Bootcamp Problems after Yosemite Update

Question

Level 1

0 points

Bootcamp Problems after Yosemite Update

Hello, community. As many before me quite recently, I've been having troubles with my win 7 bootcamp partition after updating to yosemite. Having gone through many methods online going into making the partition workable again, I've found Loner T's methods the only ones that seem to work.

I've followed most of the necessary steps I've garnered from a bunch of the other threads here, and have installed Parted Magic unto a bootable USB and with testdisk found a sector that seems to identically match my sudo fdisk /dev/disk0 output that I get in OS X:

Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 1 - 1023 254 63 [ 1 - 409639] <Unknown ID>

*2: AF 1023 254 63 - 1023 254 63 [ 409640 - 400650744] HFS+

3: AF 1023 254 63 - 1023 254 63 [ 401060384 - 1269536] HFS+

4: DA 1023 254 63 - 1023 254 63 [ 412110848 - 78123008] <Unknown ID>

In Parted Magic, after choose EFI/GPT, analyze, and quick search, I get,

Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO)

Partition Start End Size in sectors

P EFI System 40 409639 409600 [EFI]

D Mac HFS 409640 400335143 399925504

D MS Data 314429448 402331648 87902201

D Mac HFS 401060384 402329919 1269536

D MS Data 402331648 490233848 87902201

>D MS Data 412110848 490233855 78123008

D Mac HFS 488965176 490234711 1269536

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

NTFS found using backup sector, blocksize=4096, 39 GB / 37 GiB

The MS Data on the bottom's start and size matches the one I've found earlier. So what do I do from now? I could not make out fully what to do at this point in the process, and would like further advising. Currently I am deep searching the MS Data partition. Thanks to all who respond beforehand (especially Loner T)!!

MacBook Pro with Retina display, OS X Yosemite (10.10)

Posted on Oct 19, 2014 10:15 PM

Reply

Answer 1

Loner T

Level 9

59,477 points

Oct 20, 2014 6:37 AM in response to coolio0071

Once you see a partition that has "System Volume Information" in one of the MS Data partitions, and see other familiar files, the corresponding GPT entry which is stale needs to be deleted and recreated with appropriate values and checked for NTFS header. If all that works, then Windows recovery can be tried.

Reply

Answer 2

coolio0071 Author

Level 1

0 points

Oct 20, 2014 10:32 AM in response to Loner T

So, should I be looking in that MS Data partition as I am trying to currently?

Also, for the second time in a row after deep searching I've gotten to a 40Gb~ sector very deep in the resulting list that mine checking it for files causes my testdisk to crash. Is this potentially the sector I'm looking for? What should I do with the crashing?

Reply

Answer 3

Loner T

Level 9

59,477 points

Oct 20, 2014 10:42 AM in response to coolio0071

Does it crash with an error message? I would skip the partition that is causing the crash and move to the next available one. If no other entry yields results of familiar files, then this should be considered a candidate. Do you recall if your Windows partition i roughly the same size?

Reply

Answer 4

coolio0071 Author

Level 1

0 points

Oct 20, 2014 3:17 PM in response to Loner T

My Windows partition was set to 40Gb. And there is no error message; the testdisk terminal window just closes abruptly.

Reply

Answer 5

Loner T

Level 9

59,477 points

Oct 20, 2014 3:24 PM in response to coolio0071

Can you post the output of

sudo gpt -vv -r show /dev/disk0

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

this should provide a bit more detail.

Are you able to skip this partition that causes the crash, or is it not possible?

Are you using the version of Testdisk (WIP7.0) or the stable 6.1.4+ version? Is this a version which came with Parted Magic?

Reply

Answer 6

coolio0071 Author

Level 1

0 points

Oct 20, 2014 5:32 PM in response to coolio0071

I just found this, and it seems like what I was looking for? What do I do now?

I got this on my Mac side now because I had to do work there, and the test disk version there is 7.0. This time I may have not touched the specific crashing partition because I searched in a different spot!

MS Data

402331648 490233848 87902201

Directory /

>dr-xr-xr-x	0	0	0 15-Oct-2014 20:28 .
dr-xr-xr-x	0	0	0 15-Oct-2014 20:28 ..
dr-xr-xr-x	0	0	0 25-May-2014 01:43 $Recycle.Bin
dr-xr-xr-x	0	0	0 5-Jul-2014 20:20 .Trashes
dr-xr-xr-x	0	0	0 5-Jul-2014 20:20 .fseventsd
dr-xr-xr-x	0	0	0 26-May-2014 05:28 Boot
dr-xr-xr-x	0	0	0 27-Aug-2014 23:44 Heroes of Might and Magic V
dr-xr-xr-x	0	0	0 25-May-2014 01:38 Intel
dr-xr-xr-x	0	0	0 29-Aug-2014 06:12 My Web Sites
dr-xr-xr-x	0	0	0 25-May-2014 21:48 NVIDIA
dr-xr-xr-x	0	0	0 13-Jul-2009 23:20 PerfLogs
dr-xr-xr-x	0	0	0 26-Sep-2014 03:11 Program Files
dr-xr-xr-x	0	0	0 15-Oct-2014 19:04 Program Files (x86)
dr-xr-xr-x	0	0	0 26-Sep-2014 03:11 ProgramData
Next

Use Right to change directory, h to hide Alternate Data Stream

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

Reply

Answer 7

coolio0071 Author

Level 1

0 points

Oct 20, 2014 5:28 PM in response to coolio0071

And the info you asked for as well,

gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 490234751

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 400650744 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

401060384 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

402329920 9780928

412110848 78123008 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

490233856 863

490234719 32 Sec GPT table

490234751 1 Sec GPT header

Michaels-MacBook-Pro-2:~ Michael$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000 b2 68 7b bb d3 42 3c 78 c4 6d dc fb c4 a5 ff 57 |.h{..B<x.m.....W|

00000010 1a ca e5 70 0b c0 ec 14 b2 68 7b bb d3 42 3c 78 |...p.....h{..B<x|

00000020 c4 6d dc fb c4 a5 ff 57 dd c9 aa 21 26 33 0b 99 |.m.....W...!&3..|

00000030 b2 68 7b bb d3 42 3c 78 c4 6d dc fb c4 a5 ff 57 |.h{..B<x.m.....W|

00000040 cb 74 8e f1 93 41 f9 ca b2 68 7b bb d3 42 3c 78 |.t...A...h{..B<x|

00000050 c4 6d dc fb c4 a5 ff 57 b1 27 30 6d 86 93 e0 23 |.m.....W.'0m...#|

00000060 2b 5f d9 81 68 c4 3a 61 c4 6d dc fb c4 a5 ff 57 |+_..h.:a.m.....W|

00000070 a4 24 e4 90 2a c8 f8 4c 2b 5f d9 81 68 c4 3a 61 |.$..*..L+_..h.:a|

00000080 c4 6d dc fb c4 a5 ff 57 ef 45 31 72 64 09 f6 14 |.m.....W.E1rd...|

00000090 b2 68 7b bb d3 42 3c 78 c4 6d dc fb c4 a5 ff 57 |.h{..B<x.m.....W|

000000a0 0c 78 4c 3b 38 6b 75 c5 b2 68 7b bb d3 42 3c 78 |.xL;8ku..h{..B<x|

000000b0 c4 6d dc fb c4 a5 ff 57 ed f6 63 30 c3 e6 a9 cf |.m.....W..c0....|

000000c0 b2 68 7b bb d3 42 3c 78 c4 6d dc fb c4 a5 ff 57 |.h{..B<x.m.....W|

000000d0 e6 f1 d3 56 96 03 22 f4 2b 5f d9 81 68 c4 3a 61 |...V..".+_..h.:a|

000000e0 c4 6d dc fb c4 a5 ff 57 c3 53 f6 cb 47 b6 b1 96 |.m.....W.S..G...|

000000f0 2b 5f d9 81 68 c4 3a 61 c4 6d dc fb c4 a5 ff 57 |+_..h.:a.m.....W|

00000100 b7 95 8d 64 8d b5 34 b7 2b 5f d9 81 68 c4 3a 61 |...d..4.+_..h.:a|

00000110 c4 6d dc fb c4 a5 ff 57 2a a7 c7 d3 79 94 a4 f7 |.m.....W*...y...|

00000120 2b 5f d9 81 68 c4 3a 61 c4 6d dc fb c4 a5 ff 57 |+_..h.:a.m.....W|

00000130 3a e7 f3 a8 31 22 51 a0 2b 5f d9 81 68 c4 3a 61 |:...1"Q.+_..h.:a|

00000140 c4 6d dc fb c4 a5 ff 57 67 a6 e2 bc f1 18 7a 7d |.m.....Wg.....z}|

00000150 2b 5f d9 81 68 c4 3a 61 c4 6d dc fb c4 a5 ff 57 |+_..h.:a.m.....W|

00000160 07 d0 f7 b3 5c e2 05 a5 2b 5f d9 81 68 c4 3a 61 |....\...+_..h.:a|

00000170 c4 6d dc fb c4 a5 ff 57 95 71 28 d7 85 35 b3 ec |.m.....W.q(..5..|

00000180 b2 68 7b bb d3 42 3c 78 c4 6d dc fb c4 a5 ff 57 |.h{..B<x.m.....W|

00000190 2b 12 3f 4f 6f 7a 3d 11 b2 68 7b bb d3 42 3c 78 |+.?Ooz=..h{..B<x|

000001a0 c4 6d dc fb c4 a5 ff 57 22 20 f6 a9 b6 d2 09 84 |.m.....W" ......|

000001b0 2b 5f d9 81 68 c4 3a 61 c4 6d dc fb c4 a5 ff 57 |+_..h.:a.m.....W|

000001c0 89 67 30 f5 8c cd 77 53 2b 5f d9 81 68 c4 3a 61 |.g0...wS+_..h.:a|

000001d0 c4 6d dc fb c4 a5 ff 57 38 2f 6c bc 86 6a a0 b3 |.m.....W8/l..j..|

000001e0 2b 5f d9 81 68 c4 3a 61 c4 6d dc fb c4 a5 ff 57 |+_..h.:a.m.....W|

000001f0 91 12 1b 72 4c fe 2b b5 2b 5f d9 81 68 c4 3a 61 |...rL.+.+_..h.:a|

00000200

Reply

Answer 8

Loner T

Level 9

59,477 points

Oct 20, 2014 6:53 PM in response to coolio0071

Since these files look very familiar, the Yosemite update incorrectly moved your partitions and corrupted your NTFS header. This seems to be located between GPT3 and GPT4, so you should not lose any data.

Your NTFS start, end and size triplet is

402331648 490233848 87902201

If you look at Windows error loading after Yosemite upgrade, there are 6 steps and 4 tests with an example, which should be done in that sequence. your start/end/size are different than what is mentioned in the referenced thread. If you are comfortable executing them, please use them, otherwise I can cut and paste them here and put the start/end pair that you have. If you need details of step 5, please ask. It also uses Gdisk.

Reply

Answer 9

coolio0071 Author

Level 1

0 points

Oct 20, 2014 9:29 PM in response to Loner T

So I input these commands, just to make sure?

sudo gdisk /dev/disk0

p

d

4

n

4

402331648

490233848

0700

p

w

y

then,

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

And step 5, I really do want clear instructions with this, as one screw up and it's over. Thanks so much already, Loner T.

Reply

Answer 10

Loner T

Level 9

59,477 points

Oct 21, 2014 5:51 AM in response to coolio0071

You need a reboot after the GPT change for disk0s4 to be rebuilt. Test 1,2 and 3 can be done, without Step 5. Post back once you get to that stage. The Hybrid MBR is a quick step.

Reply

Answer 11

coolio0071 Author

Level 1

0 points

Oct 21, 2014 10:14 AM in response to Loner T

Everything has been done, and after the second command, the first line does start with R.NTFS. Not sure what to do about step 4, but by your indication it seems not really necessary.

Reply

Answer 12

Loner T

Level 9

59,477 points

Oct 21, 2014 10:36 AM in response to coolio0071

If you can see the NTFS header, excellent. To re-create the Hybrid MBR (step 5) take a look at the following example. After you type 'w', type 'y' to confirm, reboot, repeat tests 1,2,3 to confirm nothing is broken, and then try test4.

sudo gdisk /dev/disk0

Password:

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: protective

BSD: not present

APM: not present

GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): p

Disk /dev/disk0: 976773168 sectors, 465.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 957085DC-3AE0-41B3-B770-BAB3A0230399

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 976773134

Partitions will be aligned on 8-sector boundaries

Total free space is 1997 sectors (998.5 KiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 813394215 387.7 GiB AF00 Mac

3 813394216 814663751 619.9 MiB AB00 Recovery HD

4 814665728 976773119 77.3 GiB 0700 BOOTCAMP

Command (? for help): r

Recovery/transformation command (? for help): h

WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

just hit the Enter key at the below prompt and your MBR partition table will

be untouched.

Type from one to three GPT partition numbers, separated by spaces, to be

added to the hybrid MBR, in sequence: 2 3 4

Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y

Creating entry for GPT partition #2 (MBR partition #2)

Enter an MBR hex code (default AF): AF

Set the bootable flag? (Y/N): n

Creating entry for GPT partition #3 (MBR partition #3)

Enter an MBR hex code (default AB): AB

Set the bootable flag? (Y/N): n

Creating entry for GPT partition #4 (MBR partition #4)

Enter an MBR hex code (default 07): 07

Set the bootable flag? (Y/N): y

Recovery/transformation command (? for help): w

Reply

Answer 13

coolio0071 Author

Level 1

0 points

Oct 21, 2014 1:07 PM in response to Loner T

So I rebuilt the Hybrid MBR, and redid test 1-3 fine. Then I went on to test 6, and I can see my Bootcamp in Finder, can access its files, but can't see it as a choice in startup disk. What should I do now? I figure I should load my Windows recovery drive and let it do its thing?

Reply

Answer 14

Loner T

Level 9

59,477 points

Oct 21, 2014 1:15 PM in response to coolio0071

Can you post the output of sudo fdisk /dev/disk0 and sudo gpt -vv -r show /dev/disk0?

Reply

Answer 15

coolio0071 Author

Level 1

0 points

Oct 21, 2014 1:15 PM in response to Loner T

Sure.

Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 400650744] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 401060384 - 1269536] Darwin Boot

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Reply