Backup Disk Partition Resize = Confusion

Question

Level 1

55 points

Backup Disk Partition Resize = Confusion

I have an external 750 GB FireWire hard disk that I use to back up both my Mac OS X Snow Leopard installation and my Windows 7 installation; it also has a small bootable Leopard partition for troubleshooting. I found myself running out of room for backing up the large iTunes library I have in Windows 7, so I decided to use Mac OS X Disk Utility to shrink the Time Machine partition; then, I used Windows 7 Disk Management to resize the Windows 7 Backup partition. Everything seemed to go fine at first.

Last night I went to back up both systems. The Time Machine backup went fine; however, Windows is showing its backup partition as a RAW partition of its original size, so it won't recognize the existing backup or add to it. When I'm booted in Snow Leopard, the Windows partition appears as NTFS, but there's some confusion: although Get Info shows the partition correctly with its new size, Disk Utility shows the partition with its original size (which is smaller than the size it's claiming is used).

I'm grateful that this isn't messing up my boot drive, but I'd rather not lose the backups that I've already performed (I've done some spring cleaning in my podcast collection, but I'd like to have the ability to go back to the backup if I get too trigger-happy). I don't have room to copy the entire Windows 7 Backup to another disk (it's over 300 GB). Is there any way to correct the GPT / MBR setup to properly recognize the new size of the Windows 7 Backup partition?

Message was edited by: Fahrwahr (apparently Apple Discussions removes the space between paragraph blocks).

MacBook, Windows 7, CD 2.0, 2 GB RAM, 320 GB HD

Posted on May 28, 2013 12:37 PM

Reply

Answer 1

Fahrwahr Author

Level 1

55 points

May 28, 2013 8:33 PM in response to Fahrwahr

Based on a suggestion I read about here, I decided to run testdisk on this external hard disk. Here's some of the log:

Analyse Disk /dev/rdisk1 - 750 GB / 698 GiB - CHS 1465149168 1 1 (RO) hdr_size=92 hdr_lba_self=1 hdr_lba_alt=1465149167 (expected 1465149167) hdr_lba_start=34 hdr_lba_end=1465149134 hdr_lba_table=2 hdr_entries=128 hdr_entsz=128 check_part_gpt failed for partition 4 P MS Data 586610688 1172547583 585936896 [WINNIE] Current partition structure: 1 P EFI System 40 409639 409600 [EFI System Partition] 2 P Mac HFS 409640 440387055 439977416 [Rosemary] 3 P Mac HFS 440387056 586348015 145960960 [Untitled] Warning: Incorrect number of heads/cylinder 255 (NTFS) != 1 (HD) Warning: Incorrect number of sectors per track 32 (NTFS) != 1 (HD) Error: size boot_sector 878532608 > partition 585936896 No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker 4 P MS Data 586610688 1172547583 585936896 [WINNIE] 4 P MS Data 586610688 1172547583 585936896 [WINNIE]

Oddly, at one point it seems to think that my hard disk is underreporting its size:

NTFS at 586610688/0/1 heads/cylinder 255 (NTFS) != 1 (HD) sect/track 32 (NTFS) != 1 (HD) filesystem size 878532608 sectors_per_cluster 1 mft_lcn 6291456 mftmirr_lcn 146570 clusters_per_mft_record 2 clusters_per_index_record 8 MS Data 586610688 1465143295 878532608 [WINNIE] NTFS, 449 GB / 418 GiB NTFS at 1465144064/0/1 heads/cylinder 255 (NTFS) != 1 (HD) sect/track 63 (NTFS) != 1 (HD) filesystem size 1465144002 sectors_per_cluster 8 mft_lcn 786432 mftmirr_lcn 91571500 clusters_per_mft_record -10 clusters_per_index_record 1 NTFS: Can't read MFT MS Data 1465144064 2930288065 1465144002 NTFS, 750 GB / 698 GiB This partition ends after the disk limits. (start=1465144064, size=1465144002, end=2930288065, disk end=1465149168) Disk /dev/rdisk1 - 750 GB / 698 GiB - CHS 1465149168 1 1 (RO) Check the harddisk size: HD jumpers settings, BIOS detection... The harddisk (750 GB / 698 GiB) seems too small! (< 1500 GB / 1397 GiB) The following partition can't be recovered: MS Data 1465144064 2930288065 1465144002 NTFS, 750 GB / 698 GiB

Will any of this data be useful to me in trying to make this NTFS partition usable again?

Results P EFI System 40 409639 409600 [EFI] FAT32, 209 MB / 200 MiB P Mac HFS 409640 440387055 439977416 HFS+, 225 GB / 209 GiB P Mac HFS 440387056 586348015 145960960 HFS+, 74 GB / 69 GiB P MS Data 586610688 1465143295 878532608 [WINNIE] NTFS, 449 GB / 418 GiB

Reply

Answer 2

Jun 28, 2013 11:40 AM in response to Fahrwahr

Well I think you're jumping the gun going to testdisk right away. Let's find out what the GPT and MBR are first, Disk Utility is completely unreliable dealing with unsync'd GPT and MBR partition tables.

sudo gpt -r -v show disk1

sudo fdisk /dev/disk1

Reply

Answer 3

Fahrwahr Author

Level 1

55 points

Jun 28, 2013 12:04 PM in response to Christopher Murphy

Thanks -- I didn't know which tools are helpful at which points.

gpt show: disk1: mediasize=750156374016; sectorsize=512; blocks=1465149168

gpt show: disk1: Suspicious MBR at sector 0

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 439977416 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

440387056 145960960 3 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

586348016 262672

586610688 585936896 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1172547584 292601551

1465149135 32 Sec GPT table

1465149167 1 Sec GPT header

Disk: /dev/disk1

geometry: 91201/255/63 [1465149168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 439977416] HFS+

3: AF 1023 254 63 - 1023 254 63 [ 440387056 - 145960960] HFS+

4: 0C 1023 254 63 - 1023 254 63 [ 586610688 - 585936896] Win95 FAT32L

Reply

Answer 4

Jun 28, 2013 1:41 PM in response to Fahrwahr

Hmm well the two partition tables are in sync in terms of start and end sectors for each partition. However, the MBR 4th partition type code is set to 0C which is for FAT not NTFS. It should be 07, so that might have an adverse affect.

But the other thing is that testdisk is saying the Windows volume is larger than the partition. So that tells me that Windows resize succeeded, it probably only altered the MBR entry. And then in OS X, Disk Utility, if you tried to do any sort of repair on the disk or any volume, resynced the GPT and hybrid MBR by copying the old values from the GPT to the MBR. That's why the Windows partition is smaller than the Windows volume (a partition's size is defined in the a partition table, and a volume's size is defined by the file system).

It looks like the start sector of 586610688 is correct, but it probably should end at something other than 1172547584. If the partition is larger than the volume, that'll still cause NTFS utilities including chkdsk to complain, but it's not nearly as big a problem as having a partition smaller than the volume. So what I would do is recreate the 4th partition in the GPT. And I'd also stop using the hybrid MBR. Since this disk doesn't need to be bootable for Windows, it doesn't need a hybrid MBR. That'll make things much saner to deal with just the GPT only.

To do that, download and install gdisk. This is a command line utility. It works in interactive mode, which means you run the program against a disk, and you'll get a prompt that lets you enter commands. Example: ? <return> will get you a listing of commands in the current menu. p <return> prints/lists the current partition table, and so on. So what you need to do is:

p to show the current partition table

d to delete a partition

4 to specify the 4th partition, Windows

n to create a new partition

<return> to accept default, which should be 4

586610688 this is the starting sector value, same as the original

<return> accept the default for the end sector value

0700 the partition type code

p to show the current partition table

w to write out the new partition table

And then I recommend copying and pasting this whole thing into the forum. It's sort of a backup and confirmation of where you were before and where you're at now in case everything goes to to cr@p. I'm doing that by memory but I think that's the right sequence. Also I would issue:

diskutil eject disk1

And then power off or unplug the external drive, then plug it back in/power it on. That'll refresh the GPT with the kernel to ensure it has the change.

Upon reboot, if this works, OS X should be able to see and mount the NTFS volume read only, as before. If it doesn't work, you'll need to run testdisk again and see what it thinks the remaining problem(s) are, and you can post that too if it comes to it.

Reply

Answer 5

Fahrwahr Author

Level 1

55 points

Jun 28, 2013 3:06 PM in response to Christopher Murphy

Ha -- it had been so long since my original post that I initially forgot to put /dev/ before the disk. Anyway, here's the whole thing:

GPT fdisk (gdisk) version 0.8.6

Type device filename, or press <Enter> to exit: /dev/disk1

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): p

Disk /dev/disk1: 1465149168 sectors, 698.6 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): C9579524-72E1-4DDB-820A-BD937B136BB6

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 1465149134

Partitions will be aligned on 8-sector boundaries

Total free space is 292864229 sectors (139.6 GiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 440387055 209.8 GiB AF00 Rosemary

3 440387056 586348015 69.6 GiB AF00 Untitled

4 586610688 1172547583 279.4 GiB 0700 WINNIE

Command (? for help): d

Partition number (1-4): 4

Command (? for help): n

Partition number (4-128, default 4):

First sector (34-1465149134, default = 586348016) or {+-}size{KMGTP}: 586610688

Last sector (586610688-1465149134, default = 1465149134) or {+-}size{KMGTP}:

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): 0700

Changed type of partition to 'Microsoft basic data'

Command (? for help): p

Disk /dev/disk1: 1465149168 sectors, 698.6 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): C9579524-72E1-4DDB-820A-BD937B136BB6

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 1465149134

Partitions will be aligned on 8-sector boundaries

Total free space is 262678 sectors (128.3 MiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 440387055 209.8 GiB AF00 Rosemary

3 440387056 586348015 69.6 GiB AF00 Untitled

4 586610688 1465149134 418.9 GiB 0700 Microsoft basic data

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

PARTITIONS!!

Do you want to proceed? (Y/N): y

OK; writing new GUID partition table (GPT) to /dev/disk1.

Warning: The kernel may continue to use old or deleted partitions.

You should reboot or remove the drive.

The operation has completed successfully.

Reply

Answer 6

Fahrwahr Author

Level 1

55 points

Jun 28, 2013 3:13 PM in response to Christopher Murphy

The partition came back in Snow Leopard correctly, but it still won't mount in Windows 7, and now Windows 7 Disk Management is showing the space as unallocated rather than having a RAW partition.

Reply

Answer 7

Jun 28, 2013 3:19 PM in response to Fahrwahr

When you say it's back in Snow Leopard, you mean it mounts readonly and you can extract your data from this backup? If there's anything in the backup you want to retain, I'd move it to new media at this time. And then if that's successful, reboot to Windows, have it format that Windows backup partition as NTFS, and then move the offloaded backup back to the cleanly formatted volume. I really wouldn't worry about test disk any further, or trying to fix it if OS X's read only support can get you the data you want.

And just for confirmation can you post the result from:

sudo fdisk /dev/disk1

I want to make sure the hybrid MBR is gone.

Reply

Answer 8

Fahrwahr Author

Level 1

55 points

Jun 28, 2013 4:51 PM in response to Christopher Murphy

Disk: /dev/disk1

geometry: 91201/255/63 [1465149168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 439977416] HFS+

3: AF 1023 254 63 - 1023 254 63 [ 440387056 - 145960960] HFS+

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

gpt is still reporting "Suspicious MBR at sector 0". The partition appears as NTFS when booted into Snow Leopard, and I can see the Windows backup files in the drive.

Reply

Answer 9

Jun 28, 2013 5:21 PM in response to Fahrwahr

The suspicious MBR message means that the MBR isn't a protective MBR as required by the EFI/UEFI spec which defines the GPT scheme. The message means it's a hybrid MBR, which is what Apple's Bootcamp creates, and you don't need that since you aren't booting Windows from this external disk (and likely you can't anyway).

I'd go back to gdisk and do this:

sudo gdisk /dev/disk1

x to get to the expert menu

n to create a new protective MBR

w to write out the changes

y to confirm

That'll create a protective MBR, which has a single 0xEE entry that defines the entire disk is reserved for GPT only.

So at this point if you can grab the backup files you want to preserve, do that, and then reboot to Windows and reformat this 4th partition NTFS so you're working with a known good clean filesystem for your Windows backups from this point forward. The alternatives are sortof a PITA and probably not worth it but if for some reason you want to know what they are let me know.

Reply

Answer 10

Fahrwahr Author

Level 1

55 points

Jun 28, 2013 7:37 PM in response to Christopher Murphy

YES! Creating the protective MBR brought the partition back in Windows 7. Am I good to go to use the partition as-is, or is that too risky?

For future reference, if I want to set up a new external hard disk such that I can have a bootable HFS+ partition, a non-bootable HFS+ partition for Time Machine, and a non-bootable NTFS partition for Windows Backup, how do I set up the drive to use GPT without the hybrid MBR?

Reply

Answer 11

Jun 28, 2013 7:42 PM in response to Fahrwahr

I'd still run chkdsk /f on it from Windows to make sure the file system is OK, as long as it doesn't complain or fixes any problems persistently, then it's usable as is.

To set up a new external disk as described, if you want to use Disk Utility, make them all JHFS+ volumes, and then reformat the one you want NTFS from within Windows. It will change the GPT partition type GUID to that of NTFS and also reformat that partition. If you use Disk Utility to make an MSDOS partition, then it'll create a hybrid MBR, which you don't want or need.

Reply

Answer 12

Fahrwahr Author

Level 1

55 points

Jun 28, 2013 7:55 PM in response to Christopher Murphy

chkdsk is happy, so I'm pressing forward with it.

Thanks for all your help. I love to tinker with things, but I prefer to do so with a fair amount of confidence that I'm not going to blow up my data. 🙂

Reply

Answer 13

Fahrwahr Author

Level 1

55 points

Jul 19, 2013 12:23 PM in response to Christopher Murphy

Unfortunately, it now appears that I've lost the non-backup partition (which had a Leopard installation for troubleshooting). Here's what I'm getting from gpt and fdisk:

gpt show: disk1: mediasize=750156374016; sectorsize=512; blocks=1465149168 start size index contents 0 1 PMBR 1 1 Pri GPT header 2 32 Pri GPT table 34 6 40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B 409640 439977416 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC 440387056 145960960 3 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 586348016 262672 586610688 878538447 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 1465149135 32 Sec GPT table 1465149167 1 Sec GPT header

Disk: /dev/disk1 geometry: 91201/255/63 [1465149168 sectors] Signature: 0xAA55 Starting Ending #: id cyl hd sec - cyl hd sec [ start - size] ------------------------------------------------------------------------ 1: EE 0 0 2 - 1023 255 63 [ 1 - 1465149167] <Unknown ID>

2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused 3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused 4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Reply

Answer 14

Fahrwahr Author

Level 1

55 points

Jul 19, 2013 12:36 PM in response to Fahrwahr

Apparently this partition does not appear when I'm booted into Mac OS X Snow Leopard 10.6.8, but it DOES appear when I start up in Windows 7 (the reverse of my original problem when I couldn't get the NTFS-formatted backup partition to appear). Can't they all just get along? 😕

Reply

Answer 15

Jul 19, 2013 2:34 PM in response to Fahrwahr

The GPT and MBR look correct, assuming you do not want to boot Windows from this disk. The only partition marked as being for JHFS+ is disk1s2. There are two NTFS partitions on the disk, disk1s3 and disk1s4.

It merely sounds like it's not automounting for whatever reason. Try:

diskutil mount disk1s2

I'm not necessarily expecting that to work, but I'd like to know what error message you get when you try it. Have you tried running Disk Utility -> Verify agains this volume?

Reply