mannygomez

Q: Bootcamp disappeared after Yosemite upgrade

Hi Loner,

Unfortunately, should have read this before upgrading the yosemite while having the bootcamp.

I have noticed you have successfully advised some users on recovering the windows files and data.

 

I have followed your notes:

diskutil list

/dev/disk0

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *251.0 GB   disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:          Apple_CoreStorage                         130.7 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:       Microsoft Basic Data                         20.0 GB    disk0s4

/dev/disk1

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:                  Apple_HFS Macintosh HD           *130.3 GB   disk1

                                 Logical Volume on disk0s2

                                 D1498301-E94E-48FF-B819-BF4B24BDAE9C

                                 Unlocked Encrypted

diskutil cs list

sudo fdisk /dev/rdisk0s4

sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 490234751

      start       size  index  contents

          0          1         MBR

          1          1         Pri GPT header

          2         32         Pri GPT table

         34          6        

         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

     409640  255259680      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

  255669320    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

  256938856  194233496        

  451172352   39061504      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  490233856        863        

  490234719         32         Sec GPT table

  490234751          1         Sec GPT header

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

 

But after this step, instead of obtaining the first row with NFTS files, I got the following:

 

Manuels-MacBook-Pro:~ manuelgomes$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

00000200

 

Does that mean that all is lost??

Could you please elucidate me whether it is possible to recover the data I had in the bootcamp partition and what should be the next steps?

 

Many thanks,

Manny

MacBook Pro, iOS 8, Upgrade to Yosemite completed

Posted on Nov 1, 2014 3:26 AM

Close

Q: Bootcamp disappeared after Yosemite upgrade

  • All replies
  • Helpful answers

  • by mannygomez,

    mannygomez mannygomez Nov 1, 2014 3:30 AM in response to mannygomez
    Level 1 (0 points)
    Nov 1, 2014 3:30 AM in response to mannygomez

    Dear Loner,

    Many thanks for your prompt response. In reply to your steps:

     

    1. Ok, done.

    2. I'm new to Mac, so please bear with me. I will install TestDisk and GPT Fdisk and follow the instructions on the link you sent.

    3. That sounds encouraging!

     

    Manny

  • by mannygomez,

    mannygomez mannygomez Nov 1, 2014 3:31 AM in response to mannygomez
    Level 1 (0 points)
    Nov 1, 2014 3:31 AM in response to mannygomez

    OK, I've created a new thread atBootcamp disappeared after Yosemite upgrade

  • by mannygomez,

    mannygomez mannygomez Nov 1, 2014 4:55 AM in response to mannygomez
    Level 1 (0 points)
    Nov 1, 2014 4:55 AM in response to mannygomez

    Hi Loner,

    After running Testdisk I got the following output:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO)

     

    The harddisk (251 GB / 233 GiB) seems too small! (< 370 GB / 345 GiB)

    Check the harddisk size: HD jumpers settings, BIOS detection...

     

    The following partitions can't be recovered:

         Partition               Start        End    Size in sectors

    >  MS Data                490233855  723527671  233293817

       Mac HFS                490234708  491504243    1269536logout

     

    [Process completed]

     

     

     

     

     

     

     

    [ Continue ]

    NTFS, blocksize=4096, 119 GB / 111 GiB

     

    What should be the next steps? If I press enter (continue) nothing happens..


    Then I run:

    sudo gdisk /dev/disk0


    Manuels-MacBook-Pro:~ manuelgomes$ sudo gdisk /dev/disk0

    Password:

    GPT fdisk (gdisk) version 0.8.10

     

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Partition table scan:

      MBR: hybrid

      BSD: not present

      APM: not present

      GPT: present

     

    Found valid GPT with hybrid MBR; using GPT.

     

    Command (? for help): p

    Disk /dev/disk0: 490234752 sectors, 233.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): AED95BC6-A8C7-45F6-B111-5CAE2EBAD67F

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 490234718

    Partitions will be aligned on 8-sector boundaries

    Total free space is 194234365 sectors (92.6 GiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EFI System Partition

       2          409640       255669319   121.7 GiB   AF05  Macintosh HD

       3       255669320       256938855   619.9 MiB   AB00  Recovery HD

       4       451172352       490233855   18.6 GiB    0700  BOOTCAMP

    Command (? for help):

     

    What should I enter?

    I will wait for your response before proceeding.


  • by Loner T,

    Loner T Loner T Nov 1, 2014 6:27 AM in response to mannygomez
    Level 7 (24,601 points)
    Safari
    Nov 1, 2014 6:27 AM in response to mannygomez

    Disk would be needed later. Testdisk is the primary tool.

     

    What you are currently looking at does not contain a NTFS header that is usable.

     

    Start Testdisk (sudo testdisk) and select the device rdisk0 . Select EFI partition type. Do not use left/right cursor keys under any circumstances (these delete partitions). Please look at the Deeper Search option at this link http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#A_partition_is_still_missin g:_Deeper_Search

     

    .

    This is a very slow and time consuming process, and depending on your disk size and speed can take up to 10+ hours, so please be patient.

  • by mannygomez,

    mannygomez mannygomez Nov 3, 2014 12:03 AM in response to Loner T
    Level 1 (0 points)
    Nov 3, 2014 12:03 AM in response to Loner T

    Hi Loner,

    Okay, I ran a test disk on rdisk0 rather than disk0. After a while I got something similar to hexagram92 Bootcamp win8.1 autorepair fail after yosemite upgrade:

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO)

         Partition               Start        End    Size in sectors

    P EFI System                    40     409639     409600 [EFI]

    D MS Data                 23646216  256940032  233293817

    D Mac HFS                255669320  256938855    1269536

    >D MS Data                256940032  490233848  233293817

    D MS Data                256940039  490233855  233293817

    D Mac HFS                488965176  490234711    1269536

     

     

     

     

     

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

    NTFS, blocksize=4096, 119 GB / 111 GiB


    The details of the selected partition are as follows:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

         MS Data                256940032  490233848  233293817

    Directory /

     

    >dr-xr-xr-x     0     0         0 31-Oct-2014 20:49 .

    dr-xr-xr-x     0     0         0 31-Oct-2014 20:49 ..

    dr-xr-xr-x     0     0         0 21-Nov-2013 09:53 $Recycle.Bin

    dr-xr-xr-x     0     0         0 21-Nov-2013 17:05 Boot

    dr-xr-xr-x     0     0         0  5-Oct-2014 16:29 Gomes

    dr-xr-xr-x     0     0         0  4-Dec-2013 23:39 Intel

    dr-xr-xr-x     0     0         0  6-Jan-2014 15:48 MSOCache

    dr-xr-xr-x     0     0         0 14-Jul-2009 04:20 PerfLogs

    dr-xr-xr-x     0     0         0 12-Sep-2014 22:59 Program Files

    dr-xr-xr-x     0     0         0 31-Oct-2014 20:38 Program Files (x86)

    dr-xr-xr-x     0     0         0 12-Sep-2014 22:58 ProgramData

    dr-xr-xr-x     0     0         0 21-Nov-2013 09:23 Recovery

    dr-xr-xr-x     0     0         0 28-Oct-2014 23:12 System Volume Information

    dr-xr-xr-x     0     0         0 21-Nov-2013 09:23 Users

                                                       Next

    Use Right to change directory, h to hide Alternate Data Stream

        q to quit, : to select the current file, a to select all files

        C to copy the selected files, c to copy the current file

     

     

    Is this what we were looking for? Or do I need to run a deeper search?

  • by Loner T,Helpful

    Loner T Loner T Nov 3, 2014 3:35 AM in response to mannygomez
    Level 7 (24,601 points)
    Safari
    Nov 3, 2014 3:35 AM in response to mannygomez

    You have three MS Data entries of 233293817. Each of them is candidate for being your lost NTFS partition. The listing you are looking at has three numbers which are 256940032/490233848/233293817. These are start/end/size numbers. Using the the size number, 233293817 / (2 * 1024 *1024) = 111+ GB. Do you recall your Windows partition size?

     

    Scroll to the first one and enter "P", if it does not show any familiar files, go to the next MS Data entry. You have three start points to look at

    23646216, 256940032 and 256940039. The last two are fairly close, and the smaller number should be used (the difference is only 7 bytes).

     

    256938856  194233496        

    451172352   39061504      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

     

    Your GPT entries are from the output of GPT command. Assuming 256940032 to be the correct NTFS start, the "hole" starts at 256938856,

    which is 1,716 bytes before 256940032. This is the issue with Yosemite. It moves partitions around but leaves this hold with customer data. If it is not caught early, you will lose data.

     

    Once you establish which of the three MS Data entries is to be used, the current GPT#4 is deleted, and a new one is created using the chosen start/end/size and the corresponding MBR rebuilt and tested.

     

    Please post the output of the files list of the other two MS Data entries. I suspect the first one is damaged.

  • by mannygomez,

    mannygomez mannygomez Nov 3, 2014 6:32 AM in response to Loner T
    Level 1 (0 points)
    Nov 3, 2014 6:32 AM in response to Loner T

    Yes, the windows partition was about that size (111GB+).

    The second MS data partition (starting 256940032) seems to be the correct one (the other 2 say the system is damaged). See output example below:

     

      MS Data                 23646216  256940032  233293817

     

     

     

    Can't open filesystem. Filesystem seems damaged.

     

     

    My last picture above show the listing of that partition, which contains the folder I'm trying to recover ("Gomes") plus all other windows files.

     

    Should I proceed and delete current GPT#4 and create a new one? Is the code below correct to proceed?

    sudo gdisk /dev/rdisk0

    p

    d #4

    n #4

    256940032

    490233848

    0700

    p

     

    Thanks!

  • by Loner T,Helpful

    Loner T Loner T Nov 3, 2014 6:42 AM in response to mannygomez
    Level 7 (24,601 points)
    Safari
    Nov 3, 2014 6:42 AM in response to mannygomez

    mannygomez wrote:

     

    Should I proceed and delete current GPT#4 and create a new one? Is the code below correct to proceed?

    sudo gdisk /dev/rdisk0

    p

    d #4

    n #4

    256940032

    490233848

    0700

    p

     

    Thanks!

     

    sudo gdisk /dev/rdisk0

    p

    d

    4

    n

    4

    256940032

    490233848

    0700

    p

    w

    y


  • by mannygomez,

    mannygomez mannygomez Nov 3, 2014 9:39 AM in response to Loner T
    Level 1 (0 points)
    Nov 3, 2014 9:39 AM in response to Loner T

    Thanks Loner T,

    Bootcamp is now back in the Finder, and fortunately all the important folders seem to be there (!)

    However, I cannot boot with Windows yet.

    What additional steps do I need to take to boot with Windows?

  • by Loner T,

    Loner T Loner T Nov 3, 2014 9:47 AM in response to mannygomez
    Level 7 (24,601 points)
    Safari
    Nov 3, 2014 9:47 AM in response to mannygomez

    If you have not re-created the hybrid MBR after fixing the partitions, follow these steps.

     

    You need to create the Hybrid MBR. Here is an example...

     

     

    sudo gdisk /dev/disk0

    GPT fdisk (gdisk) version 0.8.10

     

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Partition table scan:

      MBR: hybrid

      BSD: not present

      APM: not present

      GPT: present

     

    Found valid GPT with hybrid MBR; using GPT.

     

    Command (? for help): p

    Disk /dev/disk0: 490234752 sectors, 233.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): 59BDFEEB-1EB4-4529-94FE-3CBC2C3CD513

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 490234718

    Partitions will be aligned on 8-sector boundaries

    Total free space is 2604 sectors (1.3 MiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EF

       2          409640       401060383   191.0 GiB   AF05  Macintosh HD

       3       401060384       402329919   619.9 MiB   AB00  Re

       4       402331648       490233848   41.9 GiB    0700  Microsoft basic data

     

    Command (? for help): r

     

    Recovery/transformation command (? for help): h

     

    WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

    just hit the Enter key at the below prompt and your MBR partition table will

    be untouched.

     

    Type from one to three GPT partition numbers, separated by spaces, to be

    added to the hybrid MBR, in sequence: 2 3 4

    Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y

     

    Creating entry for GPT partition #2 (MBR partition #2)

    Enter an MBR hex code (default AF): AF

    Set the bootable flag? (Y/N): n

     

    Creating entry for GPT partition #3 (MBR partition #3)

    Enter an MBR hex code (default AB): AB

    Set the bootable flag? (Y/N): n

     

    Creating entry for GPT partition #4 (MBR partition #4)

    Enter an MBR hex code (default 07): 07

    Set the bootable flag? (Y/N): y

     

    Recovery/transformation command (? for help): w

     

    Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

    PARTITIONS!!

     

    Do you want to proceed? (Y/N): y

    OK; writing new GUID partition table (GPT) to /dev/disk0.

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Warning: The kernel may continue to use old or deleted partitions.

    You should reboot or remove the drive.

    The operation has completed successfully.

     

    Now Reboot and verify the output of fdisk again.

  • by mannygomez,

    mannygomez mannygomez Nov 3, 2014 11:01 AM in response to Loner T
    Level 1 (0 points)
    Nov 3, 2014 11:01 AM in response to Loner T

    Thanks Loner T, I feel we are almost there!!

    So I can boot with windows fine, swap startup disk, etc. The output of the fdisk now looks like this

    Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE    0   0   2 -   25 127  14 [         1 -     409639] <Unknown ID>

    2: AF   25 127  15 - 1023 254  63 [    409640 -  255259680] HFS+       

    3: AB 1023 254  63 - 1023 254  63 [ 255669320 -    1269536] Darwin Boot

    *4: 07 1023 254  63 - 1023 254  63 [ 256940032 -  233293817] HPFS/QNX/AUX

     

    GPT fdisk (gdisk) version 0.8.10

     

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Partition table scan:

      MBR: hybrid

      BSD: not present

      APM: not present

      GPT: present

     

    Found valid GPT with hybrid MBR; using GPT.

    Disk /dev/disk0: 490234752 sectors, 233.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): AED95BC6-A8C7-45F6-B111-5CAE2EBAD67F

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 490234718

    Partitions will be aligned on 8-sector boundaries

    Total free space is 2052 sectors (1.0 MiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EFI System Partition

       2          409640       255669319   121.7 GiB   AF05  Macintosh HD

       3       255669320       256938855   619.9 MiB   AB00  Recovery HD

       4       256940032       490233848   111.2 GiB   0700  Microsoft basic data

     

     

    With Mac I can access both Macintosh and Bootcamp hard drives and all the data inside them, whereas when I boot with Windows, I can only access the Bootcamp drive (C:). When I click on the Macintosh drive (D:), it gives me the following message: 'You need to format the disk in Drive D: before you can use it'

     

    What do I need to do to get around this issue?

  • by Loner T,Solvedanswer

    Loner T Loner T Nov 3, 2014 10:58 AM in response to mannygomez
    Level 7 (24,601 points)
    Safari
    Nov 3, 2014 10:58 AM in response to mannygomez

    Please see windows 8 does not recognise Macintosh HD, No drive Letter. Do NOT format D: You will lose OSX.

     

    Yosemite upgrade broke the readability of the OSX volume on Windows side, because it was converted from HFS+ to CoreStorage. This requires Apple to fix it. This is from your first post.

     

    /dev/disk1

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:                  Apple_HFS Macintosh HD           *130.3 GB   disk1

                                     Logical Volume on disk0s2

                                     D1498301-E94E-48FF-B819-BF4B24BDAE9C

                                     Unlocked Encrypted

  • by mannygomez,

    mannygomez mannygomez Nov 3, 2014 11:11 AM in response to Loner T
    Level 1 (0 points)
    Nov 3, 2014 11:11 AM in response to Loner T

    Thanks Loner T.

    Unfortunately I will have to wait for a possible fix in the future, but the most important thing was to recover the information in Bootcamp and being able to run Windows again.

     

    Your help was invaluable, really appreciate it.

     

    Best wishes,

    Manny