Currently Being ModeratedOct 23, 2013 5:58 PM (in response to tomd007)
tomd007, frankywashere, defly all have some things in common, it appears.
1. All have fdisk results, with the 4th partition ID set to 0C and not flagged as bootable. This tells me something that didn't know better reset that type code and boot flag, and that something is Apple's diskutil repairdisk (or resizevolume) command.
2. All have large gaps of free space between the 3rd and 4th partition. I no longer think this is free space, I think it's actually the portion that Windows was expanded into when you resized it larger.
3. When you resized in OS X, both the MBR and GPT were correctly modified.
4. When you resized in Windows, the tool only changed the MBR, it did not change the GPT. This is normal for such applications because typically they are only MBR aware, and whenever Windows boots in BIOS mode (which it does on Apple hardware) it only uses MBR. The problem is that now the GPT is wrong, and OS X uses primarily the GPT.
5. When upgrading OS X it does a diskutil repairdisk, which includes checking partition maps. When it finds a discrepancy, it fixes it by creating a new hybrid MBR from the now wrong GPT data, overwriting the MBR which is the only remaining place that has knowledge of where the Windows volume starts.
To fix this problem is non-trivial and different for every person's disk. The 4th parition start value must be exactly correct. If it's wrong by 1 value, Windows will not be found (to boot from or to mount the volume to at least copy data from).
Example in tomd007's case, the start value for free space is reported as 784539400. Somewhere between that and 2047 sectors later, is the likely actual start of the Windows volume.
Testdisk should be able to figure this out. It might find more than one possible start value, all would have to be checked to see which is the correct one. But it wouldn't be 2047 attempts, probably less than a dozen depending on how many NTFS volumes this disk has had created on it, all time, since it was last zero'd.
So I would say for all of you having this problem, time wise and mental wise, you're way way better off backing everything up, blowing away the disk (reformat as one partition) restore your OS X backup, use Bootcamp Assistant to resize the partition, reinstall Windows, then restore Windows from your backups. Tedious but that's the easiest thing to do. Because otherwise you're eyeballs deep in the meticulous and lengthy process of data recovery.
If testdisk doesn't give you useful information, then there might be an alternative, but again it's unique for each person's situation so I'd only be able to describe it generally. There's no one size fits all solution except backup, reformat, reinstall, restore.
Currently Being ModeratedOct 23, 2013 6:50 PM (in response to Christopher Murphy)
Thanks for your reply!
I need to give it a try because I have a Company's program installed in Windows 7 that I will find very difficult to get installed again.
I have downloaded "Testdisk" but I don't know how to use it... so I am reading the step by step guide here: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
I am not used to work in "Terminal", but I will give it a try. If I discover something new, I will let you know. Also if there is anything else you think I should know, please let me know.
Currently Being ModeratedOct 23, 2013 7:35 PM (in response to Christopher Murphy)
I'm having the exact same issue. Can I backup bootcamp and restore it? If not, can I use a program to extract a few files?
Currently Being ModeratedOct 23, 2013 8:25 PM (in response to Tatyiona)
If you actually have the exact same fdisk and gpt output as tomd007, frankywashere, and defly then no to the first question, and maybe to the 2nd. You'll need to work through testdisk like tomd007 is. There is no magic bullet for this.
Currently Being ModeratedOct 23, 2013 11:14 PM (in response to Christopher Murphy)
Hi Christopher Murphy,
By using "TestDisk" I have identified the partition that I wish to bring back to life. It starts in Sector 784539648 and ends in Sector 976773119.
The partition currently recognized by MacOS as "Partition 4" when running "sudo fdisk /dev/rdisk0" is the old version of my Windows partition, the one that I enlarged and should be about 100GB instead of 40GB... but since I did the expantion with a third party software in Windows, it didn't get registered in the GPT (I guess that was the problem).
TestDisk has found my partition, as you can see below, but I don't know what to do next. The selected partition is the one I want to revive. Looks like my disk is "Read Only", probably because I am working on it.
I have added a topic in the "TestDisk" forum to get some guidance from here. I will post
any steps forward.
All ideas are welcome. If you think that now that I have identified the sectors, there is
a simple process I can carry out in Terminal from MacOS to revive this partition and
delete the current recognized Partition 4, please let me know.
Currently Being ModeratedOct 23, 2013 11:19 PM (in response to tomd007)
The start LBA is quite plausible because it's 2048 sector (1MB) aligned. The ending value is also plausible.
So I think you use A to add this partition, but I'm actually not sure. What I would do, is go to gdisk and delete the current #4 partition, then add a new partition and plug in the start/end values you have highlighted in the latest screen shot. When asked for the type code, use 0700. Then w to write out the partition and reboot to OS X.
If this is correct, OS X should mount BOOTCAMP read only (assuming you don't have 3rd party read-write support for NTFS and if you do I would uninstall it because if the partition info is wrong you don't want to mount read write).
If the read only looks decent, take the opportunity to get the data out that you need before the next step which is to go back to gdisk, go to the recovery menu, create a new hybrid mbr, put the EFI GPT in the first MBR entry, add partitions 2 3 4, hit only enter for each request for type code to accept the suggested default, and only make 4 bootable. Write that out, reboot with option key and see if you can boot Windows.
If the read only does not work, then back to test disk...
Currently Being ModeratedOct 23, 2013 11:37 PM (in response to Christopher Murphy)
Currently Being ModeratedOct 23, 2013 11:55 PM (in response to frankywashere)
I don't know that testdisk knows about hybrid MBRs. So I would use gdisk for that.
Currently Being ModeratedOct 24, 2013 12:18 AM (in response to Christopher Murphy)
Hey Chris and everyone,
Here's my steps for accessing the files. In Testdisk i clicked "analyse"
The I selected "Quick Search"
Then this came up, and I selected "HPFS - NTFS" because obviously that's my lost NTFS Windows 7 Partition
Now once you get here, it lists you a bunch of potential partitions. All I did was select each NTFS partition and hit the "P". That attempts to read the files in that partition. If it can't read that partition you get the next screen.
If it CAN read the partition, then you've found the partition and you get this next screen wich lets you go through all the directories, when you find a file or folder you want to copy simply highlight it and hit the "C" key to copy it to any directory on your Mac.
Now my question to you Chris, It allows me to Write the Partition Table once i find the correct partition. Should I do this?
Currently Being ModeratedOct 24, 2013 12:23 AM (in response to frankywashere)
No I would not because I don't know what it's going to do. I would just make a note of the start and end values, and then use gdisk to clean things up. You'll have to delete the invalid partition 4 first, then add a new partition, plug in the start and end values from gdisk, then the type code for Windows NTFS volumes which is 0700.
It might work with testdisk but since I don't know if it writes out a GPT or MBR I'm not going to suggest it. At least if you get something wrong in gdisk removing partition 4, or adding a new one, it won't mangle anything else.
Currently Being ModeratedOct 24, 2013 12:28 AM (in response to Christopher Murphy)
would you delete the partition with Disk Utility?
Currently Being ModeratedOct 24, 2013 12:54 AM (in response to frankywashere)
No I trust it less than anything when it comes to hybrid MBRs.
Currently Being ModeratedOct 24, 2013 9:33 AM (in response to Christopher Murphy)
Currently Being ModeratedOct 24, 2013 10:02 AM (in response to Tatyiona)
Yes, it looks like the same problem. MBR partition 4 has an ID of 0C, and there is a large gap of free space between partitions 3 and 4 in the GPT. And there's every reason to believe this is not really free space, but a huge chunk of your Windows volume.
So you're in the same realm as franky and tomd. You'll need to use testdisk to figure out where the NTFS volume is, and then repair the problem using gdisk.
I'm not certain, but possibly if you use test disk to update the partition map, will only update the MBR. So that could allow windows to boot, but if it doesn't also update the GPT, you won't see the BOOTCAMP volume in OS X Finder.
I haven't really tested testdisk's behavior in this area which is why I back out after finding the start and end sectors for Windows, and use gdisk to make repairs. And since I have explicit control in gdisk over what's being changed, I'm certain I won't screw things up so badly that I can't boot OS X again. If that happens, things get difficult because now a 2nd computer or a linux live USB stick is needed to boot the computer and fix the problem.
More Like This
- Retrieving data ...
- This solved my question - 10 points
- This helped me - 5 points