RockingGarage

Q: Boot camp missing when update to Yosemite

Hi, I was update to Yosemite and didn't notice the Boot camp bug, is it possible to recover back my windows 7? Because I have important data inside...

Thanks

 

GPT output

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

      start       size  index  contents

          0          1         MBR

          1          1         Pri GPT header

          2         32         Pri GPT table

         34          6        

         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

     409640  488281248      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

  488690888    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

  489960424  232907800        

  722868224  253904896      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  976773120         15        

  976773135         32         Sec GPT table

  976773167          1         Sec GPT header

LunaSea:~ Sugizo$



Fdisk output


Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>

2: AC 1023 254  63 - 1023 254  63 [    409640 -  488281248] <Unknown ID>

3: AB 1023 254  63 - 1023 254  63 [ 488690888 -    1269536] Darwin Boot

4: 0C 1023 254  63 - 1023 254  63 [ 722868224 -  253904896] Win95 FAT32L

MacBook Pro (13-inch Mid 2012), OS X Yosemite (10.10)

Posted on Nov 12, 2014 6:06 AM

Close

Q: Boot camp missing when update to Yosemite

  • All replies
  • Helpful answers

Page 1 of 3 last Next
  • by Loner T,

    Loner T Loner T Nov 12, 2014 6:24 AM in response to RockingGarage
    Level 7 (24,202 points)
    Safari
    Nov 12, 2014 6:24 AM in response to RockingGarage

    You have been bitten by the Yosemite-Bootcamp bug. The large gap between GPT#3 and GPT#4 is your culprit.

     

    Please download Testdisk and GPT Fdisk and use Yosemite deleted my bootcamp as reference. If you have questions, please post back.

  • by RockingGarage,

    RockingGarage RockingGarage Nov 12, 2014 6:41 AM in response to Loner T
    Level 1 (0 points)
    Nov 12, 2014 6:41 AM in response to Loner T

    Hi Loner T,

     

    Thanks for your reply.

     

    I have download the Testdisk and GPT Fdisk, but I am new to Terminal, can you guide me step by step?

     

    Thanks.

  • by Loner T,

    Loner T Loner T Nov 12, 2014 7:04 AM in response to RockingGarage
    Level 7 (24,202 points)
    Safari
    Nov 12, 2014 7:04 AM in response to RockingGarage

    Start with Testdisk. Here is a step-by-step guide. http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

     

    You need to use the EFI partition and use Deeper Search to locate your 'lost partition'. You are looking for familiar Windows files in MS Data partitions including 'System Volume Information'.

     

    Once it is found, the GPT (GUID partition table) is manipulated to point to the correct partition location 9by deleting the current GPT#4 and creating a new one). A new Hybrid MBR is created using GPT Fdisk (gdisk) and then tested to make sure Windows can be resurrected.

  • by RockingGarage,

    RockingGarage RockingGarage Nov 12, 2014 7:08 PM in response to Loner T
    Level 1 (0 points)
    Nov 12, 2014 7:08 PM in response to Loner T

    Dear Loner T,

     

    Thanks for your help, I already run the testdisk, below is the result, what should I do next?

     

    Disk /dev/disk0 - 500 GB / 465 GiB - 976773168 sectors (RO)

         Partition               Start        End    Size in sectors

    >P DOS_FAT_32                    40     409639     409600 [EFI]

    P HFS                    488690888  489960423    1269536

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

    FAT32, blocksize=512, 209 MB / 200 MiB

  • by Loner T,

    Loner T Loner T Nov 12, 2014 7:25 PM in response to RockingGarage
    Level 7 (24,202 points)
    Safari
    Nov 12, 2014 7:25 PM in response to RockingGarage

    1. Do not use left/right cursor keys anywhere in Testdisk, because these change partition types among other things.

    2. Press Enter/Return to continue.

    3. You will get a list of MS Data partitions. The start/end/size will look very similar to your GPT output as shown in your original post.

    4. Look in each MS Data entry for familiar files. You may see some at the top level, but use the step-by-step by guide and run a deeper search, which will show you 'lost' MS Data partitions as well. These are the ones you should look into for familiar files.

  • by RockingGarage,

    RockingGarage RockingGarage Nov 13, 2014 2:52 AM in response to Loner T
    Level 1 (0 points)
    Nov 13, 2014 2:52 AM in response to Loner T

    Hi Loner T,

     

    I got this after press enter

     

    Disk /dev/disk0 - 500 GB / 465 GiB - 976773168 sectors (RO)

     

         Partition                  Start        End    Size in sectors

     

       P DOS_FAT_32                    40     409639     409600 [EFI]

       P HFS                    488690888  489960423    1269536

     

     

     

     

     

     

     

     

     

     

     

     

    [  Quit  ] >[Deeper Search]  [ Write  ]


    What should I do? Do I need to continue with "Deeper Search"?

  • by Loner T,

    Loner T Loner T Nov 13, 2014 3:51 AM in response to RockingGarage
    Level 7 (24,202 points)
    Safari
    Nov 13, 2014 3:51 AM in response to RockingGarage

    Yes, you need to continue with Deeper Search and look in each MS Data entry that it lists. If some of them say filesystem damaged, move to the next MS Data entry. Use 'P' to list files and check for familiar Windows files and 'System Volume Information'.

  • by RockingGarage,

    RockingGarage RockingGarage Nov 13, 2014 9:44 AM in response to Loner T
    Level 1 (0 points)
    Nov 13, 2014 9:44 AM in response to Loner T

    Hi Toner L,

     

    I hope I am doing it right, I got the result below

     

    Disk /dev/disk0 - 500 GB / 465 GiB - 976773168 sectors (RO)

         Partition               Start        End    Size in sectors

    P EFI System                    40     409639     409600 [EFI]

    D MS Data                  3149832  489961472  486811641

    D Mac HFS                488690888  489960423    1269536

    >D MS Data                489961472  976773112  486811641

    D MS Data                722868224  976773119  253904896

    D Mac HFS                975503592  976773127    1269536

     

    Only the second MS Data have the windows file as below

     

    MS Data                489961472  976773112  486811641

    Directory /

                                                       Previous

    dr-xr-xr-x     0     0         0 18-Oct-2014 10:42 Boot

    dr-xr-xr-x     0     0         0 16-Oct-2014 22:08 Config.Msi

    dr-xr-xr-x     0     0         0 19-May-2014 22:16 DirectX End user

    dr-xr-xr-x     0     0         0 20-Jan-2014 11:21 Intel

    dr-xr-xr-x     0     0         0 19-May-2014 23:27 MSOCache

    dr-xr-xr-x     0     0         0 14-Jul-2009 11:20 PerfLogs

    dr-xr-xr-x     0     0         0  4-Oct-2014 22:49 Program Files

    dr-xr-xr-x     0     0         0  1-Nov-2014 06:45 Program Files (x86)

    dr-xr-xr-x     0     0         0  1-Nov-2014 06:46 ProgramData

    dr-xr-xr-x     0     0         0 31-Mar-2014 00:46 QvodPlayer

    dr-xr-xr-x     0     0         0 20-Jan-2014 11:15 Recovery

    >dr-xr-xr-x     0     0         0 17-Oct-2014 20:17 System Volume Information

    dr-xr-xr-x     0     0         0  1-Nov-2014 06:47 Users

    dr-xr-xr-x     0     0         0  1-Nov-2014 06:45 Windows

     

    So what is the next step?

  • by Loner T,Solvedanswer

    Loner T Loner T Nov 13, 2014 9:56 AM in response to RockingGarage
    Level 7 (24,202 points)
    Safari
    Nov 13, 2014 9:56 AM in response to RockingGarage

    Based on what you have posted...

     

    GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartByte OffsetNTFS SizeNTFS End
    48869088812695364899604244899614721048486811641976773113

     

    Please use the following steps and test.



    1. Delete the old entry and create a new entry at GPT#4.

     

    sudo gdisk /dev/disk0

    p

    d

    4

    n

    4

    489961472

    976773112

    0700

    p

    w

    y

     

    Here is an example of the delete/new...

     

    Command (? for help): d

    Partition number (1-4): 4

     

    Command (? for help): n

    Partition number (4-128, default 4): 4

    First sector (34-1954210086, default = 1454210080) or {+-}size{KMGTP}: 1454211072

    Last sector (1454211072-1954210086, default = 1954210086) or {+-}size{KMGTP}: 1954209791

    Current type is 'Apple HFS/HFS+'

    Hex code or GUID (L to show codes, Enter = AF00): 0700

    Changed type of partition to 'Microsoft basic data'

     

    Command (? for help): p

    Disk /dev/disk0: 1954210120 sectors, 931.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): 6ED0C429-00D1-4759-B50E-04B6FB80D0E3

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 1954210086

    Partitions will be aligned on 8-sector boundaries

    Total free space is 1293 sectors (646.5 KiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EFI System Partition

       2          409640      1452940543   692.6 GiB   AF00  Customer

       3      1452940544      1454210079   619.9 MiB   AB00  Recovery HD

       4      1454211072      1954209791   238.4 GiB   0700  Microsoft basic data



    2. This is a tedious process and you want to check after the second 'p'rint command that it looks reasonable, before the 'w'rite and 'y'es to confirm.

     

    3. You will need to reboot after the change, because the disk you are booted from is the one being modified. Reboot will rebuild disk0s4 using the start/end you entered.

     

    4. Run the dd command - sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C and check that the first line contains "R.NTFS".

     

    5. Once you have a working GPT#4, a new hybrid MBR needs to be created which will overwrite what you see in your Fdisk output. This is also done using GPT Fdisk (Gdisk). Your numbers will look different than what are in the following example. In most cases, you will use the default except entry 4, which should have a 'y' for bootable flag.

     

    sudo gdisk /dev/disk0

    GPT fdisk (gdisk) version 0.8.10

     

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Partition table scan:

      MBR: hybrid

      BSD: not present

      APM: not present

      GPT: present

     

    Found valid GPT with hybrid MBR; using GPT.

     

    Command (? for help): p

    Disk /dev/disk0: 490234752 sectors, 233.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): 59BDFEEB-1EB4-4529-94FE-3CBC2C3CD513

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 490234718

    Partitions will be aligned on 8-sector boundaries

    Total free space is 2604 sectors (1.3 MiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EF

       2          409640       401060383   191.0 GiB   AF05  Macintosh HD

       3       401060384       402329919   619.9 MiB   AB00  Re

       4       402331648       490233848   41.9 GiB    0700  Microsoft basic data

     

    Command (? for help): r

     

    Recovery/transformation command (? for help): h

     

    WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

    just hit the Enter key at the below prompt and your MBR partition table will

    be untouched.

     

    Type from one to three GPT partition numbers, separated by spaces, to be

    added to the hybrid MBR, in sequence: 2 3 4

    Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y

     

    Creating entry for GPT partition #2 (MBR partition #2)

    Enter an MBR hex code (default AF): AF

    Set the bootable flag? (Y/N): n

     

    Creating entry for GPT partition #3 (MBR partition #3)

    Enter an MBR hex code (default AB): AB

    Set the bootable flag? (Y/N): n

     

    Creating entry for GPT partition #4 (MBR partition #4)

    Enter an MBR hex code (default 07): 07

    Set the bootable flag? (Y/N): y

     

    Recovery/transformation command (? for help): w

     

    Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

    PARTITIONS!!

     

    Do you want to proceed? (Y/N): y

    OK; writing new GUID partition table (GPT) to /dev/disk0.

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Warning: The kernel may continue to use old or deleted partitions.

    You should reboot or remove the drive.

    The operation has completed successfully.

     

    Reboot after this step.

     

    6. a. Test 1 - Can you see your Bootcamp volume in Finder.

        b. Test 2 - Can you files in the Bootcamp volume?

        c. Test 3 - Can you see Bootcamp in your System Preferences -> Startup Disk.

        d. Test 4 - If Test 1-3 are successful, select Bootcamp and click on Restart. You may need Windows startup repair, if you see a hanging underline cursor at the top left corner of your screen. In most cases, it is not required.

  • by RockingGarage,

    RockingGarage RockingGarage Nov 13, 2014 9:56 AM in response to Loner T
    Level 1 (0 points)
    Nov 13, 2014 9:56 AM in response to Loner T

    So I can close the testdisk and open terminal?

  • by Loner T,

    Loner T Loner T Nov 13, 2014 9:58 AM in response to RockingGarage
    Level 7 (24,202 points)
    Safari
    Nov 13, 2014 9:58 AM in response to RockingGarage

    Leave Testdisk open and open another Terminal window for changes. I updated the top table. You can quit Testdisk after it so you have the start/end/size handy.

  • by RockingGarage,

    RockingGarage RockingGarage Nov 13, 2014 10:19 AM in response to Loner T
    Level 1 (0 points)
    Nov 13, 2014 10:19 AM in response to Loner T

    Hi,

    6. a. Test 1 - Can you see your Bootcamp volume in Finder. (YES)

        b. Test 2 - Can you files in the Bootcamp volume? (YES)

        c. Test 3 - Can you see Bootcamp in your System Preferences -> Startup Disk. (NO)

     

    How?

  • by Loner T,

    Loner T Loner T Nov 13, 2014 10:37 AM in response to RockingGarage
    Level 7 (24,202 points)
    Safari
    Nov 13, 2014 10:37 AM in response to RockingGarage

    Can you post the output of

     

    sudo gpt -vv -r show /dev/disk0

    sudo fdisk /dev/disk0

    sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

  • by RockingGarage,

    RockingGarage RockingGarage Nov 13, 2014 3:07 PM in response to Loner T
    Level 1 (0 points)
    Nov 13, 2014 3:07 PM in response to Loner T

    LunaSea:~ Sugizo$ sudo gpt -vv -r show /dev/disk0

    Password:

    gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

    gpt show: /dev/disk0: Suspicious MBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 976773167

          start       size  index  contents

              0          1         MBR

              1          1         Pri GPT header

              2         32         Pri GPT table

             34          6        

             40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

         409640  488281248      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

      488690888    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

      489960424       1048        

      489961472  486811641      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      976773113         22        

      976773135         32         Sec GPT table

      976773167          1         Sec GPT header




    LunaSea:~ Sugizo$ sudo fdisk /dev/disk0

    Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE    0   0   2 -   25 127  14 [         1 -     409639] <Unknown ID>

    2: AF   25 127  15 - 1023 254  63 [    409640 -  488281248] HFS+       

    3: AB 1023 254  63 - 1023 254  63 [ 488690888 -    1269536] Darwin Boot

    *4: 07 1023 254  63 - 1023 254  63 [ 489961472 -  486811641] HPFS/QNX/AUX



    LunaSea:~ Sugizo$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null|hexdump -C

    00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|

    00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 38 34 1d  |........?....84.|

    00000020  00 00 00 00 80 00 80 00  f8 27 04 1d 00 00 00 00  |.........'......|

    00000030  45 07 00 00 00 00 00 00  44 07 00 00 00 00 00 00  |E.......D.......|

    00000040  f6 00 00 00 01 00 00 00  00 6d 7c 9d 73 1b cf 01  |.........m|.s...|

    00000050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|

    00000060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|

    00000070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|

    00000080  55 aa 75 06 f7 c1 01 00  75 03 e9 dd 00 1e 83 ec  |U.u.....u.......|

    00000090  18 68 1a 00 b4 48 8a 16  0e 00 8b f4 16 1f cd 13  |.h...H..........|

    000000a0  9f 83 c4 18 9e 58 1f 72  e1 3b 06 0b 00 75 db a3  |.....X.r.;...u..|

    000000b0  0f 00 c1 2e 0f 00 04 1e  5a 33 db b9 00 20 2b c8  |........Z3... +.|

    000000c0  66 ff 06 11 00 03 16 0f  00 8e c2 ff 06 16 00 e8  |f...............|

    000000d0  4b 00 2b c8 77 ef 0e 68  30 10 cb 66 23 c0 75 2d  |K.+.w..h0..f#.u-|

    000000e0  66 81 fb 54 43 50 41 75  24 81 f9 02 01 72 1e 16  |f..TCPAu$....r..|

    000000f0  68 07 bb 16 68 70 0e 16  68 09 00 66 53 66 53 66  |h...hp..h..fSfSf|

    00000100  55 16 16 16 68 b8 01 66  61 0e 07 cd 1a 33 c0 bf  |U...h..fa....3..|

    00000110  28 10 b9 d8 0f fc f3 aa  e9 5f 01 90 90 66 60 1e  |(........_...f`.|

    00000120  06 66 a1 11 00 66 03 06  1c 00 1e 66 68 00 00 00  |.f...f.....fh...|

    00000130  00 66 50 06 53 68 01 00  68 10 00 b4 42 8a 16 0e  |.fP.Sh..h...B...|

    00000140  00 16 1f 8b f4 cd 13 66  59 5b 5a 66 59 66 59 1f  |.......fY[ZfYfY.|

    00000150  0f 82 16 00 66 ff 06 11  00 03 16 0f 00 8e c2 ff  |....f...........|

    00000160  0e 16 00 75 bc 07 1f 66  61 c3 a0 f8 01 e8 09 00  |...u...fa.......|

    00000170  a0 fb 01 e8 03 00 f4 eb  fd b4 01 8b f0 ac 3c 00  |..............<.|

    00000180  74 09 b4 0e bb 07 00 cd  10 eb f2 c3 0d 0a 41 20  |t.............A |

    00000190  64 69 73 6b 20 72 65 61  64 20 65 72 72 6f 72 20  |disk read error |

    000001a0  6f 63 63 75 72 72 65 64  00 0d 0a 42 4f 4f 54 4d  |occurred...BOOTM|

    000001b0  47 52 20 69 73 20 6d 69  73 73 69 6e 67 00 0d 0a  |GR is missing...|

    000001c0  42 4f 4f 54 4d 47 52 20  69 73 20 63 6f 6d 70 72  |BOOTMGR is compr|

    000001d0  65 73 73 65 64 00 0d 0a  50 72 65 73 73 20 43 74  |essed...Press Ct|

    000001e0  72 6c 2b 41 6c 74 2b 44  65 6c 20 74 6f 20 72 65  |rl+Alt+Del to re|

    000001f0  73 74 61 72 74 0d 0a 00  8c a9 be d6 00 00 55 aa  |start.........U.|

    00000200

Page 1 of 3 last Next