bob_silicon

Q: Cannot boot to windows 7 after canceling bootcamp backup

Im running win7 x64 and OS X on MacBook air. Yesterday i made regular bootcamp back-up. When back-up is processing, i cancel it. After that, i cant boot to win7.


Results of the “sudo gpt -r -vv show disk0”

webwxgetmsgimg.jpg


Results of the “sudo fdisk /dev/disk0”

webwxgetmsgimg (2).jpg


Is there any recommendation? thank you

MacBook Air, Mac OS X (10.5.1)

Posted on Aug 15, 2014 8:38 PM

Close

Q: Cannot boot to windows 7 after canceling bootcamp backup

  • All replies
  • Helpful answers

first Previous Page 4 of 4
  • by bob_silicon,

    bob_silicon bob_silicon Sep 22, 2014 8:38 AM in response to Loner T
    Level 1 (0 points)
    Sep 22, 2014 8:38 AM in response to Loner T

    1. Bootcamp Volumes doesn't show up in OSX finder after updated the GUID of the GPT #4 entry to 0700

    2. I can't see any files in Bootcamp

     

  • by Loner T,

    Loner T Loner T Sep 22, 2014 9:42 AM in response to bob_silicon
    Level 7 (24,312 points)
    Safari
    Sep 22, 2014 9:42 AM in response to bob_silicon

    What files do you see via Testdisk at  245821440? Can you post a listing?

  • by bob_silicon,

    bob_silicon bob_silicon Sep 23, 2014 6:55 AM in response to Loner T
    Level 1 (0 points)
    Sep 23, 2014 6:55 AM in response to Loner T

    Something i found in testdisk.log

     

    Current partition structure:

       1 P EFI System                    40     409639     409600 [EFI System Partition]

       2 P Mac HFS                   409640  244550263  244140624 [???]

       3 P Mac Boot               244550264  245819799    1269536 [Recovery HD]

       4 P Mac HFS                245821440  489972567  244151128 [Apple_HFSX_Untitled_2]

     

    HFSX magic value at 245821440/0/1

     

    part_size 244151128

    Mac HFS                245821440  489972567  244151128

    HFSX blocksize=4096 + Backup, 125 GB / 116 GiB

     

    clusters_per_index_record 1

             MS Data                245821440  490233855  244412416

             NTFS found using backup sector, blocksize=4096, 125 GB / 116 GiB

     

    Results

           P EFI System                    40     409639     409600 [EFI]

              FAT32, blocksize=512, 209 MB / 200 MiB

           P Mac HFS                   409640  244550263  244140624

              HFS+ blocksize=4096 + Backup, 124 GB / 116 GiB

           P Mac HFS                244550264  245819799    1269536

              HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

             Mac HFS                245821440  489972567  244151128

             HFSX blocksize=4096 + Backup, 125 GB / 116 GiB

             MS Data                245821440  490233855  244412416

             NTFS found using backup sector, blocksize=4096, 125 GB / 116 GiB

             Mac HFS                488965176  490234711    1269536

             HFS+ found using backup sector!, 650 MB / 619 MiB

     

     

    HFSX magic value at 245821440/0/1

     

    HFSX magic value at 245821440/0/1

    part_size 244151128

          Mac HFS                245821440  489972567  244151128

          HFSX blocksize=4096 + Backup, 125 GB / 116 GiB

     

         Mac HFS                245821440  489972567  244151128

         HFSX blocksize=4096 + Backup, 125 GB / 116 GiB

  • by Loner T,

    Loner T Loner T Sep 23, 2014 9:31 AM in response to bob_silicon
    Level 7 (24,312 points)
    Safari
    Sep 23, 2014 9:31 AM in response to bob_silicon

    bob_silicon wrote:

     

     

    clusters_per_index_record 1

             MS Data                245821440  490233855  244412416

             NTFS found using backup sector, blocksize=4096, 125 GB / 116 GiB

     

     

             MS Data                245821440  490233855  244412416

             NTFS found using backup sector, blocksize=4096, 125 GB / 116 GiB

     

    This seems to be the most promising part. If you look at

     

    http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#A_partition_is_still_missin g:_Deeper_Search

     

    You can recover this partition entry using the steps outlined.

     

    In your GPT you have 489972567, but the MS Data in this entry is at 490233855. It should be changed in the GPT. This partition (245821440,490233855) should be also recovered using the backup sector.  Please list files via Testdisk, after you update GPT in this partition.

     

    Command (? for help): i

    Partition number (1-4): 4

    Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)

    Partition unique GUID: 38C13FC6-E08A-43D7-9181-55342A8B8E9A

    First sector: 245821440 (at 117.2 GiB)

    Last sector: 489972567 (at 233.6 GiB)

    Partition size: 244151128 sectors (116.4 GiB)

    Attribute flags: 0000000000000000

    Partition name: 'Apple_HFSX_Untitled_2'

  • by bob_silicon,

    bob_silicon bob_silicon Sep 25, 2014 6:36 AM in response to Loner T
    Level 1 (0 points)
    Sep 25, 2014 6:36 AM in response to Loner T

    The last sector in GPT is 489972567, but the last sector in test disk is 490233855.

    The number is different, so you want me to update GPT? I'm sorry i don't know how can i update GPT to 490233855

    I can't find command to change GPT in gdisk. thank you very much!

  • by Loner T,

    Loner T Loner T Sep 25, 2014 8:49 AM in response to bob_silicon
    Level 7 (24,312 points)
    Safari
    Sep 25, 2014 8:49 AM in response to bob_silicon

    The backup NTFS sector needs to be included.

     

    Using Gdisk,

    1. the current GPT#4 entry needs to be deleted.

    sudo gdisk /dev/disk0

    d

    4

     

    2. create a new GPT#4 with start 245821440 and size 244412416.

    n

    4

    245821440

    490233855

    p

    w

    y

     

    3. create a new hybrid MBR using the updated GPT.

    r

    h

    2 3 4 (say yes to allow EFI to be included in the MBR)

    (Partition 4 needs to be code 07 and flagged for boot ability. Accept defaults for partition 2,3).

    p

    w

    y

     

    Now run sudo fdisk /dev/disk0

    p

     

    and verify that GPT and MBR match.

     

    Verify that Finder can see Bootcamp, and you can see files in the volume. Verify that Startup disk shows Bootcamp.

    Switch to Bootcamp. If you get a black screen, it will need a Windows Startup Repair using Windows Installation media.

  • by bob_silicon,

    bob_silicon bob_silicon Oct 8, 2014 8:42 AM in response to Loner T
    Level 1 (0 points)
    Oct 8, 2014 8:42 AM in response to Loner T

    I have  updated GPT to 490233855, then i repaired Windows startup with U disk.

    When i reboot to windows, "A disk read error occurred" is displayed.

    Maybe Ms data partition was formatted by TM.  Anyway, thank you very much

  • by Loner T,

    Loner T Loner T Oct 8, 2014 8:54 AM in response to bob_silicon
    Level 7 (24,312 points)
    Safari
    Oct 8, 2014 8:54 AM in response to bob_silicon

    Please post the output of the following

     

    sudo gpt -vv -r show /dev/disk0

    sudo fdisk /dev/disk0

     

    It may be easily fixable.

  • by bob_silicon,

    bob_silicon bob_silicon Oct 9, 2014 8:37 AM in response to Loner T
    Level 1 (0 points)
    Oct 9, 2014 8:37 AM in response to Loner T

    The output of "sudo gpt -vv -r show /dev/disk0"

    sudo gpt -vv -r show /dev/disk0

    gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

    gpt show: /dev/disk0: Suspicious MBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 490234751

              start           size  index   contents

                  0                1             MBR

                  1                1             Pri GPT header

                  2               32            Pri GPT table

                 34                6        

                 40        409600      1   GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

           409640  244140624      2   GPT part - 48465300-0000-11AA-AA11-00306543ECAC

      244550264     1269536      3   GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

      245819800          1640        

      245821440  244412416      4   GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      490233856             863        

      490234719               32          Sec GPT table

      490234751                1           Sec GPT header

  • by bob_silicon,

    bob_silicon bob_silicon Oct 9, 2014 8:45 AM in response to Loner T
    Level 1 (0 points)
    Oct 9, 2014 8:45 AM in response to Loner T

    The output of "sudo frisk /dev/disk0"

    sudo fdisk /dev/disk0

    Password:

    Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE    0   0   2 -   25 127  14 [         1 -     409639] <Unknown ID>

    2: AF   25 127  15 - 1023 254  63 [    409640 -  244140624] HFS+      

    3: AB 1023 254  63 - 1023 254  63 [ 244550264 -    1269536] Darwin Boot

    *4: 07 1023 254  63 - 1023 254  63 [ 245821440 -  244412416] HPFS/QNX/AUX

     

    I almost want to give up, the worst result is Ms data partition  was formatted by TM

  • by Loner T,

    Loner T Loner T Oct 9, 2014 8:54 AM in response to bob_silicon
    Level 7 (24,312 points)
    Safari
    Oct 9, 2014 8:54 AM in response to bob_silicon

    To check if NTFS header is intact, can you post the output of

     

    sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

  • by bob_silicon,

    bob_silicon bob_silicon Oct 11, 2014 9:19 AM in response to Loner T
    Level 1 (0 points)
    Oct 11, 2014 9:19 AM in response to Loner T

    The output of "sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C"

     

    apple$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

    Password:

    00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|

    00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 f0 a6 0e  |........?.......|

    00000020  00 00 00 00 80 00 80 00  ff 6f 91 0e 00 00 00 00  |.........o......|

    00000030  00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|

    00000040  f6 00 00 00 01 00 00 00  7f 21 12 4a 5c 12 4a 6e  |.........!.J\.Jn|

    00000050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|

    00000060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|

    00000070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|

    00000080  55 aa 75 06 f7 c1 01 00  75 03 e9 dd 00 1e 83 ec  |U.u.....u.......|

    00000090  18 68 1a 00 b4 48 8a 16  0e 00 8b f4 16 1f cd 13  |.h...H..........|

    000000a0  9f 83 c4 18 9e 58 1f 72  e1 3b 06 0b 00 75 db a3  |.....X.r.;...u..|

    000000b0  0f 00 c1 2e 0f 00 04 1e  5a 33 db b9 00 20 2b c8  |........Z3... +.|

    000000c0  66 ff 06 11 00 03 16 0f  00 8e c2 ff 06 16 00 e8  |f...............|

    000000d0  4b 00 2b c8 77 ef b8 00  bb cd 1a 66 23 c0 75 2d  |K.+.w......f#.u-|

    000000e0  66 81 fb 54 43 50 41 75  24 81 f9 02 01 72 1e 16  |f..TCPAu$....r..|

    000000f0  68 07 bb 16 68 70 0e 16  68 09 00 66 53 66 53 66  |h...hp..h..fSfSf|

    00000100  55 16 16 16 68 b8 01 66  61 0e 07 cd 1a 33 c0 bf  |U...h..fa....3..|

    00000110  28 10 b9 d8 0f fc f3 aa  e9 5f 01 90 90 66 60 1e  |(........_...f`.|

    00000120  06 66 a1 11 00 66 03 06  1c 00 1e 66 68 00 00 00  |.f...f.....fh...|

    00000130  00 66 50 06 53 68 01 00  68 10 00 b4 42 8a 16 0e  |.fP.Sh..h...B...|

    00000140  00 16 1f 8b f4 cd 13 66  59 5b 5a 66 59 66 59 1f  |.......fY[ZfYfY.|

    00000150  0f 82 16 00 66 ff 06 11  00 03 16 0f 00 8e c2 ff  |....f...........|

    00000160  0e 16 00 75 bc 07 1f 66  61 c3 a0 f8 01 e8 09 00  |...u...fa.......|

    00000170  a0 fb 01 e8 03 00 f4 eb  fd b4 01 8b f0 ac 3c 00  |..............<.|

    00000180  74 09 b4 0e bb 07 00 cd  10 eb f2 c3 0d 0a 41 20  |t.............A |

    00000190  64 69 73 6b 20 72 65 61  64 20 65 72 72 6f 72 20  |disk read error |

    000001a0  6f 63 63 75 72 72 65 64  00 0d 0a 42 4f 4f 54 4d  |occurred...BOOTM|

    000001b0  47 52 20 69 73 20 6d 69  73 73 69 6e 67 00 0d 0a  |GR is missing...|

    000001c0  42 4f 4f 54 4d 47 52 20  69 73 20 63 6f 6d 70 72  |BOOTMGR is compr|

    000001d0  65 73 73 65 64 00 0d 0a  50 72 65 73 73 20 43 74  |essed...Press Ct|

    000001e0  72 6c 2b 41 6c 74 2b 44  65 6c 20 74 6f 20 72 65  |rl+Alt+Del to re|

    000001f0  73 74 61 72 74 0d 0a 00  8c a9 be d6 00 00 55 aa  |start.........U.|

    00000200

  • by Loner T,

    Loner T Loner T Oct 11, 2014 12:53 PM in response to bob_silicon
    Level 7 (24,312 points)
    Safari
    Oct 11, 2014 12:53 PM in response to bob_silicon

    Using bootrec.exe, you can rebuild the boot loader/manager

     

    http://support2.microsoft.com/kb/927392

     

     

    On my Bootcamp installation, i get the following using the same dd command. It looks similar to yours.

     

    sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

    Password:

    00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|

    00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 50 06 0f  |........?....P..|

    00000020  00 00 00 00 80 00 80 00  ff df c8 0e 00 00 00 00  |................|

    00000030  00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|

    00000040  f6 00 00 00 01 00 00 00  e1 b7 f7 ec f4 f7 ec 2a  |...............*|

    00000050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|

    00000060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|

    00000070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|

    00000080  55 aa 75 06 f7 c1 01 00  75 03 e9 dd 00 1e 83 ec  |U.u.....u.......|

    00000090  18 68 1a 00 b4 48 8a 16  0e 00 8b f4 16 1f cd 13  |.h...H..........|

    000000a0  9f 83 c4 18 9e 58 1f 72  e1 3b 06 0b 00 75 db a3  |.....X.r.;...u..|

    000000b0  0f 00 c1 2e 0f 00 04 1e  5a 33 db b9 00 20 2b c8  |........Z3... +.|

    000000c0  66 ff 06 11 00 03 16 0f  00 8e c2 ff 06 16 00 e8  |f...............|

    000000d0  4b 00 2b c8 77 ef b8 00  bb cd 1a 66 23 c0 75 2d  |K.+.w......f#.u-|

    000000e0  66 81 fb 54 43 50 41 75  24 81 f9 02 01 72 1e 16  |f..TCPAu$....r..|

    000000f0  68 07 bb 16 68 52 11 16  68 09 00 66 53 66 53 66  |h...hR..h..fSfSf|

    00000100  55 16 16 16 68 b8 01 66  61 0e 07 cd 1a 33 c0 bf  |U...h..fa....3..|

    00000110  0a 13 b9 f6 0c fc f3 aa  e9 fe 01 90 90 66 60 1e  |.............f`.|

    00000120  06 66 a1 11 00 66 03 06  1c 00 1e 66 68 00 00 00  |.f...f.....fh...|

    00000130  00 66 50 06 53 68 01 00  68 10 00 b4 42 8a 16 0e  |.fP.Sh..h...B...|

    00000140  00 16 1f 8b f4 cd 13 66  59 5b 5a 66 59 66 59 1f  |.......fY[ZfYfY.|

    00000150  0f 82 16 00 66 ff 06 11  00 03 16 0f 00 8e c2 ff  |....f...........|

    00000160  0e 16 00 75 bc 07 1f 66  61 c3 a1 f6 01 e8 09 00  |...u...fa.......|

    00000170  a1 fa 01 e8 03 00 f4 eb  fd 8b f0 ac 3c 00 74 09  |............<.t.|

    00000180  b4 0e bb 07 00 cd 10 eb  f2 c3 0d 0a 41 20 64 69  |............A di|

    00000190  73 6b 20 72 65 61 64 20  65 72 72 6f 72 20 6f 63  |sk read error oc|

    000001a0  63 75 72 72 65 64 00 0d  0a 42 4f 4f 54 4d 47 52  |curred...BOOTMGR|

    000001b0  20 69 73 20 63 6f 6d 70  72 65 73 73 65 64 00 0d  | is compressed..|

    000001c0  0a 50 72 65 73 73 20 43  74 72 6c 2b 41 6c 74 2b  |.Press Ctrl+Alt+|

    000001d0  44 65 6c 20 74 6f 20 72  65 73 74 61 72 74 0d 0a  |Del to restart..|

    000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

    000001f0  00 00 00 00 00 00 8a 01  a7 01 bf 01 00 00 55 aa  |..............U.|

    00000200

  • by bob_silicon,

    bob_silicon bob_silicon Oct 13, 2014 8:19 AM in response to Loner T
    Level 1 (0 points)
    Oct 13, 2014 8:19 AM in response to Loner T

    I have used "bootrec /FixMbr", "bootrec /Fixboot" "bootrec /RebuildBcd" command in window7 command line.

    But "A disk error occurred" is still displayed


  • by Loner T,

    Loner T Loner T Oct 13, 2014 8:36 AM in response to bob_silicon
    Level 7 (24,312 points)
    Safari
    Oct 13, 2014 8:36 AM in response to bob_silicon

    In your Bootcamp volume, if it is readable from OSX, can you check the following logs for any recent error messages?

     

    In my Bootcamp volume, these are the locations...

     

    pwd

    /Volumes/rMBPBCMP

     

    find . -name setupact.log -print

    ./Windows/Logs/DPX/setupact.log

    ./Windows/Panther/setupact.log

    ./Windows/Panther/UnattendGC/setupact.log

    ./Windows/setupact.log

    ./Windows/System32/sysprep/Panther/IE/setupact.log

first Previous Page 4 of 4