Fixing missing Bootcamp partition after Mavericks rewrote wrong GPT

I will try and run testdisk again and try the "Deeper Search" option. I've tried this before, and you're right, this takes a long time so I stopped it. I really don't want to write off the data as a loss bc I goofed and didn't back any of it up.

I'll report back once testdisk is complete with the scan and see if I can make sense of the results. I've been trying lots of different things from these forums so it is possible that I've manually messed something up.

I'm confused about my Bootcamp partition showing up but when you enter "p" in testdisk I don't see any of my files. That leads me to believe that it isn't the correct partition. Thoughts?

Also, when I go to Bootcamp Assistant it doesn't recognize an installed windows directory and will not allow me to do any resizing. So I think I definitely screwed something up... Have either of you ever heard of gpt_surgeon.py? It's a python script that I ran because, at first, I didn't even have a Mac partition to boot from after installing Mavericks. Anyway, I ran it and it worked like a charm and it recovered my Mac partition but i'm just wondering if it affected the rest?

Thanks a ton and your help is appreciated!

Was there any partition work done between the original Bootcamp installation and Mavericks upgrade?

Was the Recovery HD excercised prior to the Mavericks upgrade, with Bootcamp in place?

Yes, I remember I had similar issues with Mountain Lion and I had to do some tweaks(not sure what) to make my drives bootable again.

I dont think I touched the Recovery HD during that ML upgrade but I honestly don't remember.

Downloaded gpt_surgeon.py on my test machine.

The repair option makes me nervous. The disk being modified could have locks, could be mounted, another utility may also be modifying the disk partition, etc., which the script does not seem to account for. Also, it can only change a partition to HFS+ but has no mechanism of rolling it back, and does not ask for confirmation, if the user picks the incorrect partition number. If a partition does become HFS+ (if it originally was BOOTCAMP) and is mounted, it can cause corruption. Not for the faint of the heart. 😉

sudo python gpt_surgeon.py list /dev/disk0

Password:

Read MBR and GPT from /dev/disk0.

partition 0:

type: EFI System

name: u'EFI System Partition'

flags: 0x00000000

partition 1:

type: Apple HFS+

name: u'Macintosh HD'

flags: 0x00000000

partition 2:

type: Apple Boot

name: u'Recovery HD'

flags: 0x2000000000000

partition 3:

type: Microsoft Basic Data

name: u'BOOTCAMP'

flags: 0x00000000

It's dated from 2010. gdisk is actively maintained and is the right tool to use for partitioning gpt disks.

Ok so this is the latest update.

I ran the "Deeper search" option using testdisk and it found a ton of results. I went through each partition and I found the BOOTCAMP partition. I was able to view all my files so I selected that partition and then I hit "write". There were too many results to find the Mac OS X partition so I just selected the BOOTCAMP partition without selected any Mac OS X partitions. So now I'm to the point where I can see all my bootcamp files but now I need to add my Mac OS X partition back. I was hoping that I can use some information from my original post that will easily allow me to manually add the Mac partition.

Let me paste my current configuration and hopefully I can get some guidance on to properly add my Mac partition back. Thanks in advance for the help.

Andress-iMac:~ andressosa$ sudo fdisk /dev/rdisk0

Password:

Disk: /dev/rdisk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1 0 1 - 1023 0 1 [ 1 - 1953525167] <Unknown ID>

2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Andress-iMac:~ andressosa$ sudo gpt -r -v show /dev/rdisk0

gpt show: /dev/rdisk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

start size index contents

0 1 PMBR

1 1 Pri GPT header

2 32 Pri GPT table

34 1743144926

1743144960 210378752 1 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

You should not have chosen "write" in test disk. You've erased all partitions except for the one you just wrote, so whatever you do don't shutdown or reboot until you fix this or you won't be able to startup the computer.

Using gdisk add the following four partitions using their original start and end sector values you posted (I did the ending sector computation) and the 3rd column is the type code to use for each partition. After you've added them all, use the s command to resort the list. Then use r to go to the recovery menu, h to create a new hybrid MBR. Add partitions 2 and 5 to the MBR by just typing 2 5. Just a space between them, and enter. Y to add the EFI GPT to the first MBR entry. Accept the default type code by just hitting enter when asked. When asked, do not make 2 bootable, but do make 5 bootable. When asked if you want to add more entries answer n. And then use w to write out the change to disk. Before rebooting I suggest you post the results from the previous fdisk and gpt commands yet again to confirm the changes you've made are correct.

40 409639 ef00

409640 587030719 af00

587030720 588300263 ab00

588300264 589569799 ab00

I've posted fdisk, gpt, and gdisk results. Thanks for helping out so quickly.

Recovery/transformation command (? for help): o

Disk size is 1953525168 sectors (931.5 GiB)

MBR disk identifier: 0x24112411

MBR partitions:

Number Boot Start Sector End Sector Status Code

1 1 411647 primary 0xEE

2 411648 587030719 primary 0xAF

3 * 1743144960 1953523711 primary 0x07

Andress-iMac:~ andressosa$ sudo gpt -r -v show /dev/rdisk0

gpt show: /dev/rdisk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/rdisk0: Suspicious MBR at sector 0

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 2014

2048 407592 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 2008

411648 586619072 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

587030720 1856

587032576 1267688 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

588300264 24

588300288 1269512 4 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

589569800 1153575160

1743144960 210378752 5 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

Andress-iMac:~ andressosa$ sudo fdisk /dev/rdisk0

Disk: /dev/rdisk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 159 6 [ 1 - 411647] <Unknown ID>

2: AF 25 159 7 - 1023 254 63 [ 411648 - 586619072] HFS+

*3: 07 1023 254 63 - 1023 254 63 [1743144960 - 210378752] HPFS/QNX/AUX

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Andress-iMac:~ andressosa$

Also, I didnt mention that I'm running Mac from a USB hard drive in order to troubleshoot my main drive. (just an FYI)

OK so this is wrong, and I think I know why. You entered in the correct value, but gdisk by default aligns sectors to 1MB so it corrected them for you and you didn't notice this. So you need to go back to gdisk:

x for the expert menu

l to change the sector alignment value

1 to change to alignment of 1 sector

m to return to the main menu

d

1

d

2

d

3

d

4 this sequence deletes partitions 1 through 4

Now create new partitions 1 through 4 again, and enter the same start and end values as before, with the proper type code. And once you're done with partition 4, you need to use r to get to the recovery menu, and h to create a new hybrid mbr. Do the same thing as before. When done with that, w to write out the changes. And again fdisk and gpt commands as before, and post those results.

You're right this is the message that gdisk gave me.

Command (? for help): n

Partition number (2-128, default 2):

First sector (34-1953525134, default = 2048) or {+-}size{KMGTP}: 40

Information: Moved requested sector from 40 to 2048 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (2048-1743144959, default = 1743144959) or {+-}size{KMGTP}: 409639

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): ef00

Changed type of partition to 'EFI System'

Command (? for help): n

Partition number (3-128, default 3):

First sector (34-1953525134, default = 411648) or {+-}size{KMGTP}: 409640

Information: Moved requested sector from 409640 to 411648 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (411648-1743144959, default = 1743144959) or {+-}size{KMGTP}: 587030719

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00):

Changed type of partition to 'Apple HFS/HFS+'

Command (? for help): n

Partition number (4-128, default 4): 587030720

Value out of range

Partition number (4-128, default 4): 588300263

Value out of range

Partition number (4-128, default 4): 4

First sector (34-1953525134, default = 587032576) or {+-}size{KMGTP}: 587030720

Information: Moved requested sector from 587030720 to 587032576 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (587032576-1743144959, default = 1743144959) or {+-}size{KMGTP}: 588300263

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): ab00

Changed type of partition to 'Apple boot'

Command (? for help): n

Partition number (5-128, default 5):

First sector (34-1953525134, default = 588300288) or {+-}size{KMGTP}: 588300264

Information: Moved requested sector from 588300264 to 588300288 in

order to align on 2048-sector boundaries.

Use 'l' on the experts' menu to adjust alignment

Last sector (588300288-1743144959, default = 1743144959) or {+-}size{KMGTP}: 589569799

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): ab00

Changed type of partition to 'Apple boot'

Stand by let me try your last suggestion.

I think this did it! I havent restarted yet but after remounting my drive I can see both bootcamp and Mac drive. The only part that stands out is the size of the drives. Currently mac drive is 300GB and BOOTCAMP is 107GB. Where did the rest go? This is more of a curiosity because I think it will be best for me to back my important info and wipe this drive clean and start over. Do you agree?

Andress-iMac:~ andressosa$ sudo fdisk /dev/rdisk0

Password:

Disk: /dev/rdisk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 586621080] HFS+

*3: 07 1023 254 63 - 1023 254 63 [1743144960 - 210378752] HPFS/QNX/AUX

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Andress-iMac:~ andressosa$ sudo gpt -r -v show /dev/rdisk0

gpt show: /dev/rdisk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/rdisk0: Suspicious MBR at sector 0

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 586621080 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

587030720 1269544 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

588300264 1269536 4 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

589569800 1153575160

1743144960 210378752 5 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

If you look at the unnumbered line between partitions 4 and 5, the size column is 1153575160 which is 550GB. So if OS X is intact and if the Bootcamp volume mounts or boots and you have access to your files, then that means one of the resize steps didn't work out, likely the one intended to make Windows bigger. In any case, yes, once you've got backups, blow the whole thing away: repartition with a single partition, install OS X and install any updates, then use Bootcamp Assistant to resize the drive the way you want. Then restore OS X backup. Reinstall Windows and restore data from backup (or if you're using something like a new version of Winclone for the backup/restore, it'll backup and restore all of Windows and your data and will resize it to fit the new Bootcamp partition you've created).

Or alternatively, as I increasingly recommend, use a VM for Windows so you don't have to deal with the risks of Bootcamp and dual booting.

Is it safe to run windows repair to try and boot windows? Or will this damage my partition further?

As long as Windows does not want to repair any disk partition related stuff, a repair/windows update should be fine.

If you are starting over, the following may not matter, and you have a USB stick to boot/mount the machine anyway.

In your fdisk output, this (the Recovery HD) is missing. (This is your GPT 3 or GPT 4 and can be found with Testdisk).

587030720 588300263 ab00