Redeagles-143

Q: Bootcamp not working after Yosemite update

Hi,

 

I have similar problem after updating to Yosemite, now  I can't boot into windows. There is no Windows option at startup when holding on ALT button and in disk utility, it showed Mac OS X partition with disks greyed out. I updated to Yosemite on my 11 inch Mac air and Mac Pro with no problem, before I decided to update my sons iMac (which has his school work) and ran into this problem. I remembered I use a third party program called Paragon NTFS. Could this be the problem?

 

Please Help.

Posted on Oct 27, 2014 5:19 AM

Close

Q: Bootcamp not working after Yosemite update

  • All replies
  • Helpful answers

Page 1 of 4 last Next
  • by Loner T,

    Loner T Loner T Oct 27, 2014 6:42 AM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Oct 27, 2014 6:42 AM in response to Redeagles-143

    Yes, Paragon NTFS interferes with Apple's native NTFS driver. Can you temporarily disable/uninstall Paragon and test?

     

    If it does not work, please post the output of the following Terminal commands (enter your password when prompted).

     

    diskutil list

    diskutil cs list

    sudo gpt -vv -r show /dev/disk0

    sudo fdisk /dev/disk0

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Oct 27, 2014 7:33 AM in response to Loner T
    Level 1 (0 points)
    Oct 27, 2014 7:33 AM in response to Loner T

    Thanks for the reply, here is the screen shot of the commandsScreen Shot 2014-10-27 at 14.32.28.png.

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Oct 27, 2014 7:37 AM in response to Redeagles-143
    Level 1 (0 points)
    Oct 27, 2014 7:37 AM in response to Redeagles-143

    And here's the result of this command,

    sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C


    Screen Shot 2014-10-27 at 14.36.15.png

  • by Loner T,

    Loner T Loner T Oct 27, 2014 7:40 AM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Oct 27, 2014 7:40 AM in response to Redeagles-143

    Try this simpler fix first...

     

    sudo fdisk -e /dev/disk0

    setpid 4

    07

    flag 4

    p

    w

    y

     

    Reboot and test.

     

    PS: You second screen shot does not show a NTFS header. , so the above may not work.

     

    Can you download Testdisk (http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step) and GPT Fdisk (http://sourceforge.net/projects/gptfdisk/).

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Oct 27, 2014 10:00 AM in response to Loner T
    Level 1 (0 points)
    Oct 27, 2014 10:00 AM in response to Loner T

    Downloaded the 2 software already. I'll try that once the TestDisk finishes analysing, it is almost done, here's the screen shot, i'll post it again once it is done.

    Screen Shot 2014-10-27 at 16.59.09.png

    The Windows 7 partition have about 7 to 8 users on it. I wanted to get the data from my son's account "Jake". Thanks in advance.

  • by Loner T,

    Loner T Loner T Oct 27, 2014 10:10 AM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Oct 27, 2014 10:10 AM in response to Redeagles-143

    The last two entries sized 479133696 look like potential candidates. Please scroll down to the first MS Data right at the end, and conch highlighted, click on Continue. Use "P" to list files.

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Oct 27, 2014 4:33 PM in response to Loner T
    Level 1 (0 points)
    Oct 27, 2014 4:33 PM in response to Loner T

    Hi, thank you for your time.

     

    I tried the simpler fix, and when rebooted, the windows partition showed up when hold on the ALT key, but when i tried to load it, it say "missing operating system".

     

    In OSX, i can't see the bootcamp partition under Finder or on the desktop.

     

    TestDisk did finish analysing the drive, but i accidentally quit the program before i could look into the files, so now running test disk again. However I did save the Testdisk log file before running it again. Here is the log file, if it is any help:

     

    Mon Oct 27 12:03:27 2014

    Command line: TestDisk

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

    OS: Darwin, kernel 14.0.0 (Darwin Kernel Version 14.0.0: Fri Sep 19 00:26:44 PDT 2014; root:xnu-2782.1

    Compiler: GCC 4.0

    Compilation date: 2014-10-23T06:49:09

    ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504

    Hard disk list

    Disk /dev/disk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512

    Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512

     

    Partition table type (auto): EFI GPT

    Media is opened in read-only.

    Disk /dev/rdisk0 - 1000 GB / 931 GiB (RO)

    Partition table type: EFI GPT

     

    Analyse Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

    hdr_size=92

    hdr_lba_self=1

    hdr_lba_alt=1953525167 (expected 1953525167)

    hdr_lba_start=34

    hdr_lba_end=1953525134

    hdr_lba_table=2

    hdr_entries=128

    hdr_entsz=128

    check_part_gpt failed for partition

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

    Current partition structure:

    1 P EFI System                    40     409639     409600 [EFI System Partition]

    2 P Mac HFS                   409640  858777823  858368184 [Mac OSX]

    3 P Mac Boot               858777824  860047359    1269536 [Recovery HD]

    No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

     

    search_part()

    Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

    FAT32 at 40/0/1

    check_FAT: Unusual media descriptor (0xf0!=0xf8)

    FAT1 : 32-3182

    FAT2 : 3183-6333

    start_rootdir : 6334 root cluster : 2

    Data : 6334-409599

    sectors : 409600

    cluster_size : 1

    no_of_cluster : 403266 (2 - 403267)

    fat_length 3151 calculated 3151

    heads/cylinder 16 (FAT) != 1 (HD)

    sect/track 32 (FAT) != 1 (HD)

     

    FAT32 at 40/0/1

         EFI System                    40     409639     409600 [EFI]

         FAT32, blocksize=512, 209 MB / 200 MiB

     

    HFS+ magic value at 409640/0/1

     

    HFS+ magic value at 409640/0/1

    part_size 858368184

         Mac HFS                   409640  858777823  858368184

         HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

     

    HFS+ magic value at 858777824/0/1

     

    HFS+ magic value at 858777824/0/1

    part_size 1269536

         Mac HFS                858777824  860047359    1269536

         HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

     

    LVM magic value at 868175852/0/1

         MS Data                868847797  868847796          0

         exFAT, blocksize=1, 0 B

    Partition not added.

    FAT12 at 868847979/0/1

    check_FAT: Unusual media descriptor (0xf8!=0xf0)

    FAT1 : 1-8

    FAT2 : 9-16

    start_rootdir : 17

    Data : 49-20736

    sectors : 20739

    cluster_size : 8

    no_of_cluster : 2586 (2 - 2587)

    fat_length 8 calculated 8

    FAT differs, FAT sectors=0-8/8

    heads/cylinder 4 (FAT) != 1 (HD)

    sect/track 17 (FAT) != 1 (HD)

     

    FAT12 at 868847979/0/1

         MS Data                868847979  868868717      20739 [NO NAME]

         FAT12, blocksize=4096, 10 MB / 10 MiB

     

    LVM magic value at 869585866/0/1

     

    LVM magic value at 869692408/0/1

     

    HFS magic value at 871635660/0/1

    part_size 8388610

         Mac HFS                871635660  880024269    8388610 [ÿÿÿºD ]

         HFS blocksize=16777216, 4294 MB / 4096 MiB

     

    HFS magic value at 886859759/0/1

    part_size 1233944578

         Mac HFS                886859759 2120804336 1233944578

         HFS blocksize=16777216, 631 GB / 588 GiB

    This partition ends after the disk limits. (start=886859759, size=1233944578, end=2120804336, disk end=1953525168)

     

    HFS magic value at 886859761/0/1

     

    LVM magic value at 893176938/0/1

    FAT12 at 893746232/0/1

    FAT1 : 1-9

    FAT2 : 10-18

    start_rootdir : 19

    Data : 33-2879

    sectors : 2880

    cluster_size : 1

    no_of_cluster : 2847 (2 - 2848)

    fat_length 9 calculated 9

    heads/cylinder 2 (FAT) != 1 (HD)

    sect/track 18 (FAT) != 1 (HD)

     

    FAT12 at 893746232/0/1

         MS Data                893746232  893749111       2880 [EFISECTOR]

         FAT12, blocksize=512, 1474 KB / 1440 KiB

    NTFS at 893826200/0/1

    heads/cylinder 16 (NTFS) != 1 (HD)

    sect/track 2 (NTFS) != 1 (HD)

    filesystem size           6174

    sectors_per_cluster       1

    mft_lcn                   2058

    mftmirr_lcn               5162

    clusters_per_mft_record   2

    clusters_per_index_record 8

         MS Data                893820027  893826200       6174

         NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

    NTFS at 893826200/0/1

    heads/cylinder 16 (NTFS) != 1 (HD)

    sect/track 2 (NTFS) != 1 (HD)

    filesystem size           6174

    sectors_per_cluster       1

    mft_lcn                   2058

    mftmirr_lcn               5162

    clusters_per_mft_record   2

    clusters_per_index_record 8

         MS Data                893826200  893832373       6174 [Boot]

         NTFS, blocksize=512, 3161 KB / 3087 KiB

     

    cramfs Marker at 897548777/0/1

     

    recover_cramfs

         MS Data                897548777  898920760    1371983 [GW¹¤Ø«ÝнÍ(bždSÜ]

         cramfs, 702 MB / 669 MiB

     

    HFS magic value at 905665415/0/1

    part_size 1233944578

         Mac HFS                905665415 2139609992 1233944578

         HFS blocksize=16777216, 631 GB / 588 GiB

    This partition ends after the disk limits. (start=905665415, size=1233944578, end=2139609992, disk end=1953525168)

     

    HFS magic value at 905665417/0/1

     

    LVM magic value at 907915554/0/1

     

    LVM magic value at 923934155/0/1

    NTFS at 932041032/0/1

    heads/cylinder 16 (NTFS) != 1 (HD)

    sect/track 2 (NTFS) != 1 (HD)

    filesystem size           6174

    sectors_per_cluster       1

    mft_lcn                   2058

    mftmirr_lcn               5162

    clusters_per_mft_record   2

    clusters_per_index_record 8

         MS Data                932034859  932041032       6174

         NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

    NTFS at 932041032/0/1

    heads/cylinder 16 (NTFS) != 1 (HD)

    sect/track 2 (NTFS) != 1 (HD)

    filesystem size           6174

    sectors_per_cluster       1

    mft_lcn                   2058

    mftmirr_lcn               5162

    clusters_per_mft_record   2

    clusters_per_index_record 8

         MS Data                932041032  932047205       6174 [Boot]

         NTFS, blocksize=512, 3161 KB / 3087 KiB

    check_FAT: Bad number of sectors per cluster

     

    LVM magic value at 939076850/0/1

    FAT12 at 952570280/0/1

    FAT1 : 1-9

    FAT2 : 10-18

    start_rootdir : 19

    Data : 33-2879

    sectors : 2880

    cluster_size : 1

    no_of_cluster : 2847 (2 - 2848)

    fat_length 9 calculated 9

    heads/cylinder 2 (FAT) != 1 (HD)

    sect/track 18 (FAT) != 1 (HD)

     

    FAT12 at 952570280/0/1

         MS Data                952570280  952573159       2880 [EFISECTOR]

         FAT12, blocksize=512, 1474 KB / 1440 KiB

     

    LVM magic value at 975423043/0/1

    NTFS at 979943544/0/1

    heads/cylinder 16 (NTFS) != 1 (HD)

    sect/track 2 (NTFS) != 1 (HD)

    filesystem size           6174

    sectors_per_cluster       1

    mft_lcn                   2058

    mftmirr_lcn               5162

    clusters_per_mft_record   2

    clusters_per_index_record 8

         MS Data                979937371  979943544       6174

         NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

    NTFS at 979943544/0/1

    heads/cylinder 16 (NTFS) != 1 (HD)

    sect/track 2 (NTFS) != 1 (HD)

    filesystem size           6174

    sectors_per_cluster       1

    mft_lcn                   2058

    mftmirr_lcn               5162

    clusters_per_mft_record   2

    clusters_per_index_record 8

         MS Data                979943544  979949717       6174 [Boot]

         NTFS, blocksize=512, 3161 KB / 3087 KiB

     

    LVM magic value at 1003980271/0/1

    FAT12 at 1013826976/0/1

    FAT1 : 1-9

    FAT2 : 10-18

    start_rootdir : 19

    Data : 33-2879

    sectors : 2880

    cluster_size : 1

    no_of_cluster : 2847 (2 - 2848)

    fat_length 9 calculated 9

    heads/cylinder 2 (FAT) != 1 (HD)

    sect/track 18 (FAT) != 1 (HD)

     

    FAT12 at 1013826976/0/1

         MS Data               1013826976 1013829855       2880 [EFISECTOR]

         FAT12, blocksize=512, 1474 KB / 1440 KiB

     

    LVM magic value at 1053198024/0/1

     

    LVM magic value at 1095629328/0/1

    FAT32 at 1134393777/0/1

    FAT1 : 32-9478

    FAT2 : 9479-18925

    start_rootdir : 18926 root cluster : 2

    Data : 18926-9691853

    sectors : 9691857

    cluster_size : 8

    no_of_cluster : 1209116 (2 - 1209117)

    fat_length 9447 calculated 9447

    FAT differs, FAT sectors=0-16/9447

    heads/cylinder 255 (FAT) != 1 (HD)

    sect/track 63 (FAT) != 1 (HD)

    set_FAT_info: name from BS used

     

    FAT32 at 1134393777/0/1

         MS Data               1134393777 1144085633    9691857 [NO NAME]

         FAT32, blocksize=4096, 4962 MB / 4732 MiB

     

    HFS+ magic value at 1161907512/0/1

    part_size 976757296

         Mac HFS               1161907512 2138664807  976757296

         HFS+ blocksize=4096, 500 GB / 465 GiB

    This partition ends after the disk limits. (start=1161907512, size=976757296, end=2138664807, disk end=1953525168)

     

    HFS+ magic value at 1161907514/0/1

    part_size 976757296

         Mac HFS                185150220 1161907515  976757296

         HFS+ found using backup sector!, 500 GB / 465 GiB

     

    HFS+ magic value at 1162577688/0/1

    part_size 976757296

         Mac HFS               1162577688 2139334983  976757296

         HFS+ blocksize=4096, 500 GB / 465 GiB

    This partition ends after the disk limits. (start=1162577688, size=976757296, end=2139334983, disk end=1953525168)

     

    HFS+ magic value at 1162577690/0/1

    part_size 976757296

         Mac HFS                185820396 1162577691  976757296

         HFS+ found using backup sector!, 500 GB / 465 GiB

    NTFS at 1163069408/0/1

    heads/cylinder 255 (NTFS) != 1 (HD)

    sect/track 63 (NTFS) != 1 (HD)

    filesystem size           479133696

    sectors_per_cluster       8

    mft_lcn                   786432

    mftmirr_lcn               2

    clusters_per_mft_record   -10

    clusters_per_index_record 1

         MS Data                683935713 1163069408  479133696

         NTFS found using backup sector, blocksize=4096, 245 GB / 228 GiB

    NTFS at 1163069408/0/1

    heads/cylinder 255 (NTFS) != 1 (HD)

    sect/track 63 (NTFS) != 1 (HD)

    filesystem size           479133696

    sectors_per_cluster       8

    mft_lcn                   786432

    mftmirr_lcn               2

    clusters_per_mft_record   -10

    clusters_per_index_record 1

         MS Data               1163069408 1642203103  479133696

         NTFS, blocksize=4096, 245 GB / 228 GiB

     

    HFS+ magic value at 1764519300/0/1

    part_size 1764109664

         Mac HFS               1764519300 3528628963 1764109664

         HFS+ blocksize=4096, 903 GB / 841 GiB

    This partition ends after the disk limits. (start=1764519300, size=1764109664, end=3528628963, disk end=1953525168)

     

    HFS+ magic value at 1764519302/0/1

    part_size 1764109664

         Mac HFS                   409640 1764519303 1764109664

         HFS+ found using backup sector!, 903 GB / 841 GiB

     

    HFS+ magic value at 1764519304/0/1

     

    HFS+ magic value at 1764519304/0/1

    part_size 83886080

         Mac HFS               1764519304 1848405383   83886080

         HFS+ blocksize=4096 + Backup, 42 GB / 40 GiB

    FAT32 at 1848405384/0/1

    check_FAT: Unusual media descriptor (0xf0!=0xf8)

    FAT1 : 32-10261

    FAT2 : 10262-20491

    start_rootdir : 20492 root cluster : 2

    Data : 20492-10485755

    sectors : 10485760

    cluster_size : 8

    no_of_cluster : 1308158 (2 - 1308159)

    fat_length 10230 calculated 10220

    heads/cylinder 255 (FAT) != 1 (HD)

    sect/track 63 (FAT) != 1 (HD)

     

    FAT32 at 1848405384/0/1

         MS Data               1848405384 1858891143   10485760 [DIAG]

         FAT32, blocksize=4096, 5368 MB / 5120 MiB

     

    HFS+ magic value at 1858891144/0/1

    part_size 94371840

         Mac HFS               1858891144 1953262983   94371840

         HFS+ blocksize=4096, 48 GB / 45 GiB

    NTFS at 1953519615/0/1

    heads/cylinder 255 (NTFS) != 1 (HD)

    sect/track 63 (NTFS) != 1 (HD)

    filesystem size           552955904

    sectors_per_cluster       8

    mft_lcn                   786432

    mftmirr_lcn               2

    clusters_per_mft_record   -10

    clusters_per_index_record 1

         MS Data               1400563712 1953519615  552955904

         NTFS found using backup sector, blocksize=4096, 283 GB / 263 GiB

    NTFS at 1953519615/0/1

    heads/cylinder 255 (NTFS) != 1 (HD)

    sect/track 63 (NTFS) != 1 (HD)

    filesystem size           552955904

    sectors_per_cluster       8

    mft_lcn                   786432

    mftmirr_lcn               2

    clusters_per_mft_record   -10

    clusters_per_index_record 1

    NTFS: Can't read MFT

         MS Data               1953519615 2506475518  552955904

         NTFS, blocksize=4096, 283 GB / 263 GiB

    This partition ends after the disk limits. (start=1953519615, size=552955904, end=2506475518, disk end=1953525168)

    NTFS at 1953523711/0/1

    heads/cylinder 255 (NTFS) != 1 (HD)

    sect/track 63 (NTFS) != 1 (HD)

    filesystem size           1093476352

    sectors_per_cluster       8

    mft_lcn                   786432

    mftmirr_lcn               2

    clusters_per_mft_record   -10

    clusters_per_index_record 1

         MS Data                860047360 1953523711 1093476352

         NTFS found using backup sector, blocksize=4096, 559 GB / 521 GiB

    NTFS at 1953523711/0/1

    heads/cylinder 255 (NTFS) != 1 (HD)

    sect/track 63 (NTFS) != 1 (HD)

    filesystem size           1093476352

    sectors_per_cluster       8

    mft_lcn                   786432

    mftmirr_lcn               2

    clusters_per_mft_record   -10

    clusters_per_index_record 1

    NTFS: Can't read MFT

         MS Data               1953523711 3047000062 1093476352

         NTFS, blocksize=4096, 559 GB / 521 GiB

    This partition ends after the disk limits. (start=1953523711, size=1093476352, end=3047000062, disk end=1953525168)

    Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

    Check the harddisk size: HD jumpers settings, BIOS detection...

    The harddisk (1000 GB / 931 GiB) seems too small! (< 1806 GB / 1682 GiB)

    The following partitions can't be recovered:

         Mac HFS                886859759 2120804336 1233944578

         HFS blocksize=16777216, 631 GB / 588 GiB

         Mac HFS                905665415 2139609992 1233944578

         HFS blocksize=16777216, 631 GB / 588 GiB

         Mac HFS               1161907512 2138664807  976757296

         HFS+ blocksize=4096, 500 GB / 465 GiB

         Mac HFS               1162577688 2139334983  976757296

         HFS+ blocksize=4096, 500 GB / 465 GiB

         Mac HFS               1764519300 3528628963 1764109664

         HFS+ blocksize=4096, 903 GB / 841 GiB

         MS Data               1953519615 2506475518  552955904

         NTFS, blocksize=4096, 283 GB / 263 GiB

         MS Data               1953523711 3047000062 1093476352

         NTFS, blocksize=4096, 559 GB / 521 GiB

     

    Results

       P EFI System                    40     409639     409600 [EFI]

         FAT32, blocksize=512, 209 MB / 200 MiB

         Mac HFS                   409640  858777823  858368184

         HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

         Mac HFS                   409640 1764519303 1764109664

         HFS+ found using backup sector!, 903 GB / 841 GiB

         Mac HFS                185150220 1161907515  976757296

         HFS+ found using backup sector!, 500 GB / 465 GiB

         Mac HFS                185820396 1162577691  976757296

         HFS+ found using backup sector!, 500 GB / 465 GiB

         MS Data                683935713 1163069408  479133696

         NTFS found using backup sector, blocksize=4096, 245 GB / 228 GiB

         Mac HFS                858777824  860047359    1269536

         HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

         MS Data                860047360 1953523711 1093476352

         NTFS found using backup sector, blocksize=4096, 559 GB / 521 GiB

         MS Data                868847979  868868717      20739 [NO NAME]

         FAT12, blocksize=4096, 10 MB / 10 MiB

         Mac HFS                871635660  880024269    8388610 [ÿÿÿºD ]

         HFS blocksize=16777216, 4294 MB / 4096 MiB

         MS Data                893746232  893749111       2880 [EFISECTOR]

         FAT12, blocksize=512, 1474 KB / 1440 KiB

         MS Data                893820027  893826200       6174

         NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

         MS Data                893826200  893832373       6174 [Boot]

         NTFS, blocksize=512, 3161 KB / 3087 KiB

         MS Data                897548777  898920760    1371984 [GW¹¤Ø«ÝнÍ(bždSÜ]

         cramfs, 702 MB / 669 MiB

         MS Data                932034859  932041032       6174

         NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

         MS Data                932041032  932047205       6174 [Boot]

         NTFS, blocksize=512, 3161 KB / 3087 KiB

         MS Data                952570280  952573159       2880 [EFISECTOR]

         FAT12, blocksize=512, 1474 KB / 1440 KiB

         MS Data                979937371  979943544       6174

         NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

         MS Data                979943544  979949717       6174 [Boot]

         NTFS, blocksize=512, 3161 KB / 3087 KiB

         MS Data               1013826976 1013829855       2880 [EFISECTOR]

         FAT12, blocksize=512, 1474 KB / 1440 KiB

         MS Data               1134393777 1144085633    9691857 [NO NAME]

         FAT32, blocksize=4096, 4962 MB / 4732 MiB

         MS Data               1163069408 1642203103  479133696

         NTFS, blocksize=4096, 245 GB / 228 GiB

         MS Data               1400563712 1953519615  552955904

         NTFS found using backup sector, blocksize=4096, 283 GB / 263 GiB

         Mac HFS               1764519304 1848405383   83886080

         HFS+ blocksize=4096 + Backup, 42 GB / 40 GiB

         MS Data               1848405384 1858891143   10485760 [DIAG]

         FAT32, blocksize=4096, 5368 MB / 5120 MiB

         Mac HFS               1858891144 1953262983   94371840

         HFS+ blocksize=4096, 48 GB / 45 GiB

     

    interface_write()

    1 P EFI System                    40     409639     409600 [EFI]

    simulate write!

     

    Interface Advanced

    hdr_size=92

    hdr_lba_self=1

    hdr_lba_alt=1953525167 (expected 1953525167)

    hdr_lba_start=34

    hdr_lba_end=1953525134

    hdr_lba_table=2

    hdr_entries=128

    hdr_entsz=128

    check_part_gpt failed for partition

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

    1 P EFI System                    40     409639     409600 [EFI System Partition]

    2 P Mac HFS                   409640  858777823  858368184 [Mac OSX]

         HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

    3 P Mac Boot               858777824  860047359    1269536 [Recovery HD]

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

    New options :

    Dump : No

    Align partition: Yes

    Expert mode : No

     

    Analyse Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

    hdr_size=92

    hdr_lba_self=1

    hdr_lba_alt=1953525167 (expected 1953525167)

    hdr_lba_start=34

    hdr_lba_end=1953525134

    hdr_lba_table=2

    hdr_entries=128

    hdr_entsz=128

    check_part_gpt failed for partition

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

    Current partition structure:

    1 P EFI System                    40     409639     409600 [EFI System Partition]

    2 P Mac HFS                   409640  858777823  858368184 [Mac OSX]

    3 P Mac Boot               858777824  860047359    1269536 [Recovery HD]

    No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

     

    search_part()

    Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

    FAT32 at 40/0/1

    check_FAT: Unusual media descriptor (0xf0!=0xf8)

    FAT1 : 32-3182

    FAT2 : 3183-6333

    start_rootdir : 6334 root cluster : 2

    Data : 6334-409599

    sectors : 409600

    cluster_size : 1

    no_of_cluster : 403266 (2 - 403267)

    fat_length 3151 calculated 3151

    heads/cylinder 16 (FAT) != 1 (HD)

    sect/track 32 (FAT) != 1 (HD)

     

    FAT32 at 40/0/1

         EFI System                    40     409639     409600 [EFI]

         FAT32, blocksize=512, 209 MB / 200 MiB

     

    HFS+ magic value at 409640/0/1

     

    HFS+ magic value at 409640/0/1

    part_size 858368184

         Mac HFS                   409640  858777823  858368184

         HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

     

    HFS+ magic value at 858777824/0/1

     

    HFS+ magic value at 858777824/0/1

    part_size 1269536

         Mac HFS                858777824  860047359    1269536

         HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

    Search for partition aborted

     

    Results

       P EFI System                    40     409639     409600 [EFI]

         FAT32, blocksize=512, 209 MB / 200 MiB

       P Mac HFS                   409640  858777823  858368184

         HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

       P Mac HFS                858777824  860047359    1269536

         HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

  • by Loner T,

    Loner T Loner T Oct 27, 2014 4:44 PM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Oct 27, 2014 4:44 PM in response to Redeagles-143

    The following entries are interesting ones. You will still need Testdisk to look inside these partitions for familiar files though.

     

    MS Data                683935713 1163069408  479133696

    MS Data               1163069408 1642203103  479133696

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

    4 P MS Data                860047360 1953523711 1093476352 [BOOTCAMP]

     


  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Oct 27, 2014 5:34 PM in response to Loner T
    Level 1 (0 points)
    Oct 27, 2014 5:34 PM in response to Loner T

    Sorry to be a pain, but when using test disk, am I looking for familiar files of the windows partition with all the user accounts in it (hence will have my sons user account with the data I want to recover) or am I just looking for familiar files in my sons user account ?

  • by Loner T,

    Loner T Loner T Oct 27, 2014 6:32 PM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Oct 27, 2014 6:32 PM in response to Redeagles-143

    You are looking for familiar files that belongs to Windows, typically system files, since they are usually the first files to be installed and written. My suggestion is to have Windows up and running then you can backup/extract files as you choose.

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Oct 29, 2014 7:32 AM in response to Loner T
    Level 1 (0 points)
    Oct 29, 2014 7:32 AM in response to Loner T

    I looked in both the ms data folders and found nothing familiar.

    Screen Shot 2014-10-27 at 22.53.14.png

    Screen Shot 2014-10-29 at 06.19.13.png

    Screen Shot 2014-10-29 at 06.15.42.png

    I am currently doing a deep search of the drive, its been 7 hours now and only done about 40%. Will update you when finish. Any suggestions?

  • by Loner T,

    Loner T Loner T Oct 29, 2014 7:55 AM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Oct 29, 2014 7:55 AM in response to Redeagles-143

    The Deeper Search is a slow process.

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Oct 30, 2014 3:06 AM in response to Loner T
    Level 1 (0 points)
    Oct 30, 2014 3:06 AM in response to Loner T

    Found something interesting after the Deeper Search,

    Screen Shot 2014-10-30 at 09.06.43.png

    Screen Shot 2014-10-30 at 09.16.20.png

    Screen Shot 2014-10-30 at 09.19.14.png

    Screen Shot 2014-10-30 at 09.19.44.png

    Screen Shot 2014-10-30 at 09.22.33.png

    I only went into the the first MS DATA  partition "MS Data     1953519615     2506475518     552955904"  from the 1st screen shot.

    I can't get back into the original screen to select "MS data      1953523711     3047000062     1093476352" to look in there.

    I will have to do the Deeper Search again if you need me to look there ( which its going to take 36 hours ".

     

    When i went into the users directory, I didn't see all the user names listed and not the user data I wanted to recover "Jake". Do you think this the the right one?

  • by Loner T,

    Loner T Loner T Oct 30, 2014 4:39 AM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Oct 30, 2014 4:39 AM in response to Redeagles-143

    It is not very useful to do a second Deeper Search, it will lead to the same results, because each is a sector-by-sector scan. Think of yourself sitting on the branch of a tree, irrespective of the "path-of-descent" chosen, you goal is to get to trunk towards the root to get to the surface on which the three is planted.

     

    Once you get to Deeper Search, you can look at each MS Data in that set of results to exhaust each entry in the list.

     

    The entry at start/end/size of 781864960/1257201663/475336704 is roughly 226+ GB. Is that about the correct size of your Windows partition?

     

    If Windows will come up properly, you should be able to find all your users.

Page 1 of 4 last Next