Repairing Boot Camp after creating new partition

That turns out to be a tricky business, making sure one has a backup.

Winclone 3.7 kicks an error citing partition 5 as the cause. I'm negotiating with the publisher.

It amazes me how full of surprises can be the experience of trying to recover from creating an extra partition on a Bootcamp drive, whether willfully, as did the OP (original poster) or inadvertently, as did I when I failed to scrutinize the activity of Carbon Copy Cloner adequately.

One method to backup that I find useful in cases like this, is a block copy. But you need a disk with at least as much free space on it, as the entire disk you're backing up. In your case, the disk to backup is 500GB, so you would need a 2nd drive with at least 500GB of free space. This backup method is inefficient because it includes free space and deleted files, literally every sector whether it's used or not, is backedup. But the advantage is, it's an exact snapshot, and easy to restore. Basically it's a sector copy, although the performance is faster if you specify a slightly larger block size (multiple sectors at a time). The command is dd.

You can use dd from/to a disk, partition, or file, in any combination. So you can turn a disk or partition into a file or vice versa. It's very much like Disk Utility pointed at a volume icon, and telling it to make a DMG of it. Except, this works with any file system. The catch is that the file system must be unmounted, because any mounted/active file system is constantly changing. So you can't make a sector backup of it while small bits are changing.

I can explain more how to do this if this is something you'd actually use, including how to find the mounted volume, unmount it, and how to copy the Windows partition to a file onto another drive. And briefly how to restore it should it be necessary.

But yeah, if the Winclone folks have a work around, that's easier because during their restore, they fix things automatically like the boot loader and BCD, which with a sector/block copy, you have to fix these things manually after a restore if they need fixing (by manually, you use Windows Startup Repair).

If you're only backing up Windows, then you only need as much free space as the entire Windows partition. FWIW. And the tool I'm referring to do this is dd. Comes with OS X. And it will copy an entire Windows NTFS partition to a file which you can store on any file system, even JHFS+.

Hi Chris,

If you want a little more work can you look in on ths thread for me. https://discussions.apple.com/thread/4739136

Thanks

The source volume is now unmounted. It is now at dev/disk0s5. I have a place to put the output file (a JHFS+ volume with much more empty space than needed for the source).

I assume I want to tell dd what its source is – I can't figure that out from the man pages for dd. Perhaps you'll tell me how to navigate to the unmounted volume. Right now I have navigated to /dev and I can see the volume there.

I assume when I'm in the right place, I want to do something like

rightplace myuser$ dd of=path-to-output-file

Yes? Tell where/if I'm wrong, and how to navigate to the unmounted file so dd will accept it as the source, please.

Wow, do I appreciate your help!

I think I see now. It doesn't matter what parent directory is in the focus of the shell. Would the right command structure be

myuser$ dd if=/dev/disk0s5 of=/path-to-output-file

?

My contention that it is unmounted now is that it does not appear in the output of

myuser$ cd /Volumes

myuser$ ls -al

A more reliable command for finding mounts is either 'df' or 'mount'.

For a Windows partition at disk0s5 the command to copy it to a file is something like:

sudo dd if=/dev/rdisk0s5 of=/Volumes/externaldiskname/somefolder/Windows_backup.bin bs=256k

You can use .bin or .img, both are common, and .iso will work but it's not strictly correct (I think that's for CD/DVD's based on ISO 9660); but funny enough if you give it a .iso and double click on it in OS X, Disk Utility will open and mount it as a read only "DMG" like file. So you can read the contents.

So in the above command it's important to use sudo so the command has root privilage; that you use rdisk (with r) so you're using the raw block device; that you're pointing to an external disk with enough space; and the bs=256k means a block size of 256k at a time which will make this go way faster. You get no command prompt (it seems like it's hung) for the duration of the process, at the end there's a summary that's kinda important to make sure the records in and out are the same values.

That sudo dd command is all one line, even though it's soft wrapping in the browser...

myuser$ sudo dd if=/dev/rdisk0s5 of=/Volumes/external/directoryname/POCTOBAM.iso bs=256k

Password:

dd: /dev/rdisk0s5: Input/output error

98207+0 records in

98207+0 records out

25744375808 bytes transferred in 598.608368 secs (43007043 bytes/sec)

Is this telling me there was an error?

The third partition gave me a hex code of af again instead of ab....is that ok?

Yes. If you go back to your gpt -v -rr show output for this disk, it reports the Windows partition is 89004032 sectors, which is 45570064384 bytes. But dd was interrupted and only copied 25744375808 bytes, or 56%. The resulting file is next to useless. And it raises the question what this IO error is about. Down the rabbit hole... This is usually the result of a disk read error which means it encountered a bad sector.

In terminal, type

dmesg

and report the results. It might be long. You might also open Console and see if the system.log reports anything suspicious at the time this error was received.

Yeah it's fine, it looks like the HDD does not have a Recovery HD on it, but two HFS+ disks and one Windows disk. So that's AF, AF, 07. The SSD is the one with Recovery HD.

Worth trying the command again. Try a bs=128k this time. If it's a persistent read error it'll happen again at the same point and it means you've got bigger issues going on. If it works, great. You should end up with a file that's the same size as this partition. You can delete the one that was interrupted halfway through.

Chris, it worked perfectly...I have access to everything now and everything that is supposed to boot does as expected. I can't thank you enough! If Apple isnt paying you they should....I feel like I should make a Paypal contribution or something LOL. Thank you so much.

Hi Chritopher,

Thansk for your reply! As I am a bit unsure what terminal commands I have to use to make a new hybrid MBR, copy 2 3 4 to it and make 4 bootable, I would like to ask you to list the commands step by step for me.

I hope it's not to much trouble for you and thanks in advance for your time and help! Cheers