I’m running win7 x64 and OS X on MacBook air. Yesterday i made regular bootcamp back-up. When back-up is processing, i cancel it. After that, i can’t boot to win7.
Results of the “sudo gpt -r -vv show disk0”
Results of the “sudo fdisk /dev/disk0”
Is there any recommendation? thank you
MacBook Air, Mac OS X (10.5.1)
the output of sudo gpt -vv -r show /dev/"disk0s3"
applematoMacBook-Air:~ apple$ sudo gpt -vv -r show /dev/"disk0s3"
gpt show: /dev/disk0s3: mediasize=650002432; sectorsize=512; blocks=1269536
gpt show: /dev/disk0s3: MBR not found at sector 0
start size index contents
0 1269536
bob_silicon wrote:
409640 244140624 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC
244550264 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
245819800 1640
245821440 244151128 4 GPT part - 48465300-0000-11AA-AA11-00306543ECAC
It looks like your Bootcamp partition became HFS+ (the long string after GPT #2 and #4 is identical 48465300-0000-11AA-AA11-00306543ECAC) .
For reference please see http://en.wikipedia.org/wiki/GUID_Partition_Table . TM normally cannot backup a Bootcamp partition since it is NTFS.
Please post the output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C .
For a working Bootcamp installation
sudo gpt -vv -r show /dev/disk0
Password:
gpt show: /dev/disk0: mediasize=256060514304; sectorsize=512; blocks=500118192
gpt show: /dev/disk0: Suspicious MBR at sector 0
gpt show: /dev/disk0: Pri GPT at sector 1
gpt show: /dev/disk0: Sec GPT at sector 500118191
start size index contents
0 1 MBR
1 1 Pri GPT header
2 32 Pri GPT table
34 6
40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
409640 250392096 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC
250801736 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
252071272 664
252071936 248045568 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
500117504 655
500118159 32 Sec GPT table
500118191 1 Sec GPT header
the output of sudo fdisk /dev/disk0
applematoMacBook-Air:~ apple$ sudo fdisk /dev/disk0
Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]
Signature: 0xAA55
Starting Ending
#: id cyl hd sec - cyl hd sec [ start - size]
------------------------------------------------------------------------
1: EE 1023 254 63 - 1023 254 63 [ 1 - 490234751] <Unknown ID>
2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused
3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused
4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused
the output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C
applematoMacBook-Air:~ apple$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200
1. The fdisk entry has 490234571, and it covers the entire disk. The MBR entries as they existed prior to the backup issue are gone.
2. The disk0s4 partition should have an NTFS header, but it does not.
3. Testdisk is the option that should be pursued to look for any deleted partition headers which should provide clues to where it might have existed.
4. I am still puzzled by the fact that you were backing up a Bootcamp(NTFS) partition using Time Machine. On my TM setup, the Bootcamp partition is grayed out. See the following image.
The bootcamp partition is grayed too in my TM setup, but it seems that w7 partition is damaged.
After teskdisk analyse, the output
After teskdisk qucik search, the output
I chose MS Data , but what shall i do next ?
thank you
1. You have two entries of 1269536 (entries 3 and 6), which is the recovery partition. This indicates that Recovery HD moved.
2. The entries at #4 and #5 start at the same sector. This is the most likely candidate. Choose the MS Data partition. Do not use the left/right arrow keys, but only up/down keys.
3. It should bring up a menu which says "P: List files". Please list files and see if the file names look like Windows files. If they do please note down the start and size for future reference.
4. In your first Testdisk output there are two entries and it says these partitions cannot be recovered.
I have chose MS Data and list files, unfortunately, testdisk output is
"Can't open filesystem, Filesystem sees damaged"😢
Are you allowed to run "Deeper Search" as shown the the test disk step-by-step page? If yes, it will search for backup boot sectors.
This is where it should be - http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#A_partition_is_still_missin g:_Deeper_Search
"Deeper search" took almost two hours. The output is as follows
What shall i do? thank you
Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO)
The harddisk (251 GB / 233 GiB) seems too small! (< 376 GB / 350 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
> MS Data 381057696 625470111 244412416
MS Data 384338112 628750527 244412416
MS Data 385447712 629860127 244412416
MS Data 388083112 632495527 244412416
MS Data 390759368 635171783 244412416
MS Data 391337408 635749823 244412416
MS Data 392232040 636644455 244412416
MS Data 396152768 640565183 244412416
MS Data 397540160 641952575 244412416
MS Data 397745472 642157887 244412416
MS Data 398062688 642475103 244412416
MS Data 399859400 644271815 244412416
MS Data 400505128 644917543 244412416
MS Data 400703816 645116231 244412416
MS Data 401196424 645608839 244412416
MS Data 401358944 645771359 244412416
MS Data 401721032 646133447 244412416
MS Data 402825888 647238303 244412416
MS Data 403677416 648089831 244412416
MS Data 404499968 648912383 244412416
MS Data 406601768 651014183 244412416
MS Data 408076488 652488903 244412416
MS Data 409434888 653847303 244412416
MS Data 410221832 654634247 244412416
Mac HFS 489972564 734123691 244151128
MS Data 490233855 734646270 244412416
> Mac HFS 490234708 491504243 1269536
Deeper Search is very time consuming.
In this list, are there any partitions that allow the option to "P: List files"? If yes, please check if there are any familiar Windows files in that specific partition. You may want to write down the start/end of such partitions as you find them, in a spreadsheet. These may need to be used later to re-construct your MBR/GPT as needed.
I found first MS data partition that allow the option "P"
D MS Data 138401704 138404583 2880
drwxr-xr-x 0 0 0 2-Jul-2014 19:48 AMD64
-rwxr-xr-x 0 0 98 2-Jul-2014 19:48 Autounattend.vbs
-rwxr-xr-x 0 0 6374 2-Jul-2014 19:48 Autounattend.xml
-rwxr-xr-x 0 0 0 2-Jul-2014 19:48 FDD.TAG
-rwxr-xr-x 0 0 105984 2-Jul-2014 19:48 IGT.EXE
-rwxr-xr-x 0 0 44544 2-Jul-2014 19:48 PRL_PV32.SYS
-rwxr-xr-x 0 0 177 2-Jul-2014 19:48 TXTSETUP.OEM
-rwxr-xr-x 0 0 81 2-Jul-2014 19:48 TXTSETUP.SIF
-rwxr-xr-x 0 0 1051 2-Jul-2014 19:48 WINNT.SIF
Cannot boot to windows 7 after canceling bootcamp backup
