Xegony42
Level 1 (0 points)

Q: Boot Camp Lost After 10.10.1 Upgrade

Last login: Fri Dec  5 15:49:42 on console

michael-tyos-MacBook-Air:~ michaeltyo$ diskutil list

/dev/disk0

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *121.3 GB   disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:                  Apple_HFS Macintosh HD            24.6 GB    disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:       Microsoft Basic Data                         88.8 GB    disk0s4

michael-tyos-MacBook-Air:~ michaeltyo$ diskutil cs list

No CoreStorage logical volume groups found

michael-tyos-MacBook-Air:~ michaeltyo$ sudo gpt -vv -r show /dev/disk0

 

WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.

 

To proceed, enter your password, or type Ctrl-C to abort.

 

Password:

gpt show: /dev/disk0: mediasize=121332826112; sectorsize=512; blocks=236978176

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 236978175

      start       size  index  contents

          0          1         MBR

          1          1         Pri GPT header

          2         32         Pri GPT table

         34          6        

         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

     409640   48061168      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

   48470808    1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

   49740352   13848000        

   63588352  173387776      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  236976128       2015        

  236978143         32         Sec GPT table

  236978175          1         Sec GPT header

michael-tyos-MacBook-Air:~ michaeltyo$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 14751/255/63 [236978176 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>

2: AF 1023 254  63 - 1023 254  63 [    409640 -   48061168] HFS+       

3: AB 1023 254  63 - 1023 254  63 [  48470808 -    1269544] Darwin Boot

4: 0C 1023 254  63 - 1023 254  63 [  63588352 -  173387776] Win95 FAT32L

michael-tyos-MacBook-Air:~ michaeltyo$

 

Your assistance is greatly appreciated - I need to recover this partition and be able to boot it.

MacBook Air

Posted on Dec 5, 2014 3:59 PM

Close
Xegony42

Q: Boot Camp Lost After 10.10.1 Upgrade

  • All replies
  • Helpful answers

  • by adam1314,

    adam1314 adam1314 Dec 5, 2014 4:28 PM in response to Xegony42
    Level 1 (0 points)
    Dec 5, 2014 4:28 PM in response to Xegony42

    download and run testdisk. Use test disk to find the start, end and size of the missing partition. Then follow Loner's instruction to reset the partition table and etc.

  • by Loner T,Helpful

    Loner T Loner T Dec 5, 2014 4:57 PM in response to Xegony42
    Level 7 (24,202 points)
    Safari
    Dec 5, 2014 4:57 PM in response to Xegony42

    Thanks for the assist adam1314.

     

    Xegony42 - Please see Re: Missing Bootcamp Partition (with pastes!) for an example. Testdisk Quick Search will just show the current partitions. You need to use Deeper Search before you make any GPT/Gdisk changes.

  • by Xegony42,

    Xegony42 Xegony42 Dec 8, 2014 9:47 AM in response to Xegony42
    Level 1 (0 points)
    Dec 8, 2014 9:47 AM in response to Xegony42

    Last login: Fri Dec  5 15:53:49 on ttys000

    michael-tyos-MacBook-Air:~ michaeltyo$ /Users/michaeltyo/Downloads/testdisk-7.0-WIP/testdisk ; exit;

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    No disk found.

    TestDisk will try to restart itself using the sudo command to get

    root (superuser) privileges.

     

    sudo may ask your user password, it doesn't ask for the root password.

    Usually there is no echo or '*' displayed when you type your password.

     

    Password:

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

     

     

     

     

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/disk0 - 121 GB / 113 GiB - 236978176 sectors (RO)

     

    The harddisk (121 GB / 113 GiB) seems too small! (< 383 GB / 357 GiB)

    Check the harddisk size: HD jumpers settings, BIOS detection...

     

    The following partitions can't be recovered:

         Partition               Start        End    Size in sectors

    >  MS Data                 50979864  238214160  187234297

       MS Data                 58158048  245392344  187234297

       MS Data                 79406536  252794311  173387776

       MS Data                148359880  321747655  173387776

       Mac HFS                160255567  749686352  589430786

       MS Data                236976120  424210416  187234297

       MS Data                236976127  410363902  173387776

     

     

     

     

    [ Continue ]

    NTFS, blocksize=4096, 95 GB / 89 GiB

  • by Xegony42,

    Xegony42 Xegony42 Dec 8, 2014 9:48 AM in response to Xegony42
    Level 1 (0 points)
    Dec 8, 2014 9:48 AM in response to Xegony42

    This is what popped up after deep scan.  I'm not sure what to do next.  Not an IT guy.

  • by Xegony42,

    Xegony42 Xegony42 Dec 8, 2014 11:07 AM in response to Xegony42
    Level 1 (0 points)
    Dec 8, 2014 11:07 AM in response to Xegony42

    Last login: Fri Dec  5 15:53:49 on ttys000

    michael-tyos-MacBook-Air:~ michaeltyo$ /Users/michaeltyo/Downloads/testdisk-7.0-WIP/testdisk ; exit;

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    No disk found.

    TestDisk will try to restart itself using the sudo command to get

    root (superuser) privileges.

     

    sudo may ask your user password, it doesn't ask for the root password.

    Usually there is no echo or '*' displayed when you type your password.

     

    Password:

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

     

     

     

     

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/disk0 - 121 GB / 113 GiB - 236978176 sectors (RO)

         Partition               Start        End    Size in sectors

    D Mac HFS                 48477586   49747129    1269544

    D Mac HFS                 48477651   49747194    1269544

    D Mac HFS                 48477716   49747259    1269544

    D Mac HFS                 48477781   49747324    1269544

    D Mac HFS                 48477958   49747501    1269544

    D Mac HFS                 48478127   49747670    1269544

    D Mac HFS                 48478192   49747735    1269544

    D Mac HFS                 48478289   49747832    1269544

    D Mac HFS                 48478354   49747897    1269544

    D Mac HFS                 48478427   49747970    1269544

    D Mac HFS                 48478492   49748035    1269544

    D Mac HFS                 48478589   49748132    1269544

    D Mac HFS                 48478654   49748197    1269544

    D Mac HFS                 48478743   49748286    1269544

    D Mac HFS                 48478808   49748351    1269544

    D Mac HFS                 48478873   49748416    1269544

    D Mac HFS                 48478938   49748481    1269544

    D Mac HFS                 48479011   49748554    1269544

    D Mac HFS                 49740348   51009891    1269544

    D MS Data                 49741824  236976120  187234297

    D Mac HFS                 56660182   65048791    8388610 [    D^A]

    D MS Data                 58187816  231575591  173387776

    D MS Data                 63588352  236976127  173387776

    D Mac HFS                 65048788   73437397    8388610 [    D^A]

    D MS Data                 76818403   76839141      20739 [NO NAME]

    D MS Data                 79218267   79224440       6174

    D MS Data                 79224440   79230613       6174 [Boot]

    D MS Data                 98772888   98775767       2880 [EFISECTOR]

    D MS Data                140606385  141978368    1371984 [GW  Ø«ÝŠ  b~^dS

    D MS Data                140606386  141978369    1371984 [GW  Ø«ÝŠ  b~^dS

    D MS Data                141421187  141427360       6174

    D MS Data                141427360  141433533       6174 [Boot]

    D MS Data                141427379  141433552       6174

    D MS Data                141433552  141439725       6174 [Boot]

    D MS Data                141433571  141439744       6174

    D MS Data                141439744  141445917       6174 [Boot]

    D MS Data                141448800  141451679       2880 [EFISECTOR]

    D MS Data                169453120  169455999       2880 [EFISECTOR]

    D Mac HFS                210210127  210276678      66552

    >D Mac HFS                210276675  210343226      66552

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type,

         Enter: to continue

    HFS blocksize=1024, 34 MB / 32 MiB

  • by Loner T,Helpful

    Loner T Loner T Dec 8, 2014 11:21 AM in response to Xegony42
    Level 7 (24,202 points)
    Safari
    Dec 8, 2014 11:21 AM in response to Xegony42

    You have a gap between these start/end blocks.

    49740352   13848000       

    Please look in this partition

    D MS Data                 49741824  236976120  187234297

     

    Please do not use left/right arrow/cursor keys. Scroll down to this partition and use 'P' to list files.

  • by Xegony42,

    Xegony42 Xegony42 Dec 8, 2014 2:26 PM in response to Loner T
    Level 1 (0 points)
    Dec 8, 2014 2:26 PM in response to Loner T

    Okay it looks like the files and disk that is missing.  Thanks! How do I get it back so I can select it on boot?

     

     

     

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

         MS Data                 49741824  236976120  187234297

    Directory /

     

    >dr-xr-xr-x     0     0         0 21-Nov-2014 14:53 .

    dr-xr-xr-x     0     0         0 21-Nov-2014 14:53 ..

    dr-xr-xr-x     0     0         0 24-Dec-2010 16:08 $AVG

    dr-xr-xr-x     0     0         0 24-Sep-2013 08:44 $Recycle.Bin

    dr-xr-xr-x     0     0         0 10-Nov-2011 19:58 .Trashes

    dr-xr-xr-x     0     0         0 10-Nov-2011 19:58 .fseventsd

    dr-xr-xr-x     0     0         0 14-Oct-2014 17:35 Boot

    dr-xr-xr-x     0     0         0  4-Feb-2011 15:50 CISCO64BIT

    dr-xr-xr-x     0     0         0 19-Nov-2014 16:59 Config.Msi

    dr-xr-xr-x     0     0         0  2-Jul-2013 17:56 Expat Shield

    dr-xr-xr-x     0     0         0 28-May-2014 02:30 GRLAWBKUP

    dr-xr-xr-x     0     0         0 21-Dec-2010 20:20 Intel

    dr-xr-xr-x     0     0         0 22-Dec-2010 11:07 MSOCache

    dr-xr-xr-x     0     0         0 29-Nov-2012 21:09 MacFan

    dr-xr-xr-x     0     0         0 22-Dec-2010 17:39 Music

    dr-xr-xr-x     0     0         0 29-Nov-2012 22:33 NVIDIA

    dr-xr-xr-x     0     0         0 13-Jul-2009 20:20 PerfLogs

    dr-xr-xr-x     0     0         0 17-Nov-2014 16:58 Program Files

    dr-xr-xr-x     0     0         0 17-Nov-2014 16:59 Program Files (x86)

    dr-xr-xr-x     0     0         0 17-Nov-2014 17:00 ProgramData

    dr-xr-xr-x     0     0         0 21-Dec-2010 20:13 Recovery

    dr-xr-xr-x     0     0         0  4-Dec-2014 17:21 System Volume Information

    dr-xr-xr-x     0     0         0 24-Sep-2013 08:44 Users

    dr-xr-xr-x     0     0         0 21-Nov-2014 14:53 Windows

    dr-xr-xr-x     0     0         0  7-Oct-2013 16:34 found.000

    -r--r--r--     0     0         8 21-Nov-2014 14:53 ..:^EC0B21842-99B8-46E2-A991

    -r--r--r--     0     0         8 21-Nov-2014 14:53 .:^EC0B21842-99B8-46E2-A991-

    -r--r--r--     0     0      6148  2-Nov-2011 12:16 .DS_Store

    -r--r--r--     0     0        64 10-Nov-2011 19:58 .Trashes:AFP_AfpInfo

    -r--r--r--     0     0      1024 26-Apr-2014 09:27 .rnd

    -r--r--r--     0     0      8192 22-Dec-2010 04:04 BOOTSECT.BAK

    -r--r--r--     0     0       508 10-Aug-2013 10:24 CKINFO.TXT

    -r--r--r--     0     0       355  8-Dec-2013 08:16 Computer - Shortcut.lnk

    -r--r--r--     0     0      2058 27-Apr-2014 04:05 RHDSetup.log

    -r--r--r--     0     0     41472 17-Apr-2011 09:33 Thumbs.db

    -r--r--r--     0     0         0 17-Apr-2011 09:33 Thumbs.db:encryptable

    -r--r--r--     0     0     46841 24-Jun-2011 21:46 bookmarks-2011-06-24.json

    -r--r--r--     0     0    383786 20-Nov-2010 04:40 bootmgr

    -r--r--r--     0     0    132547  6-Jan-2013 22:37 formatter.log

    -r--r--r--     0     0 1401917440  5-Dec-2014 01:33 hiberfil.sys

    -r--r--r--     0     0 1869225984  5-Dec-2014 01:33 pagefile.sys

    -r--r--r--     0     0    341415  7-Oct-2013 09:37 synergy.log

    -r--r--r--     0     0       251  3-Jun-2012 19:16 user.js

                                                       Next

    Use Right to change directory, h to hide Alternate Data Stream

        q to quit, : to select the current file, a to select all files

        C to copy the selected files, c to copy the current file

  • by Loner T,

    Loner T Loner T Dec 8, 2014 2:55 PM in response to Xegony42
    Level 7 (24,202 points)
    Safari
    Dec 8, 2014 2:55 PM in response to Xegony42

    This is a table that I use to validate the Testdisk output to be reasonable. Using your values

     

    GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartByte OffsetNTFS SizeNTFS End
    48470808126954449740352497418241472187234297236976121

     

    The 1472 byte offset is good news. You will not lose any other partition. I have plugged in the values for your specific configuration in the following steps.

     

    If you see any error messages during the following steps, please stop and post back here with the error message.

     

    Rebuild using start/end offsets from Testdisk DeepSearch using GPT Fdisk (http://sourceforge.net/projects/gptfdisk/)

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4   (part 4)
    7. 49741824 - Start offset in bytes  (start point for Bootcamp part)
    8. +187234297 (Size offset as opposed to End offset)
    9. 0700     (Windows part type)
    10. P           (print list of all parts just to see what changes will be made)
    11. W         (Write the new GPT)
    12. Y           (Yes! really write the new GPT)

      This will delete and re-write the GPT partition info for /dev/disk0s4. 


    Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR

    1. Sudo gdisk /dev/disk0
    2. P  (Print list of parts)
    3. R   (Recover)
    4. H (chooses Hybrid)
    5. Partitions numbers to be hybridized: 2 3 4
    6. Y (Good for GRUB question)
    7. N (part 2 flag)
    8. N (part 3 flag)
    9. Y  (part 4 flag make bootable partition)
    10. W  (Write the new MBR)
    11. Y    (Yes! write the new MBR)
    12. Reboot


    Test 1 - Does Bootcamp Volume show up in Finder?

    Test 2 - Can you see files in Bootcamp Volume?

    Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

    Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.


    If you see a hanging underline cursor at the top left on a black screen, and it does not proceed further, you may need Windows Startup Repair or a tool called EasyBCD.

  • by mmcrocetti,

    mmcrocetti mmcrocetti Jan 10, 2015 10:39 AM in response to Loner T
    Level 1 (0 points)
    Jan 10, 2015 10:39 AM in response to Loner T

    Hi Loner T,

     

    I have a similiar problem. I have a 2009 iMac that was running Mountain Lion on one partition, Snow leopard on another and then Windows 7 on the last bootcamp partition. However, when I upgraded to OS X Yosemite it completely deleted my bootcamp portion (so I thought). I then followed a few of your steps from the forum and I was able to get Windows to show up when I re booted and held the option key. However, when i click it it just loads a black screen.... I have attached the images for your terminal commands. let me know what to do next and if you think i will be able to get my partition and files back... I have some very important oxygen forensics files on that windows partition that i really need back.

     

    Thank you and best regards,Screen Shot 2015-01-10 at 12.10.06 PM.pngScreen Shot 2015-01-10 at 12.11.24 PM.pngScreen Shot 2015-01-10 at 12.12.07 PM.pngScreen Shot 2015-01-10 at 12.28.52 PM.pngScreen Shot 2015-01-10 at 12.39.10 PM.png

  • by Loner T,

    Loner T Loner T Jan 10, 2015 11:28 AM in response to mmcrocetti
    Level 7 (24,202 points)
    Safari
    Jan 10, 2015 11:28 AM in response to mmcrocetti

    I will ignore Disk1 (Stellar...).

     

    1. Is Disk2 an internal disk or an external disk? What version of OS X is on it?

    2. Please post the output of sudo dd if=/dev/rdisk0s5 count=1 2>/dev/null | hexdump -C.

    3. Can you start a new thread/discussion and post some of these screens on the new thread, so it will avoid confusion later?

  • by mmcrocetti,

    mmcrocetti mmcrocetti Jan 10, 2015 11:40 AM in response to Loner T
    Level 1 (0 points)
    Jan 10, 2015 11:40 AM in response to Loner T

    yes I will do that. Thank you so much for the quick reply!

     

    I believe that disk0s2 is my main partition of mac running osx Yosemite. Thats the one I upgraded and the original one on the computer.

     

    o.png

  • by mmcrocetti,

    mmcrocetti mmcrocetti Jan 10, 2015 11:45 AM in response to Loner T
    Level 1 (0 points)
    Jan 10, 2015 11:45 AM in response to Loner T

    Also am I putting this in terminal correctly as nothing is coming out after i press enter?

     

    Screen Shot 2015-01-10 at 1.44.37 PM.png

  • by mmcrocetti,

    mmcrocetti mmcrocetti Jan 10, 2015 11:47 AM in response to Loner T
    Level 1 (0 points)
    Jan 10, 2015 11:47 AM in response to Loner T

    My link to new discussion for you as well.

     

    http://discussions.apple.com/message/27452413#27452413