jjkeele

Q: Win7 missing after Yosemite upgrade

Hi Loner T,

 

I'm hoping you can help me, I've been searching through your threads for hours trying to figure out how I fix my Windows boot partition, here are my command dumps, I've managed to get the disk to show up during startup but it states that operating system not found:

 

diskutil list

 

/dev/disk0

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *750.2 GB   disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:                  Apple_HFS Untitled                199.3 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:       Microsoft Basic Data                         550.0 GB   disk0s4

 

diskutil cs list

 

No CoreStorage logical volume groups found

 

sudo gpt -vv -r show /dev/disk0

 

gpt show: /dev/disk0: mediasize=750156374016; sectorsize=512; blocks=1465149168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1465149167

       start        size  index  contents

           0           1         MBR

           1           1         Pri GPT header

           2          32         Pri GPT table

          34           6        

          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

      409640   389251256      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

   389660896     1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

   390930432  1074216960      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  1465147392        1743        

  1465149135          32         Sec GPT table

  1465149167           1         Sec GPT header

 

sudo fdisk /dev/disk0

 

Disk: /dev/disk0 geometry: 91201/255/63 [1465149168 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE    0   0   2 - 1023 254  63 [         1 -  390930431] <Unknown ID>

*2: 07 1023 254  63 - 1023 254  63 [ 390930432 - 1074216960] HPFS/QNX/AUX

3: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

4: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

 

Unfortunately this bit looks worrying because there is no NTFS preamble:

 

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

 

00000000  39 4a 2f 71 72 42 72 37  2f 38 39 50 4c 34 71 69  |9J/qrBr7/89PL4qi|

00000010  6e 50 68 72 5a 55 31 53  6d 75 42 66 65 6d 6a 5a  |nPhrZU1SmuBfemjZ|

00000020  78 59 4c 72 32 31 76 31  35 6e 5a 64 61 6e 74 71  |xYLr21v15nZdantq|

00000030  49 7a 55 50 44 55 2b 4e  50 43 34 48 52 6e 44 30  |IzUPDU+NPC4HRnD0|

00000040  52 6b 79 4a 41 53 67 79  59 6c 77 71 5a 35 37 63  |RkyJASgyYlwqZ57c|

00000050  4d 76 57 4d 79 35 30 6c  68 6a 44 63 73 42 4a 49  |MvWMy50lhjDcsBJI|

00000060  34 64 73 76 6f 2b 6d 76  63 48 45 74 63 53 55 54  |4dsvo+mvcHEtcSUT|

00000070  79 57 41 41 30 44 48 54  31 65 42 5a 47 39 75 38  |yWAA0DHT1eBZG9u8|

00000080  41 31 43 67 6b 49 33 5a  69 4b 64 70 77 42 34 4d  |A1CgkI3ZiKdpwB4M|

00000090  77 46 50 2f 51 39 61 44  73 4e 6d 72 56 45 63 49  |wFP/Q9aDsNmrVEcI|

000000a0  6e 64 73 49 61 52 2b 48  74 6b 68 76 4f 6e 53 33  |ndsIaR+HtkhvOnS3|

000000b0  63 6d 4c 36 70 76 55 4c  74 6e 49 34 71 39 62 67  |cmL6pvULtnI4q9bg|

000000c0  36 6f 61 33 62 4a 34 2f  37 4e 4f 35 2f 49 48 44  |6oa3bJ4/7NO5/IHD|

000000d0  47 73 70 33 52 6f 58 34  50 4b 4b 4f 2b 55 53 38  |Gsp3RoX4PKKO+US8|

000000e0  41 42 4b 73 54 50 74 77  51 30 65 4f 4b 39 49 49  |ABKsTPtwQ0eOK9II|

000000f0  77 65 61 49 4f 66 54 37  54 44 4a 41 51 43 43 53  |weaIOfT7TDJAQCCS|

00000100  4b 69 52 56 34 77 6d 63  41 77 75 46 4e 46 55 4d  |KiRV4wmcAwuFNFUM|

00000110  4b 54 38 67 74 65 30 4d  6f 76 67 50 54 75 4f 57  |KT8gte0MovgPTuOW|

00000120  48 58 67 66 32 76 74 62  37 36 37 4d 38 5a 70 57  |HXgf2vtb767M8ZpW|

00000130  45 5a 69 42 2f 59 66 52  55 47 2b 57 66 4f 77 53  |EZiB/YfRUG+WfOwS|

00000140  50 39 6e 56 4f 70 34 54  30 37 6d 51 42 79 6e 7a  |P9nVOp4T07mQBynz|

00000150  38 4f 76 4a 64 63 67 57  49 70 54 44 57 54 37 46  |8OvJdcgWIpTDWT7F|

00000160  4f 50 6a 6c 57 66 35 36  68 6f 6f 58 69 33 42 7a  |OPjlWf56hooXi3Bz|

00000170  7a 6a 4a 76 35 65 62 71  67 44 79 5a 6b 50 51 72  |zjJv5ebqgDyZkPQr|

00000180  63 52 56 64 44 79 78 57  71 6f 57 7a 63 42 30 6c  |cRVdDyxWqoWzcB0l|

00000190  4a 69 4a 72 44 7a 4e 75  67 2f 36 69 48 49 47 47  |JiJrDzNug/6iHIGG|

000001a0  64 61 52 51 30 42 30 34  35 41 55 50 77 41 4f 56  |daRQ0B045AUPwAOV|

000001b0  63 41 64 4c 76 57 42 41  6d 56 6a 49 35 4e 35 58  |cAdLvWBAmVjI5N5X|

000001c0  44 38 49 35 36 64 74 70  4e 57 39 6b 35 39 41 61  |D8I56dtpNW9k59Aa|

000001d0  4a 48 53 57 75 41 5a 4b  55 6d 54 78 35 56 73 35  |JHSWuAZKUmTx5Vs5|

000001e0  61 48 70 39 73 76 33 56  36 74 6a 64 74 63 70 56  |aHp9sv3V6tjdtcpV|

000001f0  79 36 75 55 6f 72 50 31  47 76 75 5a 46 70 4c 38  |y6uUorP1GvuZFpL8|

00000200

 

Any help would be greatly appreciated!!!!

MacBook Pro, OS X Yosemite (10.10), bootcamp windows 7

Posted on Nov 7, 2014 1:27 AM

Close

Q: Win7 missing after Yosemite upgrade

  • All replies
  • Helpful answers

Page 1 of 3 last Next
  • by Loner T,

    Loner T Loner T Nov 7, 2014 4:30 AM in response to jjkeele
    Level 7 (24,202 points)
    Safari
    Nov 7, 2014 4:30 AM in response to jjkeele

    Thank you for starting a new thread.


    1. If the Gpt command output has 4 entries (GPT#1,#2,#3 and #4), there is a corresponding entry in the Fdisk output. You have only 2. Is this the state created by Yosemite?

     

    2. The Rdisk0s4 dd looks incorrect.

     

    3. Can you describe in a bit more detail what was done post-Yosemite to arrive at this point?

  • by jjkeele,

    jjkeele jjkeele Nov 7, 2014 11:10 AM in response to Loner T
    Level 1 (0 points)
    Nov 7, 2014 11:10 AM in response to Loner T

    To my knowledge, the only action other than the actual upgrade was my attempt to make rdisk0s4 bootable which obviously failed but at least allowed it to be shown at the option boot menu. 

  • by Loner T,

    Loner T Loner T Nov 7, 2014 11:36 AM in response to jjkeele
    Level 7 (24,202 points)
    Safari
    Nov 7, 2014 11:36 AM in response to jjkeele

    What tools were used to make rdisk0s4 bootable?

  • by jjkeele,

    jjkeele jjkeele Nov 7, 2014 1:22 PM in response to Loner T
    Level 1 (0 points)
    Nov 7, 2014 1:22 PM in response to Loner T

    Hi Loner T,

     

    Apologies for the delays in response, I used gdisk from an earlier thread downloaded from sourceforge.

     

    Thanks

    James

  • by Loner T,

    Loner T Loner T Nov 7, 2014 1:36 PM in response to jjkeele
    Level 7 (24,202 points)
    Safari
    Nov 7, 2014 1:36 PM in response to jjkeele

    Thanks.

     

    You will need to download Testdisk and look for "lost" NTFS partitions. The way your GPT is now, you may lose your Recovery HD. I would suggest a backup of OSX now, before any changes are made.

     

    http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

  • by jjkeele,

    jjkeele jjkeele Nov 7, 2014 8:30 PM in response to Loner T
    Level 1 (0 points)
    Nov 7, 2014 8:30 PM in response to Loner T

    Doing that now, thanks for the help.  You have no idea how much this means to me.  All I want is the data back from the bootcamp partition.  I've taken the drive out and plugged it in separately on a PC.  I'm using Testdisk now and these are the results so far:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

                                                                                    Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63

    Analyse cylinder 24418/91200: 26%

                                                                                                                                                                     check_FAT: Unusual media descriptor (0xf0!=0xf8)

    Warning: number of heads/cylinder mismatches 16 (FAT) != 255 (HD)

    Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)

      EFI System                    40     409639     409600 [EFI]

      Mac HFS                   409640  389660895  389251256

      Mac HFS                389660896  390930431    1269536

     

    Should I be worried about the messages in bold?

  • by Loner T,

    Loner T Loner T Nov 8, 2014 4:00 AM in response to jjkeele
    Level 7 (24,202 points)
    Safari
    Nov 8, 2014 4:00 AM in response to jjkeele

    The Cylinder/Heads/Sectors (CHS) geometry was valid on very old disks, and is no longer valid on more modern disks. The MBR used for bootcamp still uses such entries which confuse Testdisk. Here is an example. The CHS numbers make very little sense now. Notice the "geometry" entry and the individual entries being different. You can safely ignore such error messages.

     

    sudo fdisk /dev/disk0

    Disk: /dev/disk0 geometry: 31130/255/63 [500118192 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>

    2: AC 1023 254  63 - 1023 254  63 [    409640 -  250392096] <Unknown ID>

    3: AB 1023 254  63 - 1023 254  63 [ 250801736 -    1269536] Darwin Boot

    *4: 07 1023 254  63 - 1023 254  63 [ 252071936 -  248045568] HPFS/QNX/AUX

  • by Loner T,

    Loner T Loner T Nov 8, 2014 5:26 AM in response to jjkeele
    Level 7 (24,202 points)
    Safari
    Nov 8, 2014 5:26 AM in response to jjkeele

    jjkeele wrote:

     

    I've taken the drive out and plugged it in separately on a PC.

    I suggest putting it back in the Mac once Testdisk finishes, because some of the changes that may be necessary to resurrect Windows require changes to the GPT and MBR and Windows can be fussy about hardware path changes for boot manager/loader. Please also look at PhotoRec while the scan is running. Testdisk has the ability to find files and copy them to external disks.

  • by jjkeele,

    jjkeele jjkeele Nov 10, 2014 12:20 AM in response to Loner T
    Level 1 (0 points)
    Nov 10, 2014 12:20 AM in response to Loner T

    Hi Loner T,

     

    The Testdisk scan just finished and here are the results:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

                                                                                                                                                                                                                                                                              Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63

                                                                                                                                                                                                                                                                              The harddisk (750 GB / 698 GiB) seems too small! (< 1300 GB / 1210 GiB)

    Check the harddisk size: HD jumpers settings, BIOS detection...

                                                                                                                                                                                                                                                                              The following partitions can't be recovered:

         Partition               Start        End    Size in sectors

    >  MS Data                978094912 2052367167 1074272256

       MS Data               1016634272 2090906527 1074272256

       MS Data               1041079520 2115351775 1074272256

       MS Data               1465145343 2539417598 1074272256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           [ Continue ]

    NTFS, blocksize=4096, 550 GB / 512 GiB

     

    Does this mean nothing is recoverable?

  • by jjkeele,

    jjkeele jjkeele Nov 10, 2014 12:22 AM in response to jjkeele
    Level 1 (0 points)
    Nov 10, 2014 12:22 AM in response to jjkeele

    Oh wait!  I pressed enter and now I have this screen:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

                                                                                                                                                                                                                                                                              Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63

         Partition               Start        End    Size in sectors

    >P EFI System                    40     409639     409600 [EFI]

    P Mac HFS                   409640  389660895  389251256

    D Mac HFS                389660896  390930431    1269536

    D MS Data                390873088 1465145343 1074272256

    D MS Data                392574081  402265937    9691857 [NO NAME]

    D MS Data                407107131  407113304       6174

    D MS Data                407113304  407119477       6174 [Boot]

    D MS Data                426526507  426547245      20739 [NO NAME]

    D MS Data                451358403  451364576       6174

    D MS Data                451364576  451370749       6174 [Boot]

    D MS Data                451364595  451370768       6174

    D MS Data                451370768  451376941       6174 [Boot]

    D MS Data                451370787  451376960       6174

    D MS Data                451376960  451383133       6174 [Boot]

    D MS Data                451383136  451386015       2880 [EFISECTOR]

    D MS Data                451386016  451388895       2880 [EFISECTOR]

    D MS Data                987425840  987437359      11520

    D MS Data               1028990352 1029001871      11520

    D MS Data               1244741696 1371684864  126943169

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

     

    Could one of these be the 550GB Bootcamp partition?!!

  • by Loner T,

    Loner T Loner T Nov 10, 2014 4:28 AM in response to jjkeele
    Level 7 (24,202 points)
    Safari
    Nov 10, 2014 4:28 AM in response to jjkeele

    From Testdisk

     

    D MS Data                390873088 1465145343 1074272256

     

    The last number that is size indicates a 530+ GiB chunk. This following is from your original GPT entries. The 1269536 bytes part contains some of the NTFS information as 1212192 bytes is the difference between GPT3 Start and Testdisk Start. If everything worked as intended, it should have been 1269536 bytes.

     

    389660896     1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

    390930432  1074216960      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

     

     

    Just a word of warning, some of the other posters with this situation are still unable to get their data out and it is a WIP. No promises that this will come back well.

     

    Do not use right/left cursor keys, which deletes partitions, but just up/down keys. Look in each MS Data entry for familiar Windows files. You should at least see a "System Volume Information" entry. The 6174 and 2880 entries are not useful, but you can look inside them.

     

     


  • by jjkeele,

    jjkeele jjkeele Nov 10, 2014 9:54 AM in response to Loner T
    Level 1 (0 points)
    Nov 10, 2014 9:54 AM in response to Loner T

    Hi Loner T,

     

    Understood!  No guarantees!  ;-)  I am a little confused though, where do I go from here?  Do I now need to set the partition start and end manually?  If so, do I use Testdisk or Gdisk?  Apologies for the novice questions here but as you probably guessed I have no idea what I am doing! 

     

    Kind regards

    James

  • by Loner T,

    Loner T Loner T Nov 10, 2014 10:20 AM in response to jjkeele
    Level 7 (24,202 points)
    Safari
    Nov 10, 2014 10:20 AM in response to jjkeele

    Your are going to delete GPT#3 and GPT#4 using Gdisk and create a new GPT#3. Here are the commands. After these changes, please reboot.

     

    After Reboot, verify that you can see a Bootcamp volume in Finder and see familiar files. Also verify that you can see the NTFS header using

     

    sudo dd if=/dev/rdisk0s3 count=1 2>/dev/null | hexdump -C

     

    sudo gdisk /dev/disk0

    p

    d

    3

    d

    4

    n

    3

    390873088

    1465145343

    0700

    p

    w

    y

  • by jjkeele,

    jjkeele jjkeele Nov 10, 2014 5:07 PM in response to Loner T
    Level 1 (0 points)
    Nov 10, 2014 5:07 PM in response to Loner T

    Still no sign of the NT4 partition header.  Is there a way I can search for it by string?

Page 1 of 3 last Next