rekonl

Q: bootcamp disk0s4 after update to mavericks

Hi all,

 

I have the same problem like many others, after upgrade to mavericks my Windows 8.1 isn't available anymore. When in OS X, the disk is disk0s4.

 

Below the screenshots. I'm close (I think), but not sure about the start and end numbers to chose.

 

diskutil list

/dev/disk0

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *251.0 GB   disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:          Apple_CoreStorage                         165.0 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:       Microsoft Basic Data                         45.1 GB    disk0s4

/dev/disk1

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:                  Apple_HFS Macintosh HD           *164.6 GB   disk1

                                 Logical Volume on disk0s2

                                 98FC8055-B1ED-4D22-9D4E-EA3DFB7E0333

                                 Unencrypted

 

diskutil cs list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group 552AB039-31F7-4BCD-A469-9614F5AF3BAD

    =========================================================

    Name:         Macintosh HD

    Status:       Online

    Size:         164999999488 B (165.0 GB)

    Free Space:   18886656 B (18.9 MB)

    |

    +-< Physical Volume 7E5BC687-CFCA-4C4E-B354-F71EF104586E

    |   ----------------------------------------------------

    |   Index:    0

    |   Disk:     disk0s2

    |   Status:   Online

    |   Size:     164999999488 B (165.0 GB)

    |

    +-> Logical Volume Family 5242B14A-FA52-427C-9287-B41976554AA0

        ----------------------------------------------------------

        Encryption Status:       Unlocked

        Encryption Type:         None

        Conversion Status:       NoConversion

        Conversion Direction:    -none-

        Has Encrypted Extents:   No

        Fully Secure:            No

        Passphrase Required:     No

        |

        +-> Logical Volume 98FC8055-B1ED-4D22-9D4E-EA3DFB7E0333

            ---------------------------------------------------

            Disk:                  disk1

            Status:                Online

            Size (Total):          164628791296 B (164.6 GB)

            Conversion Progress:   -none-

            Revertible:            Yes (no decryption required)

            LV Name:               Macintosh HD

            Volume Name:           Macintosh HD

            Content Hint:          Apple_HFS

 

 

 

sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 490234751

      start       size  index  contents

          0          1         MBR

          1          1         Pri GPT header

          2         32         Pri GPT table

         34          6        

         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

     409640  322265624      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

  322675264    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

  323944800   78126752        

  402071552   88162304      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  490233856        863        

  490234719         32         Sec GPT table

  490234751          1         Sec GPT header

 

 

sudo fdisk /dev/disk0

Disk: /dev/disk0geometry: 30515/255/63 [490234752 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>

2: AC 1023 254  63 - 1023 254  63 [    409640 -  322265624] <Unknown ID>

3: AB 1023 254  63 - 1023 254  63 [ 322675264 -    1269536] Darwin Boot

4: 0C 1023 254  63 - 1023 254  63 [ 402071552 -   88162304] Win95 FAT32L

 

 

 

TestDisk 6.14, Data Recovery Utility, July 2013

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

     MS Data                323946496  490233848  166287353 [BOOTCAMP]

Directory /

 

>dr-xr-xr-x     0     0         0 27-Oct-2014 13:56 .

dr-xr-xr-x     0     0         0 27-Oct-2014 13:56 ..

dr-xr-xr-x     0     0         0 17-Jun-2014 09:22 $Recycle.Bin

dr-xr-xr-x     0     0         0 15-Sep-2014 21:48 Boot

dr-xr-xr-x     0     0         0 29-Oct-2014 08:32 Config.Msi

dr-xr-xr-x     0     0         0 22-Aug-2013 16:45 Documents and Settings

dr-xr-xr-x     0     0         0  4-Nov-2013 07:18 Intel

dr-xr-xr-x     0     0         0  4-Nov-2013 10:48 MSOCache

dr-xr-xr-x     0     0         0 22-Aug-2013 17:22 PerfLogs

dr-xr-xr-x     0     0         0 28-Oct-2014 22:19 Program Files

dr-xr-xr-x     0     0         0 27-Oct-2014 13:51 Program Files (x86)

dr-xr-xr-x     0     0         0 28-Oct-2014 22:19 ProgramData

                                                   Next

Use Right to change directory, h to hide Alternate Data Stream

    q to quit, : to select the current file, a to select all files

    C to copy the selected files, c to copy the current file

MacBook Pro, OS X Yosemite (10.10.1)

Posted on Dec 1, 2014 2:35 PM

Close

Q: bootcamp disk0s4 after update to mavericks

  • All replies
  • Helpful answers

  • by Loner T,Solvedanswer

    Loner T Loner T Dec 2, 2014 3:56 AM in response to rekonl
    Level 7 (23,613 points)
    Safari
    Dec 2, 2014 3:56 AM in response to rekonl

    Excellent work to get to this point. Were any of your partitions resized after Windows was already in place?

     

    Your table (and my cheat sheet) looks as following

     

    GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartByte OffsetNTFS SizeNTFS End
    32267526412695363239448003239464961696166287353490233849

     

    You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message.

     

    Rebuild using start/end offsets from Testdisk DeepSearch using GPT Fdisk (http://sourceforge.net/projects/gptfdisk/)

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4   (part 4)
    7. 323946496 - Start offset in bytes  (start point for Bootcamp part)
    8. +166287353 (Size offset as opposed to End offset)
    9. 0700     (Windows part type)
    10. P           (print list of all parts just to see what changes will be made)
    11. W         (Write the new GPT)
    12. Y           (Yes! really write the new GPT)

       This will delete and re-write the GPT partition info for /dev/disk0s4.


    Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR

    1. Sudo gdisk /dev/disk0
    2. P  (Print list of parts)
    3. R   (Recover)
    4. H (chooses Hybrid)
    5. Partitions numbers to be hybridized: 2 3 4
    6. Y (Good for GRUB question)
    7. N (part 2 flag)
    8. N (part 3 flag)
    9. Y  (part 4 flag make bootable partition)
    10. W  (Write the new MBR)
    11. Y    (Yes! write the new MBR)
    12. Reboot

     

    Test 1 - Does Bootcamp Volume show up in Finder?

    Test 2 - Can you see your files in Bootcamp Volume?

    Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

    Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

     

    If you see a hanging underline cursor at the top left on a black screen, and it does not proceed further, you may need Windows Startup Repair or a tool called EasyBCD.

  • by rekonl,

    rekonl rekonl Dec 2, 2014 4:26 AM in response to Loner T
    Level 1 (0 points)
    Dec 2, 2014 4:26 AM in response to Loner T

    Worked perfectly!! Thanks Loner T for the help.

  • by Loner T,

    Loner T Loner T Dec 2, 2014 4:31 AM in response to rekonl
    Level 7 (23,613 points)
    Safari
    Dec 2, 2014 4:31 AM in response to rekonl

    Please backup OSX and Windows as a baseline backup, if you need to restore it in the future.

  • by Smiithy95,

    Smiithy95 Smiithy95 Oct 9, 2015 12:39 PM in response to rekonl
    Level 1 (0 points)
    Oct 9, 2015 12:39 PM in response to rekonl

    I have same issue, my Windows has disappeared, this is from the El Capitan update. If this solution works for this issue will it delete my window files?

     

    Also if this is any help It shows that there's 233GB on the bootcamp partition.

    Screen Shot 2015-10-09 at 20.31.52.png

  • by Loner T,

    Loner T Loner T Oct 9, 2015 12:58 PM in response to Smiithy95
    Level 7 (23,613 points)
    Safari
    Oct 9, 2015 12:58 PM in response to Smiithy95

    No, but you should post the output of the current state using the following commands.

     

    diskutil list

    diskutil cs list

    sudo gpt -vv -r show /dev/disk0

    sudo fdisk /dev/disk0

     

    The "sudo" commands will prompt for your password, and it will not be echoed back. You may also see a warning about improper use of "sudo" and potential data loss due to "abuse" of the command.

  • by Smiithy95,

    Smiithy95 Smiithy95 Oct 9, 2015 1:06 PM in response to Loner T
    Level 1 (0 points)
    Oct 9, 2015 1:06 PM in response to Loner T

    Okay, how's this?

    Screen Shot 2015-10-09 at 21.06.01.png

  • by Loner T,

    Loner T Loner T Oct 9, 2015 1:23 PM in response to Smiithy95
    Level 7 (23,613 points)
    Safari
    Oct 9, 2015 1:23 PM in response to Smiithy95

    The gap between GPT3 and GPT4 indicates a missing/lost NTFS header.

     

    Please download

     

    Testdisk - http://www.cgsecurity.org/wiki/TestDisk_Download

    GPT Fdisk - http://sourceforge.net/projects/gptfdisk/

     

    Please use Testdisk to start a scan of /dev/rdisk0 using EFI/GPT - http://imgur.com/a/PjmnK . You want to run a Quick Search first.

  • by Smiithy95,

    Smiithy95 Smiithy95 Oct 9, 2015 1:36 PM in response to Loner T
    Level 1 (0 points)
    Oct 9, 2015 1:36 PM in response to Loner T

    Okay which do I select now?

    Screen Shot 2015-10-09 at 21.33.42.png

  • by Loner T,

    Loner T Loner T Oct 9, 2015 2:41 PM in response to Smiithy95
    Level 7 (23,613 points)
    Safari
    Oct 9, 2015 2:41 PM in response to Smiithy95

    This is a list of unrecoverable partitions. Press Enter/Return to Continue and you should see a list of recoverable partitions. Please post a screen shot.

  • by Smiithy95,

    Smiithy95 Smiithy95 Oct 9, 2015 3:14 PM in response to Loner T
    Level 1 (0 points)
    Oct 9, 2015 3:14 PM in response to Loner T

    This came up Screen Shot 2015-10-09 at 23.13.58.png

  • by Loner T,

    Loner T Loner T Oct 9, 2015 3:26 PM in response to Smiithy95
    Level 7 (23,613 points)
    Safari
    Oct 9, 2015 3:26 PM in response to Smiithy95

    Your most likely partition candidate is the second MS Data entry.

     

    GPT3 StartGPT 3 SizeGPT3 EndSector OffsetNTFS StartNTFS SizeNTFS EndSector Offset (GB)NTFS Size (GB)
    116707717612695361168346711425116834713678517656919535237040.00374.40

     

    Can you use 'p' to list files in this partition? Your output should look similar to the following to be a valid partition.

     

    Testdisk-GoodWindowsPartition.png

  • by Smiithy95,

    Smiithy95 Smiithy95 Oct 9, 2015 3:39 PM in response to Loner T
    Level 1 (0 points)
    Oct 9, 2015 3:39 PM in response to Loner T

    Okay this is what I got

    Screen Shot 2015-10-09 at 23.38.32.png

  • by Loner T,

    Loner T Loner T Oct 9, 2015 4:04 PM in response to Smiithy95
    Level 7 (23,613 points)
    Safari
    Oct 9, 2015 4:04 PM in response to Smiithy95

    Install GPT Fdisk (aka gdisk).  Leave your Testdisk display and start a new Terminal Window. You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message. The following steps have values from your Testdisk output (and you can verify) in Steps 7 and 8. Please notice the'+' sign in step 8 (this is called offset notation). The text in parentheses is for informational purpose to describe the action being taken. Gdisk has one-character commands except when entering numbers.

     

    Rebuild GPT4 using start/end offsets

     

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4  (part 4)
    7. 1168347136 ( - Start offset in sectors or the start point for Bootcamp part)
    8. +785176569 ( - Size offset, as opposed to End offset)
    9. 0700 (Windows part type)
    10. P  (print list of all parts just to see what changes will be made)
    11. W (Write the new GPT)
    12. Y  (Yes! really write the new GPT)

    This will delete and re-write the GPT partition info for /dev/disk0s4.


    Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Use defaults for other questions (like partition codes). The only values that need modifications are the Boot flags and step 10. Accept all other defaults that Gdisk offers. Please see the sample Q&A as an example. These steps can be repeated if you make a mistake before you get to Step 12, otherwise start from Step 1 for these steps. Step 6 has numbers which are typed with a space between the numbers. Please see the sample Q&A before you execute these steps.

    1. Sudo gdisk /dev/rdisk0
    2. P  (Print list of parts)
    3. R  (Recover)
    4. O (print current Hybrid MBR)
    5. H (chooses Hybrid)
    6. Partitions numbers to be hybridized: 2 3 4
    7. Y  (Good for GRUB question)
    8. N  (part 2 boot flag)
    9. N  (part 3 boot flag)
    10. Y  (part 4 boot flag make NTFS bootable partition)
    11. O  (print current Hybrid MBR)
    12. W (Write the new MBR)
    13. Y (Yes! write the new MBR)
    14. Reboot

     

    Here is sample Q&A for this section. Please notice the Press Enter/Return.

     

    Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): Y

     

    Creating entry for GPT partition #2 (MBR partition #2)

    Enter an MBR hex code (default AF): Press Enter/Return

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #3 (MBR partition #3)

    Enter an MBR hex code (default AB): Press Enter/Return

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #4 (MBR partition #4)

    Enter an MBR hex code (default 07): Press Enter/Return

    Set the bootable flag? (Y/N): Y

     

    Test 1 - Does Bootcamp Volume show up in Finder?

    Test 2 - Can you see files in Bootcamp Volume?

    Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

    Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

  • by Smiithy95,

    Smiithy95 Smiithy95 Oct 9, 2015 4:21 PM in response to Loner T
    Level 1 (0 points)
    Oct 9, 2015 4:21 PM in response to Loner T

    Thank you so much! I'm going to try booting windows but as of now all my files are there and I can see bootcamp in finder!