think I definitely screwed something up... Have either of you ever heard of gpt_surgeon.py? It's a python script that I ran because, at first, I didn't even have a Mac partition to boot from after installing Mavericks. Anyway, I ran it and it worked like a charm and it recovered my Mac partition but i'm just wondering if it affected the rest?

Thanks a ton and your help is appreciated!

Was there any partition work done between the original Bootcamp installation and Mavericks upgrade?

Was the Recovery HD excercised prior to the Mavericks upgrade, with Bootcamp in place?

Yes, I remember I had similar issues with Mountain Lion and I had to do some tweaks(not sure what) to make my drives bootable again.

I dont think I touched the Recovery HD during that ML upgrade but I honestly don't remember.

Downloaded gpt_surgeon.py on my test machine.

The repair option makes me nervous. The disk being modified could have locks, could be mounted, another utility may also be modifying the disk partition, etc., which the script does not seem to account for. Also, it can only change a partition to HFS+ but has no mechanism of rolling it back, and does not ask for confirmation, if the user picks the incorrect partition number. If a partition does become HFS+ (if it originally was BOOTCAMP) and is mounted, it can cause corruption. Not for the faint of the heart.

sudo python gpt_surgeon.py list /dev/disk0

Password:

Read MBR and GPT from /dev/disk0.

partition 0:

     type: EFI System

     name: u'EFI System Partition'

    flags: 0x00000000

partition 1:

     type: Apple HFS+

     name: u'Macintosh HD'

    flags: 0x00000000

partition 2:

     type: Apple Boot

     name: u'Recovery HD'

    flags: 0x2000000000000

partition 3:

     type: Microsoft Basic Data

     name: u'BOOTCAMP'

    flags: 0x00000000

It's dated from 2010. gdisk is actively maintained and is the right tool to use for partitioning gpt disks.

Ok so this is the latest update.

I ran the "Deeper search" option using testdisk and it found a ton of results. I went through each partition and I found the BOOTCAMP partition. I was able to view all my files so I selected that partition and then I hit "write". There were too many results to find the Mac OS X partition so I just selected the BOOTCAMP partition without selected any Mac OS X partitions. So now I'm to the point where I can see all my bootcamp files but now I need to add my Mac OS X partition back. I was hoping that I can use some information from my original post that will easily allow me to manually add the Mac partition.

Let me paste my current configuration and hopefully I can get some guidance on to properly add my Mac partition back. Thanks in advance for the help.

Andress-iMac:~ andressosa$ sudo fdisk /dev/rdisk0

Password:

Disk: /dev/rdisk0          geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE    1   0   1 - 1023   0   1 [         1 - 1953525167] <Unknown ID>

2: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

3: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

4: 00    0   0   0 -    0   0   0 [         0 -          0] unused 

Andress-iMac:~ andressosa$ sudo gpt -r -v show /dev/rdisk0

gpt show: /dev/rdisk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

       start        size  index  contents

           0           1         PMBR

           1           1         Pri GPT header

           2          32         Pri GPT table

          34  1743144926        

  1743144960   210378752      1  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  1953523712        1423        

  1953525135          32         Sec GPT table

  1953525167           1         Sec GPT header

You should not have chosen "write" in test disk. You've erased all partitions except for the one you just wrote, so whatever you do don't shutdown or reboot until you fix this or you won't be able to startup the computer.

Using gdisk add the following four partitions using their original start and end sector values you posted (I did the ending sector computation) and the 3rd column is the type code to use for each partition. After you've added them all, use the s command to resort the list. Then use r to go to the recovery menu, h to create a new hybrid MBR. Add partitions 2 and 5 to the MBR by just typing 2 5. Just a space between them, and enter. Y to add the EFI GPT to the first MBR entry. Accept the default type code by just hitting enter when asked. When asked, do not make 2 bootable, but do make 5 bootable. When asked if you want to add more entries answer n. And then use w to write out the change to disk. Before rebooting I suggest you post the results from the previous fdisk and gpt commands yet again to confirm the changes you've made are correct.

          40      409639    ef00

      409640   587030719    af00

   587030720   588300263    ab00

   588300264   589569799    ab00

I've posted fdisk, gpt, and gdisk results. Thanks for helping out so quickly.

Recovery/transformation command (? for help): o

Disk size is 1953525168 sectors (931.5 GiB)

MBR disk identifier: 0x24112411

MBR partitions:

Number  Boot  Start Sector   End Sector   Status      Code

   1                     1       411647   primary     0xEE

   2                411648    587030719   primary     0xAF

   3      *     1743144960   1953523711   primary     0x07

Andress-iMac:~ andressosa$ sudo gpt -r -v show /dev/rdisk0

gpt show: /dev/rdisk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/rdisk0: Suspicious MBR at sector 0

       start        size  index  contents

           0           1         MBR

           1           1         Pri GPT header

           2          32         Pri GPT table

          34        2014        

        2048      407592      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

      409640        2008        

      411648   586619072      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

   587030720        1856        

   587032576     1267688      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

   588300264          24        

   588300288     1269512      4  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

   589569800  1153575160        

  1743144960   210378752      5  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  1953523712        1423        

  1953525135          32         Sec GPT table

  1953525167           1         Sec GPT header

Andress-iMac:~ andressosa$ sudo fdisk /dev/rdisk0

Disk: /dev/rdisk0          geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE    0   0   2 -   25 159   6 [         1 -     411647] <Unknown ID>

2: AF   25 159   7 - 1023 254  63 [    411648 -  586619072] HFS+       

*3: 07 1023 254  63 - 1023 254  63 [1743144960 -  210378752] HPFS/QNX/AUX

4: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

Andress-iMac:~ andressosa$

Also, I didnt mention that I'm running Mac from a USB hard drive in order to troubleshoot my main drive. (just an FYI)

OK so this is wrong, and I think I know why. You entered in the correct value, but gdisk by default aligns sectors to 1MB so it corrected them for you and you didn't notice this. So you need to go back to gdisk:

x for the expert menu

l to change the sector alignment value

1 to change to alignment of 1 sector

m to return to the main menu

d

1

d

2

d

3

d

4 this sequence deletes partitions 1 through 4

Now create new partitions 1 through 4 again, and enter the same start and end values as before, with the proper type code. And once you're done with partition 4, you need to use r to get to the recovery menu, and h to create a new hybrid mbr. Do the same thing as before. When done with that, w to write out the changes. And again fdisk and gpt commands as before, and post those results.

You're right this is the message that gdisk gave me.

Command (? for help): n

Partition number (2-128, default 2):

First sector (34-1953525134, default = 2048) or {+-}size{KMGTP}: 40

Information: Moved requested sector from 40 to 2048 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (2048-1743144959, default = 1743144959) or {+-}size{KMGTP}: 409639

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): ef00

Changed type of partition to 'EFI System'

Command (? for help): n

Partition number (3-128, default 3):

First sector (34-1953525134, default = 411648) or {+-}size{KMGTP}: 409640

Information: Moved requested sector from 409640 to 411648 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (411648-1743144959, default = 1743144959) or {+-}size{KMGTP}: 587030719

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00):

Changed type of partition to 'Apple HFS/HFS+'

Command (? for help): n

Partition number (4-128, default 4): 587030720

Value out of range

Partition number (4-128, default 4): 588300263

Value out of range

Partition number (4-128, default 4): 4

First sector (34-1953525134, default = 587032576) or {+-}size{KMGTP}: 587030720

Information: Moved requested sector from 587030720 to 587032576 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (587032576-1743144959, default = 1743144959) or {+-}size{KMGTP}: 588300263

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): ab00

Changed type of partition to 'Apple boot'

Command (? for help): n

Partition number (5-128, default 5):

First sector (34-1953525134, default = 588300288) or {+-}size{KMGTP}: 588300264

Information: Moved requested sector from 588300264 to 588300288 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (588300288-1743144959, default = 1743144959) or {+-}size{KMGTP}: 589569799

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): ab00

Changed type of partition to 'Apple boot'

Stand by let me try your last suggestion.

I think this did it! I havent restarted yet but after remounting my drive I can see both bootcamp and Mac drive. The only part that stands out is the size of the drives. Currently mac drive is 300GB and BOOTCAMP is 107GB. Where did the rest go? This is more of a curiosity because I think it will be best for me to back my important info and wipe this drive clean and start over. Do you agree?

Andress-iMac:~ andressosa$ sudo fdisk /dev/rdisk0

Password:

Disk: /dev/rdisk0          geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE    0   0   2 -   25 127  14 [         1 -     409639] <Unknown ID>

2: AF   25 127  15 - 1023 254  63 [    409640 -  586621080] HFS+       

*3: 07 1023 254  63 - 1023 254  63 [1743144960 -  210378752] HPFS/QNX/AUX

4: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

Andress-iMac:~ andressosa$ sudo gpt -r -v show /dev/rdisk0

gpt show: /dev/rdisk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/rdisk0: Suspicious MBR at sector 0

       start        size  index  contents

           0           1         MBR

           1           1         Pri GPT header

           2          32         Pri GPT table

          34           6        

          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

      409640   586621080      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

   587030720     1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

   588300264     1269536      4  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

   589569800  1153575160        

  1743144960   210378752      5  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  1953523712        1423        

  1953525135          32         Sec GPT table

  1953525167           1         Sec GPT header

If you look at the unnumbered line between partitions 4 and 5, the size column is 1153575160 which is 550GB. So if OS X is intact and if the Bootcamp volume mounts or boots and you have access to your files, then that means one of the resize steps didn't work out, likely the one intended to make Windows bigger. In any case, yes, once you've got backups, blow the whole thing away: repartition with a single partition, install OS X and install any updates, then use Bootcamp Assistant to resize the drive the way you want. Then restore OS X backup. Reinstall Windows and restore data from backup (or if you're using something like a new version of Winclone for the backup/restore, it'll backup and restore all of Windows and your data and will resize it to fit the new Bootcamp partition you've created).

Or alternatively, as I increasingly recommend, use a VM for Windows so you don't have to deal with the risks of Bootcamp and dual booting.

Is it safe to run windows repair to try and boot windows? Or will this damage my partition further?