dwilson00

Q: Missing Bootcamp Partition (with pastes!)

Ok, here's another one of these horrible Yosemite upgrade disasters.

 

I did my best to learn from the other threads and get started on my own trying to recover this, but I'm in over my head. I would appreciate any help that could be thrown my way.

 

First: diskutil list

Mac:~ dwilson$ diskutil list

/dev/disk0

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *1.0 TB     disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:                  Apple_HFS Macintosh HD            740.0 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:       Microsoft Basic Data                         107.6 GB   disk0s4

 

Then: diskutil cs list

iMac:~ dwilson$ diskutil cs list

No CoreStorage logical volume groups found

 

Then the hexdump:

 

iMac:~ dwilson$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000  a0 e0 28 3c 06 03 11 ad  2d 94 00 a8 18 01 c0 7d  |..(<....-......}|

00000010  13 42 47 80 aa 27 bc 20  22 fe a6 00 a0 10 01 00  |.BG..'. ".......|

00000020  de 20 01 bc 06 01 4e 94  c1 81 10 01 00 80 05 f1  |. ....N.........|

00000030  a4 2d 94 ab de 7a 5a fc  15 04 31 b5 4e 9c 0a 8b  |.-...zZ...1.N...|

00000040  ed 2b be 06 28 2e 28 bc  de 7f 35 ad a9 29 27 bc  |.+..(.(...5..)'.|

00000050  61 7c 35 01 27 26 be f4  fe 07 10 ad 5d 35 0b 10  |a|5.'&......]5..|

00000060  01 40 0a 03 f0 ac c9 93  80 e8 10 01 c0 3f 04 cf  |.@...........?..|

00000070  ac 48 7b 57 7a 96 27 3c  26 22 ff 64 97 09 08 29  |.H{Wz.'<&".d...)|

00000080  7c 0a 02 6e 9c 03 2b a7  27 fc 3f 1a 03 29 50 50  ||..n..+.'.?..)PP|

00000090  52 10 01 00 e0 7c ed 29  fc 19 7c f9 5c fd 27 bc  |R....|.)..|.\.'.|

000000a0  35 7d 95 aa 2e 7c 1e 29  3c 79 7e 03 ff ff 28 fc  |5}...|.)<y~...(.|

000000b0  52 7d e9 bf 2d 7c 1f 2f  3c 20 29 3c 01 7c 05 2f  |R}..-|./< )<.|./|

000000c0  7d 1f af 10 01 c0 9a 7c  11 2a bc 14 2e 3c 00 bc  |}......|.*...<..|

000000d0  0f 10 02 c0 98 2d bc 1d  dc 0b 27 fc 5a 9c 05 29  |.....-....'.Z..)|

000000e0  7c 21 7c 01 2e be 1d bf  ea 2c bc 40 2a 7c 02 7d  ||!|......,.@*|.}|

000000f0  05 ff 3d 7e 1f af fa 28  fc 3d bc 05 38 7c 02 dc  |..=~...(.=..8|..|

00000100  03 17 80 1d bd 01 7f 28  3c 00 01 53 63 4b ea 29  |.......(<..ScK.)|

00000110  3c 1b 22 3c 5a 2a fc bd  23 bc 3e 29 3f 39 64 63  |<."<Z*..#.>)?9dc|

00000120  83 2b 3c 7f 7d 03 df 29  fc 00 7f d9 55 57 57 27  |.+<.}..)....UWW'|

00000130  3c 04 7d f9 a8 2d fc 1f  01 fe 7e 5e 5e fc d1 01  |<.}..-....~^^...|

00000140  44 4b 43 4b 5c 1f 25 34  2c 03 00 00 43 4b 23 43  |DKCK\.%4,...CK#C|

00000150  22 fc 70 06 22 00 49 90  e4 49 92 24 43 5c ff 00  |".p.".I..I.$C\..|

00000160  35 7a fa fe 7e fc 01 00  20 00 05 90 01 e3 5b 61  |5z..~... .....[a|

00000170  2a 2b 2f 2f b7 ff e0 00  00 40 00 a4 05 03 5c 02  |*+//.....@....\.|

00000180  3b a8 fa b7 35 fe 49 4b  25 00 00 00 00 44 64 a4  |;...5.IK%....Dd.|

00000190  4b b5 09 00 00 ff 01 00  00 60 80 0e 38 45 64 c4  |K........`..8Ed.|

000001a0  53 e0 e0 f0 f6 7d 00 48  22 3c 80 04 24 05 5c c4  |S....}.H"<..$.\.|

000001b0  53 5f 5f 28 7c 02 22 3c  40 2a fc 22 7d 01 bf 29  |S__(|."<@*."}..)|

000001c0  3e 03 c3 53 1a 43 ca ea  aa 11 23 fe 20 12 24 7e  |>..S.C....#. .$~|

000001d0  01 aa aa 10 01 40 00 7c  ff 2a bc 00 7e ff ff ff  |.....@.|.*..~...|

000001e0  28 7c 84 22 fe 2b fe fe  18 01 40 de 22 3c 20 2a  |(|.".+....@."< *|

000001f0  7c 40 22 bd 47 d7 27 34  34 22 7f 64 64 4b ea 29  ||@".G.'44".ddK.)|

00000200

 

Now. It's my understanding at this point that there is no NTFS header. I ran testdisk and here's what it found.

 

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

     Partition               Start        End    Size in sectors

>P EFI System                    40     409639     409600 [EFI]

D Mac HFS                   409640 1445749127 1445339488

D MS Data                940517384 1447020544  506503161

D Mac HFS               1445749128 1447018671    1269544

D MS Data               1447020544 1953523704  506503161

D MS Data               1743407104 1953523711  210116608

 

That's as far as I am able to on my own. Can someone more educated carry me the rest of the way? I'd really appreciate any help that is available.

iMac (21.5-inch Mid 2010), OS X Yosemite (10.10.1)

Posted on Nov 22, 2014 12:14 PM

Close

Q: Missing Bootcamp Partition (with pastes!)

  • All replies
  • Helpful answers

Page 1 Next
  • by Loner T,

    Loner T Loner T Nov 22, 2014 4:40 PM in response to dwilson00
    Level 7 (24,419 points)
    Safari
    Nov 22, 2014 4:40 PM in response to dwilson00

    Please post the output of

     

    sudo gpt -vv -r show /dev/disk0

    sudo fdisk /dev/disk0

  • by dwilson00,

    dwilson00 dwilson00 Nov 23, 2014 7:55 AM in response to Loner T
    Level 1 (0 points)
    Nov 23, 2014 7:55 AM in response to Loner T

    Thanks for responding. Here's what I got.

     

    sudo gpt -vv -r show /dev/disk0

    iMac:testdisk-7.0-WIP dwilson$ sudo gpt -vv -r show /dev/disk0

    Password:

    gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

    gpt show: /dev/disk0: Suspicious MBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 1953525167

           start        size  index  contents

               0           1         MBR

               1           1         Pri GPT header

               2          32         Pri GPT table

              34           6        

              40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

          409640  1445339488      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

      1445749128     1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

      1447018672   296388432        

      1743407104   210116608      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      1953523712        1423        

      1953525135          32         Sec GPT table

      1953525167           1         Sec GPT header


    sudo fdisk /dev/disk0

    iMac:testdisk-7.0-WIP dwilson$ sudo fdisk /dev/disk0

    Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>

    2: AF 1023 254  63 - 1023 254  63 [    409640 - 1445339488] HFS+       

    3: AB 1023 254  63 - 1023 254  63 [1445749128 -    1269544] Darwin Boot

    4: 0C 1023 254  63 - 1023 254  63 [1743407104 -  210116608] Win95 FAT32L

  • by Loner T,

    Loner T Loner T Nov 23, 2014 10:31 AM in response to dwilson00
    Level 7 (24,419 points)
    Safari
    Nov 23, 2014 10:31 AM in response to dwilson00

    This is a Yosemite bug. The large gap between GPT#3 and GPT#4 indicates a 'lost' NTFS header in that gap. Was windows or OSX resized at any point after the initial installation and before the Yosemite upgrade?

     

    Can you follow the steps in Bootcamp partition has disappeared after upgrade to Yosemite 10.10? If you need any help with specifics or have questions let me know.

  • by dwilson00,

    dwilson00 dwilson00 Nov 24, 2014 7:33 AM in response to Loner T
    Level 1 (0 points)
    Nov 24, 2014 7:33 AM in response to Loner T

    This is a Yosemite bug. The large gap between GPT#3 and GPT#4 indicates a 'lost' NTFS header in that gap. Was windows or OSX resized at any point after the initial installation and before the Yosemite upgrade?

    Yeah. I underestimated my needs when I created the original bootcamp partition and resized it and the OSX partition at some point.

     

    Can you follow the steps in Bootcamp partition has disappeared after upgrade to Yosemite 10.10? If you need any help with specifics or have questions let me know.

    That's the document I was originally trying to follow. Am I correct that my next step would be to do the deep scan?

  • by Loner T,

    Loner T Loner T Nov 24, 2014 8:08 AM in response to dwilson00
    Level 7 (24,419 points)
    Safari
    Nov 24, 2014 8:08 AM in response to dwilson00

    Yes, you need to use Testdisk and run a Deeper Scan to find your 'lost' NTFS partition.

  • by dwilson00,

    dwilson00 dwilson00 Nov 25, 2014 7:25 AM in response to Loner T
    Level 1 (0 points)
    Nov 25, 2014 7:25 AM in response to Loner T

    Okay. Here's what I got from the Testdisk Deeper Scan.

     

    Disk /dev/disk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

     

    The harddisk (1000 GB / 931 GiB) seems too small! (< 1640 GB / 1527 GiB)

    Check the harddisk size: HD jumpers settings, BIOS detection...

     

    The following partitions can't be recovered:

         Partition               Start        End    Size in sectors

    >  Mac HFS               1445749124 2891088611 1445339488

       Mac HFS               1534815006 3204213395 1669398390 [D$^D~KU ~I^T$ ~_

       MS Data               1953523704 2460026864  506503161

       MS Data               1953523711 2163640318  210116608

     

     

    D MS Data               1542307720 1542313893       6174 [Boot]

    D MS Data               1542418155 1542424328       6174

    >D MS Data               1542424328 1542430501       6174 [Boot]

     

    The first one labelled "Boot" contains the system volume information file.

  • by Loner T,Helpful

    Loner T Loner T Nov 25, 2014 7:49 AM in response to dwilson00
    Level 7 (24,419 points)
    Safari
    Nov 25, 2014 7:49 AM in response to dwilson00

    The BOOT is too small for a NTFS file system and does not match the size of 107GB that diskutil list shows. The following two are close to 1953525168 which is the size of your disk, but should be checked. These are most likely damaged.

     

    MS Data               1953523704 2460026864  506503161

    MS Data               1953523711 2163640318  210116608

     

    Most likely NTFS 'lost' partition should be in the following gap.

    1447018672   296388432

     

    The combined size of the following gap and GPT4 is about 250Gb, which also adds up to 740+250 GB = 990Gb which the size of your 1TB disk.

    1447018672   296388432        

    1743407104   210116608      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  • by dwilson00,

    dwilson00 dwilson00 Nov 26, 2014 7:43 AM in response to Loner T
    Level 1 (0 points)
    Nov 26, 2014 7:43 AM in response to Loner T

    The BOOT is too small for a NTFS file system and does not match the size of 107GB that diskutil list shows. The following two are close to 1953525168 which is the size of your disk, but should be checked. These are most likely damaged.

    How do I go about checking those, and what is my next step then?

  • by Loner T,Helpful

    Loner T Loner T Nov 26, 2014 8:06 AM in response to dwilson00
    Level 7 (24,419 points)
    Safari
    Nov 26, 2014 8:06 AM in response to dwilson00

    Use up/down arrow keys (do not use left/right arrow keys, because these will delete your partitions or modify them) and scroll down to each individual MS Data entry and use 'P' to list files in each of them. You can post the output for each of these.

  • by dwilson00,

    dwilson00 dwilson00 Nov 26, 2014 9:33 AM in response to Loner T
    Level 1 (0 points)
    Nov 26, 2014 9:33 AM in response to Loner T

    Okay, I think I found what we're looking for.

     

    ttp://www.cgsecurity.org

         MS Data               1447020544 1953523704  506503161

    Directory /

                                                       Previous

    dr-xr-xr-x     0     0         0 19-Nov-2014 03:01 ..

    dr-xr-xr-x     0     0         0 28-Apr-2013 17:56 $Recycle.Bin

    dr-xr-xr-x     0     0         0 20-Jan-2014 16:37 AMD

    dr-xr-xr-x     0     0         0 25-Aug-2013 17:43 ArcTemp

    dr-xr-xr-x     0     0         0 28-Apr-2013 18:39 Boot

    dr-xr-xr-x     0     0         0 29-Apr-2013 07:08 Intel

    dr-xr-xr-x     0     0         0 28-Apr-2013 17:49 MSOCache

    dr-xr-xr-x     0     0         0 13-Jul-2009 22:20 PerfLogs

    dr-xr-xr-x     0     0         0 10-Nov-2014 15:20 Program Files

    dr-xr-xr-x     0     0         0 12-Nov-2014 18:41 Program Files (x86)

    dr-xr-xr-x     0     0         0  2-Nov-2014 18:39 ProgramData

    dr-xr-xr-x     0     0         0 28-Apr-2013 17:47 Recovery

    dr-xr-xr-x     0     0         0 29-Apr-2013 17:42 Riot Games

    >dr-xr-xr-x     0     0         0 20-Jul-2013 18:57 System Volume Information

     

    While I had it open I went through and copied over the few files I didn't have an existing backup for. So the worst case scenario is have to spend a day off nuking and starting over.

     

    I mean look at this:

     

    Disk /dev/disk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

         Partition               Start        End    Size in sectors

    D MS Data               1447020544 1953523704  506503161

    >D MS Data               1449671610 1459363466    9691857 [NO NAME]

    D Mac HFS               1449793540 1458182149    8388610 [    D^A]

    D MS Data               1456557928 1456560807       2880 [EFISECTOR]

    D MS Data               1458071584 1458074463       2880 [EFISECTOR]

    D MS Data               1459169704 1459177777       8074 [GParted-EFI]

    D MS Data               1466775491 1466796229      20739 [NO NAME]

    D MS Data               1530456721 1531828704    1371984 [GW  ث݊  b~^dS

    D MS Data               1530456722 1531828705    1371984 [GW  ث݊  b~^dS

    D MS Data               1542301547 1542307720       6174

    D MS Data               1542307720 1542313893       6174 [Boot]

    D MS Data               1542418155 1542424328       6174

     

    The output for my deep scan is an absolute mess compared to everyone else's. I'd still rather recover (for now) and do a full format when it's not holiday season and I can use some vacation time.

  • by Loner T,Solvedanswer

    Loner T Loner T Nov 26, 2014 9:54 AM in response to dwilson00
    Level 7 (24,419 points)
    Safari
    Nov 26, 2014 9:54 AM in response to dwilson00

    The first entry you posted is the correct one. Glad to see you found it. I have this table to make sure no existing partitions are lost.

     

    GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartByte OffsetNTFS SizeNTFS End
    144574912812695441447018672144702054418725065031611953523705

     

    The 'Byte Offset' being positive is good. A negative value means you lose GPT#3. The NTFS size is roughly 250GB which is good.

     

    You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message.

     

    Rebuild using start/end offsets from Testdisk DeepSearch using GPT Fdisk (http://sourceforge.net/projects/gptfdisk/)

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4   (part 4)
    7. 1447020544 - Start offset in bytes  (start point for Bootcamp part)
    8. +506503161 (Size offset as opposed to End offset)
    9. 0700     (Windows part type)
    10. P           (print list of all parts just to see what changes will be made)
    11. W         (Write the new GPT)
    12. Y           (Yes! really write the new GPT)

     

      This will delete and re-write the GPT partition info for /dev/disk0s4. 


    Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR

    1. Sudo gdisk /dev/disk0
    2. P  (Print list of parts)
    3. R   (Recover)
    4. H (chooses Hybrid)
    5. Partitions numbers to be hybridized: 2 3 4
    6. Y (Good for GRUB question)
    7. N (part 2 flag)
    8. N (part 3 flag)
    9. Y  (part 4 flag make bootable partition)
    10. W  (Write the new MBR)
    11. Y    (Yes! write the new MBR)
    12. Reboot


    Test 1 - Does Bootcamp Volume show up in Finder?

    Test 2 - Can you files in Bootcamp Volume?

    Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

    Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.


    If you see a hanging underline cursor at the top left on a black screen, and it does not proceed further, you may need Windows Startup Repair or a tool called EasyBCD.

  • by dwilson00,

    dwilson00 dwilson00 Nov 26, 2014 10:37 PM in response to Loner T
    Level 1 (0 points)
    Nov 26, 2014 10:37 PM in response to Loner T

    It worked!

     

    Everything is seemingly back as it should be. Thank you so much for your help. There's no way I would have figured that all out on my own.

  • by Loner T,

    Loner T Loner T Nov 27, 2014 6:40 AM in response to dwilson00
    Level 7 (24,419 points)
    Safari
    Nov 27, 2014 6:40 AM in response to dwilson00

    Very nicely done! Please back up your OSX and Windows installations.

  • by jochems,

    jochems jochems Mar 17, 2015 2:43 AM in response to Loner T
    Level 1 (0 points)
    Mar 17, 2015 2:43 AM in response to Loner T

    Hi, thanks for the help! My Windows partition is back after following these steps, but I'm getting a error when trying to boot it.

     

    "a disk read error occurred"

     

    When I'm trying to access it in Disk Utility it is still grayed out.

     

    Any idea what to do next? Thanks

Page 1 Next