iyune

Q: Windows BootCamp Partition gone after Yosemite Upgrade

Hi Loner T,


Here is the output for the commands you request to users to assist them in recovering the windows partition in bootcamp after installing Yosemite.


I hope you can help me,


Thanks in advance,


IsaacMBPro-2:~ isaaciyune$ diskutil list

/dev/disk0

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *320.1 GB   disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:          Apple_CoreStorage                         235.2 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:       Microsoft Basic Data                         84.0 GB    disk0s4

/dev/disk1

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:                  Apple_HFS Macintosh HD           *234.8 GB   disk1

                                 Logical Volume on disk0s2

                                 FB9119F6-5472-4B02-BBAF-ABEFB1488757

                                 Unencrypted

/dev/disk3

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *511.0 GB   disk3

   1:                        EFI EFI                     209.7 MB   disk3s1

   2:                  Apple_HFS Time Machine Backups    510.7 GB   disk3s2

IsaacMBPro-2:~ isaaciyune$ diskutil cs list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group E939C1EE-98B6-4A99-A793-2C0254847EE3

    =========================================================

    Name:         Macintosh HD

    Status:       Online

    Size:         235209998336 B (235.2 GB)

    Free Space:   18989056 B (19.0 MB)

    |

    +-< Physical Volume 91BF8AC7-605D-415B-A7FC-456A8EF35E32

    |   ----------------------------------------------------

    |   Index:    0

    |   Disk:     disk0s2

    |   Status:   Online

    |   Size:     235209998336 B (235.2 GB)

    |

    +-> Logical Volume Family 965EB12D-166F-4807-A408-A41CC1DE2418

        ----------------------------------------------------------

        Encryption Status:       Unlocked

        Encryption Type:         AES-XTS

        Conversion Status:       Converting

        Conversion Direction:    backward

        Has Encrypted Extents:   Yes

        Fully Secure:            No

        Passphrase Required:     No

        |

        +-> Logical Volume FB9119F6-5472-4B02-BBAF-ABEFB1488757

            ---------------------------------------------------

            Disk:                  disk1

            Status:                Online

            Size (Total):          234838687744 B (234.8 GB)

            Conversion Progress:   37%

            Revertible:            Yes (unlock and decryption required)

            LV Name:               Macintosh HD

            Volume Name:           Macintosh HD

            Content Hint:          Apple_HFS

IsaacMBPro-2:~ isaaciyune$ sudo gpt -vv -r show /dev/disk0

Password:

Sorry, try again.

Password:

gpt show: /dev/disk0: mediasize=320072933376; sectorsize=512; blocks=625142448

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 625142447

      start       size  index  contents

          0          1         MBR

          1          1         Pri GPT header

          2         32         Pri GPT table

         34          6        

         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

     409640  459394528      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

  459804168    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

  461073704  164068057      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  625141761        654        

  625142415         32         Sec GPT table

  625142447          1         Sec GPT header

MacBook Pro (13-inch Early 2011), OS X Yosemite (10.10.1)

Posted on Nov 24, 2014 1:46 PM

Close

Q: Windows BootCamp Partition gone after Yosemite Upgrade

  • All replies
  • Helpful answers

  • by Loner T,

    Loner T Loner T Nov 24, 2014 1:54 PM in response to iyune
    Level 7 (24,419 points)
    Safari
    Nov 24, 2014 1:54 PM in response to iyune

    1. Was any resizing of the Bootcamp partition done between the time Windows was initially installed and the Yosemite upgrade?

    2. Please post the output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C to check the current NTFS header.

  • by iyune,

    iyune iyune Nov 24, 2014 1:56 PM in response to Loner T
    Level 1 (0 points)
    Nov 24, 2014 1:56 PM in response to Loner T

    Hi Loner T,

     

    Yes I did add more storage to the windows partition after being created,

     

    Here is the outcome for the command:

     

    IsaacMBPro-2:~ isaaciyune$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

    Password:

    00000000  c2 c0 5e d9 19 0f 65 3e  a8 7f 8c 6a c9 4b 99 6a  |..^...e>...j.K.j|

    00000010  c4 ae 25 39 3b d6 14 d5  b0 21 fd 69 c6 bc bc 04  |..%9;....!.i....|

    00000020  b4 46 78 b5 ee d5 bc ab  d2 20 dd 5d ec 1e 70 7c  |.Fx...... .]..p||

    00000030  0e 3f e7 ac 8e 24 91 d2  08 bb cf 92 74 74 87 c7  |.?...$......tt..|

    00000040  65 9a a7 75 e7 ae 51 74  65 24 0e d0 d0 1f b4 76  |e..u..Qte$.....v|

    00000050  7e 18 ff ba 85 0b 7e 5e  14 1c e8 c3 16 bd 8b 1e  |~.....~^........|

    00000060  66 c1 57 30 8f c1 a8 cc  6b 64 2a 37 29 21 37 21  |f.W0....kd*7)!7!|

    00000070  4f e4 65 64 da e0 a8 59  30 4a 00 82 ae 55 33 31  |O.ed...Y0J...U31|

    00000080  59 9d d3 75 9a e7 90 54  22 67 21 d7 a2 ce 22 bb  |Y..u...T"g!...".|

    00000090  57 d5 08 a4 15 02 43 1c  88 e8 9e 3d 2f f7 f3 3d  |W.....C....=/..=|

    000000a0  f0 67 df 04 d2 50 8f 0d  8f 93 cc 7f 46 75 31 9a  |.g...P......Fu1.|

    000000b0  cf 8d 2d f1 cf ee ac f2  6f c0 03 d9 32 a7 58 d0  |..-.....o...2.X.|

    000000c0  7a 68 3b 8b a1 12 f1 f3  c5 f4 f0 55 2b 9e 94 05  |zh;........U+...|

    000000d0  bf 5e db cb 5a 60 6c b9  bf d8 05 26 05 04 84 42  |.^..Z`l....&...B|

    000000e0  4b a0 14 ef d1 34 26 79  5b 49 a3 29 53 81 44 60  |K....4&y[I.)S.D`|

    000000f0  38 c0 2f fb 82 b8 b8 b0  52 63 a4 15 80 67 6c 22  |8./.....Rc...gl"|

    00000100  27 0d 3f d6 b8 8b c4 76  43 1a d7 40 ea 24 b8 5b  |'.?....vC..@.$.[|

    00000110  ef ba 01 35 ee 51 85 b3  b3 d4 5e 18 e8 6d 69 65  |...5.Q....^..mie|

    00000120  fe 11 f7 56 7a 4d 7b 9c  fa 98 40 6b 04 77 76 df  |...VzM{...@k.wv.|

    00000130  9c ff a9 f2 e7 3d f5 5e  26 ce 5a 40 d1 6f e7 61  |.....=.^&.Z@.o.a|

    00000140  4b c7 53 87 80 0e d5 31  ec 88 88 fd 5a 5c d1 2b  |K.S....1....Z\.+|

    00000150  ee b8 b4 b0 6d 12 d3 01  a8 43 3f d8 a1 f6 29 9f  |....m....C?...).|

    00000160  0c 34 c3 f9 b7 cf df 7d  17 57 48 b6 98 f1 73 04  |.4.....}.WH...s.|

    00000170  b3 7f 96 77 f4 02 de 00  53 05 4f b0 b6 0d 5f e5  |...w....S.O..._.|

    00000180  04 b6 00 0e d6 e0 f1 14  fb cb c1 17 2d 07 6a 7a  |............-.jz|

    00000190  2c 2b 42 dc ce 31 1b 00  54 06 52 de 58 0d d4 61  |,+B..1..T.R.X..a|

    000001a0  0a d9 81 61 f4 42 d5 51  6a 29 d0 1f 28 21 fd 1b  |...a.B.Qj)..(!..|

    000001b0  8b 09 02 3d 9d 6a 1b 5e  4a 93 57 f1 b9 0b db 80  |...=.j.^J.W.....|

    000001c0  ca 90 32 9f 65 20 ed 4c  d3 83 8e 86 47 e7 16 72  |..2.e .L....G..r|

    000001d0  f4 be e9 9f ed 00 2a 83  93 83 2d 06 68 7c 9b ce  |......*...-.h|..|

    000001e0  71 21 fd eb 03 cb ae 43  b5 dc 75 c2 ac 99 ba 70  |q!.....C..u....p|

    000001f0  75 58 34 25 2b 12 ed c8  d5 c5 68 85 23 ea ed 80  |uX4%+.....h.#...|

    00000200

    IsaacMBPro-2:~ isaaciyune$



    Thanks

  • by Loner T,

    Loner T Loner T Nov 24, 2014 2:13 PM in response to iyune
    Level 7 (24,419 points)
    Safari
    Nov 24, 2014 2:13 PM in response to iyune

    In the referenced thread, theer are two utilities, Testdisk and GPT Fdisk. Please download both. Start with Testdisk and look for teh lost NTFS header using a EFI GPT partition type and Quick Search. I expect you will need 'Deeper Search'.

     

    Please see http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step.

  • by iyune,

    iyune iyune Nov 24, 2014 3:34 PM in response to Loner T
    Level 1 (0 points)
    Nov 24, 2014 3:34 PM in response to Loner T

    I downloaded both, and ran testdisk an this is what I got.

     

    Screen 1

    TestDisk1.jpg

    Screen 2

    TestDisk2.jpg

    Screen 3

    TestDisk3.jpg

    I don´t know what to do at this point to find the lost header, any clues?

     

    Thanks

  • by Loner T,

    Loner T Loner T Nov 24, 2014 3:51 PM in response to iyune
    Level 7 (24,419 points)
    Safari
    Nov 24, 2014 3:51 PM in response to iyune

    The three partitions  of the type MS Data of size 164067321 are roughly 83+ GB, which is  close to your BC partition of 84GB.

     

    Scroll down to each MS Data partition and use 'P' to list files. Look for familiar Windows files. You also need to see 'System Volume Information' in that list.

     

    Can you post a text version of the last screen so I can cut/paste numbers for my table to validate the bytes offsets? It will look similar to teh gpt output you posted in your first post.

  • by iyune,

    iyune iyune Nov 24, 2014 4:08 PM in response to Loner T
    Level 1 (0 points)
    Nov 24, 2014 4:08 PM in response to Loner T

    From the 3 partitions,

     

    Partitions 1 and 3 return an error "Can't open filesystem. Filesystem seems damaged."

    Partition 2 seems to have the windows OS, so this one might be

     

    here is the text of screen 3:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 320 GB / 298 GiB - 625142448 sectors (RO)

         Partition               Start        End    Size in sectors

    P EFI System                    40     409639     409600 [EFI]

    D Mac HFS                   409640  459078951  458669312

    >D MS Data                297007112  461074432  164067321

    D Mac HFS                459804168  461073703    1269536

    D MS Data                461074432  625141752  164067321

    D MS Data                461074439  625141759  164067321

    D Mac HFS                623872872  625142407    1269536

     

     

     

     

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

    NTFS found using backup sector, blocksize=4096, 84 GB / 78 GiB


    Thanks

  • by Loner T,

    Loner T Loner T Nov 24, 2014 5:49 PM in response to iyune
    Level 7 (24,419 points)
    Safari
    Nov 24, 2014 5:49 PM in response to iyune

    Assuming that you can see familiar files, including "System Volume Information", in the following partition,

     

    D MS Data                461074432  625141752  164067321

     

    The following table contains the values from your GPT 3 and this entry. A negative 'byte offset' indicates potential data loss. In your case it seems to be fine.

     

    GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartByte OffsetNTFS SizeNTFS End
    4598041681269536461073704461074432728164067321625141753

     

    Here are the steps.

     

    Rebuild using start/end offsets from Testdisk DeepSearch using GPT disk

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4   (part 4)
    7. 461074432
      (start point for Bootcamp part)
    8. +
      164067321
      (Size offset as opposed to End offset)
    9. 0700     (Windows part type)
    10. P           (print list of all parts just to see what changes will be made)
    11. W         (Write the new GPT)
    12. Y           (Yes! really write the new GPT)

      This will delete and re-write the GPT partition info for /dev/disk0s4.

     

    Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Please answer Yes to include EFI in MBR (good for GRUB question). Use defaults for partition types as suggested by Gdisk which it collects from the GPT GUIDs.

     

    1. Sudo gdisk /dev/disk0
    2. P  (Print list of parts)
    3. R   (Recover)
    4. H (chooses Hybrid)
    5. Partitions numbers to be hybridized: 2 3 4
    6. N (boot flag 1)
    7. N (part 2 flag)
    8. N (part 3 flag)
    9. Y  (part 4 flag make bootable partition)
    10. W  (Write the new MBR)
    11. Y    (Yes! write the new MBR)

    Reboot

       

    Check all partitions with fdisk on reboot.

    sudo fdisk /dev/disk0 (everything should match and Bootcamp should be visible everywhere)

     

    If you see any error messages, please stop and post back here. Post the output of the gpt show and fdisk commands before and after each reboot.

  • by iyune,

    iyune iyune Nov 27, 2014 7:59 AM in response to Loner T
    Level 1 (0 points)
    Nov 27, 2014 7:59 AM in response to Loner T

    Hi Loner T,

     

    Sorry for the delay, but after performing the steps you mentioned, the OS did not boot, a ? sign came out when booting instead of the apple logo.

    Long story short, I was able to solve it by performing a network recovery tool, opening the terminal and unmount and remount all the volumes (the OSX volume was never able to be mounted or unmounted), then rebooted and voila!! 

     

    I have my bootcamp partition booting and running like a charm!  but I actually don't know if related but most of my apps are not working in Yosemite and the appstore just does not download or update anything popping out a " <name of app> failed to download. Use the purchases page to try again",  and of course that does not work either.

     

    I really appreciate your help on this manner!!

  • by Loner T,

    Loner T Loner T Nov 27, 2014 8:32 AM in response to iyune
    Level 7 (24,419 points)
    Safari
    Nov 27, 2014 8:32 AM in response to iyune

    Step 6 in the Hybrid MBR portion is a problem. It should be Y. This is in response to the question of including the EFI part in the MBR. It is unrelated to boot flags for Windows. Good to see you managed to get it back up and running.

     

    On the OSX side, can you re-install OSX (it should leave everything else untouched)?

     

    Be aware that Internet Recovery - OS X: About OS X Recovery - Apple Support may provide a different version of OSX than what you currently have.

     

    Which version of OS X is installed by OS X Recovery?

    • If you use the Recovery System stored on your startup drive to reinstall OS X, it installs the most recent version of OS X previously installed on this computer.
    • If you use Internet Recovery to reinstall OS X, it installs the version of OS X that originally came with your computer. After installation is finished, use the Mac App Store to install related updates or later versions of OS X that you have previously purchased.
  • by iyune,

    iyune iyune Nov 27, 2014 9:07 AM in response to Loner T
    Level 1 (0 points)
    Nov 27, 2014 9:07 AM in response to Loner T

    How do I download Yosemite if app store is not downloading anything?

    appstore.jpg

  • by Loner T,

    Loner T Loner T Nov 27, 2014 9:27 AM in response to iyune
    Level 7 (24,419 points)
    Safari
    Nov 27, 2014 9:27 AM in response to iyune

    If you can clean install the OSX version via Internet Recovery on an external disk, not the one which you are trying to fix, and upgrade it all the way to Yosemite, you can boot from this external disk, and fix your internal disk.