Bootcamp not working after Yosemite update

Question

Bootcamp not working after Yosemite update

Hi,

I have similar problem after updating to Yosemite, now I can't boot into windows. There is no Windows option at startup when holding on ALT button and in disk utility, it showed Mac OS X partition with disks greyed out. I updated to Yosemite on my 11 inch Mac air and Mac Pro with no problem, before I decided to update my sons iMac (which has his school work) and ran into this problem. I remembered I use a third party program called Paragon NTFS. Could this be the problem?

Please Help.

Posted on Oct 27, 2014 5:19 AM

Reply

Answer 1

Loner T

Level 9

59,513 points

Oct 27, 2014 6:42 AM in response to Redeagles-143

Yes, Paragon NTFS interferes with Apple's native NTFS driver. Can you temporarily disable/uninstall Paragon and test?

If it does not work, please post the output of the following Terminal commands (enter your password when prompted).

diskutil list

diskutil cs list

sudo gpt -vv -r show /dev/disk0

sudo fdisk /dev/disk0

Reply

Answer 2

Oct 27, 2014 7:33 AM in response to Loner T

Thanks for the reply, here is the screen shot of the commands.

Reply

Answer 3

Oct 27, 2014 7:37 AM in response to Redeagles-143

And here's the result of this command,

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Reply

Answer 4

Loner T

Level 9

59,513 points

Oct 27, 2014 7:40 AM in response to Redeagles-143

Try this simpler fix first...

sudo fdisk -e /dev/disk0

setpid 4

07

flag 4

p

w

y

Reboot and test.

PS: You second screen shot does not show a NTFS header. 😟, so the above may not work.

Can you download Testdisk (http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step) and GPT Fdisk (http://sourceforge.net/projects/gptfdisk/).

Reply

Answer 5

Oct 27, 2014 10:00 AM in response to Loner T

Downloaded the 2 software already. I'll try that once the TestDisk finishes analysing, it is almost done, here's the screen shot, i'll post it again once it is done.

The Windows 7 partition have about 7 to 8 users on it. I wanted to get the data from my son's account "Jake". Thanks in advance.

Reply

Answer 6

Loner T

Level 9

59,513 points

Oct 27, 2014 10:10 AM in response to Redeagles-143

The last two entries sized 479133696 look like potential candidates. Please scroll down to the first MS Data right at the end, and conch highlighted, click on Continue. Use "P" to list files.

Reply

Answer 7

Oct 27, 2014 4:33 PM in response to Loner T

Hi, thank you for your time.

I tried the simpler fix, and when rebooted, the windows partition showed up when hold on the ALT key, but when i tried to load it, it say "missing operating system".

In OSX, i can't see the bootcamp partition under Finder or on the desktop.

TestDisk did finish analysing the drive, but i accidentally quit the program before i could look into the files, so now running test disk again. However I did save the Testdisk log file before running it again. Here is the log file, if it is any help:

Mon Oct 27 12:03:27 2014

Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

OS: Darwin, kernel 14.0.0 (Darwin Kernel Version 14.0.0: Fri Sep 19 00:26:44 PDT 2014; root:xnu-2782.1

Compiler: GCC 4.0

Compilation date: 2014-10-23T06:49:09

ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504

Hard disk list

Disk /dev/disk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO), sector size=512

Partition table type (auto): EFI GPT

Media is opened in read-only.

Disk /dev/rdisk0 - 1000 GB / 931 GiB (RO)

Partition table type: EFI GPT

Analyse Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

hdr_size=92

hdr_lba_self=1

hdr_lba_alt=1953525167 (expected 1953525167)

hdr_lba_start=34

hdr_lba_end=1953525134

hdr_lba_table=2

hdr_entries=128

hdr_entsz=128

check_part_gpt failed for partition

4 P MS Data 860047360 1953523711 1093476352 [BOOTCAMP]

Current partition structure:

1 P EFI System 40 409639 409600 [EFI System Partition]

2 P Mac HFS 409640 858777823 858368184 [Mac OSX]

3 P Mac Boot 858777824 860047359 1269536 [Recovery HD]

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

4 P MS Data 860047360 1953523711 1093476352 [BOOTCAMP]

search_part()

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

FAT32 at 40/0/1

check_FAT: Unusual media descriptor (0xf0!=0xf8)

FAT1 : 32-3182

FAT2 : 3183-6333

start_rootdir : 6334 root cluster : 2

Data : 6334-409599

sectors : 409600

cluster_size : 1

no_of_cluster : 403266 (2 - 403267)

fat_length 3151 calculated 3151

heads/cylinder 16 (FAT) != 1 (HD)

sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1

EFI System 40 409639 409600 [EFI]

FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1

part_size 858368184

Mac HFS 409640 858777823 858368184

HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

HFS+ magic value at 858777824/0/1

part_size 1269536

Mac HFS 858777824 860047359 1269536

HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

LVM magic value at 868175852/0/1

MS Data 868847797 868847796 0

exFAT, blocksize=1, 0 B

Partition not added.

FAT12 at 868847979/0/1

check_FAT: Unusual media descriptor (0xf8!=0xf0)

FAT1 : 1-8

FAT2 : 9-16

start_rootdir : 17

Data : 49-20736

sectors : 20739

cluster_size : 8

no_of_cluster : 2586 (2 - 2587)

fat_length 8 calculated 8

FAT differs, FAT sectors=0-8/8

heads/cylinder 4 (FAT) != 1 (HD)

sect/track 17 (FAT) != 1 (HD)

FAT12 at 868847979/0/1

MS Data 868847979 868868717 20739 [NO NAME]

FAT12, blocksize=4096, 10 MB / 10 MiB

LVM magic value at 869585866/0/1

LVM magic value at 869692408/0/1

HFS magic value at 871635660/0/1

part_size 8388610

Mac HFS 871635660 880024269 8388610 [ÿÿÿºD ]

HFS blocksize=16777216, 4294 MB / 4096 MiB

HFS magic value at 886859759/0/1

part_size 1233944578

Mac HFS 886859759 2120804336 1233944578

HFS blocksize=16777216, 631 GB / 588 GiB

This partition ends after the disk limits. (start=886859759, size=1233944578, end=2120804336, disk end=1953525168)

HFS magic value at 886859761/0/1

LVM magic value at 893176938/0/1

FAT12 at 893746232/0/1

FAT1 : 1-9

FAT2 : 10-18

start_rootdir : 19

Data : 33-2879

sectors : 2880

cluster_size : 1

no_of_cluster : 2847 (2 - 2848)

fat_length 9 calculated 9

heads/cylinder 2 (FAT) != 1 (HD)

sect/track 18 (FAT) != 1 (HD)

FAT12 at 893746232/0/1

MS Data 893746232 893749111 2880 [EFISECTOR]

FAT12, blocksize=512, 1474 KB / 1440 KiB

NTFS at 893826200/0/1

heads/cylinder 16 (NTFS) != 1 (HD)

sect/track 2 (NTFS) != 1 (HD)

filesystem size 6174

sectors_per_cluster 1

mft_lcn 2058

mftmirr_lcn 5162

clusters_per_mft_record 2

clusters_per_index_record 8

MS Data 893820027 893826200 6174

NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

NTFS at 893826200/0/1

heads/cylinder 16 (NTFS) != 1 (HD)

sect/track 2 (NTFS) != 1 (HD)

filesystem size 6174

sectors_per_cluster 1

mft_lcn 2058

mftmirr_lcn 5162

clusters_per_mft_record 2

clusters_per_index_record 8

MS Data 893826200 893832373 6174 [Boot]

NTFS, blocksize=512, 3161 KB / 3087 KiB

cramfs Marker at 897548777/0/1

recover_cramfs

MS Data 897548777 898920760 1371983 [GW¹¤Ø«Ý½Í(bdSÜ]

cramfs, 702 MB / 669 MiB

HFS magic value at 905665415/0/1

part_size 1233944578

Mac HFS 905665415 2139609992 1233944578

HFS blocksize=16777216, 631 GB / 588 GiB

This partition ends after the disk limits. (start=905665415, size=1233944578, end=2139609992, disk end=1953525168)

HFS magic value at 905665417/0/1

LVM magic value at 907915554/0/1

LVM magic value at 923934155/0/1

NTFS at 932041032/0/1

heads/cylinder 16 (NTFS) != 1 (HD)

sect/track 2 (NTFS) != 1 (HD)

filesystem size 6174

sectors_per_cluster 1

mft_lcn 2058

mftmirr_lcn 5162

clusters_per_mft_record 2

clusters_per_index_record 8

MS Data 932034859 932041032 6174

NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

NTFS at 932041032/0/1

heads/cylinder 16 (NTFS) != 1 (HD)

sect/track 2 (NTFS) != 1 (HD)

filesystem size 6174

sectors_per_cluster 1

mft_lcn 2058

mftmirr_lcn 5162

clusters_per_mft_record 2

clusters_per_index_record 8

MS Data 932041032 932047205 6174 [Boot]

NTFS, blocksize=512, 3161 KB / 3087 KiB

check_FAT: Bad number of sectors per cluster

LVM magic value at 939076850/0/1

FAT12 at 952570280/0/1

FAT1 : 1-9

FAT2 : 10-18

start_rootdir : 19

Data : 33-2879

sectors : 2880

cluster_size : 1

no_of_cluster : 2847 (2 - 2848)

fat_length 9 calculated 9

heads/cylinder 2 (FAT) != 1 (HD)

sect/track 18 (FAT) != 1 (HD)

FAT12 at 952570280/0/1

MS Data 952570280 952573159 2880 [EFISECTOR]

FAT12, blocksize=512, 1474 KB / 1440 KiB

LVM magic value at 975423043/0/1

NTFS at 979943544/0/1

heads/cylinder 16 (NTFS) != 1 (HD)

sect/track 2 (NTFS) != 1 (HD)

filesystem size 6174

sectors_per_cluster 1

mft_lcn 2058

mftmirr_lcn 5162

clusters_per_mft_record 2

clusters_per_index_record 8

MS Data 979937371 979943544 6174

NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

NTFS at 979943544/0/1

heads/cylinder 16 (NTFS) != 1 (HD)

sect/track 2 (NTFS) != 1 (HD)

filesystem size 6174

sectors_per_cluster 1

mft_lcn 2058

mftmirr_lcn 5162

clusters_per_mft_record 2

clusters_per_index_record 8

MS Data 979943544 979949717 6174 [Boot]

NTFS, blocksize=512, 3161 KB / 3087 KiB

LVM magic value at 1003980271/0/1

FAT12 at 1013826976/0/1

FAT1 : 1-9

FAT2 : 10-18

start_rootdir : 19

Data : 33-2879

sectors : 2880

cluster_size : 1

no_of_cluster : 2847 (2 - 2848)

fat_length 9 calculated 9

heads/cylinder 2 (FAT) != 1 (HD)

sect/track 18 (FAT) != 1 (HD)

FAT12 at 1013826976/0/1

MS Data 1013826976 1013829855 2880 [EFISECTOR]

FAT12, blocksize=512, 1474 KB / 1440 KiB

LVM magic value at 1053198024/0/1

LVM magic value at 1095629328/0/1

FAT32 at 1134393777/0/1

FAT1 : 32-9478

FAT2 : 9479-18925

start_rootdir : 18926 root cluster : 2

Data : 18926-9691853

sectors : 9691857

cluster_size : 8

no_of_cluster : 1209116 (2 - 1209117)

fat_length 9447 calculated 9447

FAT differs, FAT sectors=0-16/9447

heads/cylinder 255 (FAT) != 1 (HD)

sect/track 63 (FAT) != 1 (HD)

set_FAT_info: name from BS used

FAT32 at 1134393777/0/1

MS Data 1134393777 1144085633 9691857 [NO NAME]

FAT32, blocksize=4096, 4962 MB / 4732 MiB

HFS+ magic value at 1161907512/0/1

part_size 976757296

Mac HFS 1161907512 2138664807 976757296

HFS+ blocksize=4096, 500 GB / 465 GiB

This partition ends after the disk limits. (start=1161907512, size=976757296, end=2138664807, disk end=1953525168)

HFS+ magic value at 1161907514/0/1

part_size 976757296

Mac HFS 185150220 1161907515 976757296

HFS+ found using backup sector!, 500 GB / 465 GiB

HFS+ magic value at 1162577688/0/1

part_size 976757296

Mac HFS 1162577688 2139334983 976757296

HFS+ blocksize=4096, 500 GB / 465 GiB

This partition ends after the disk limits. (start=1162577688, size=976757296, end=2139334983, disk end=1953525168)

HFS+ magic value at 1162577690/0/1

part_size 976757296

Mac HFS 185820396 1162577691 976757296

HFS+ found using backup sector!, 500 GB / 465 GiB

NTFS at 1163069408/0/1

heads/cylinder 255 (NTFS) != 1 (HD)

sect/track 63 (NTFS) != 1 (HD)

filesystem size 479133696

sectors_per_cluster 8

mft_lcn 786432

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

MS Data 683935713 1163069408 479133696

NTFS found using backup sector, blocksize=4096, 245 GB / 228 GiB

NTFS at 1163069408/0/1

heads/cylinder 255 (NTFS) != 1 (HD)

sect/track 63 (NTFS) != 1 (HD)

filesystem size 479133696

sectors_per_cluster 8

mft_lcn 786432

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

MS Data 1163069408 1642203103 479133696

NTFS, blocksize=4096, 245 GB / 228 GiB

HFS+ magic value at 1764519300/0/1

part_size 1764109664

Mac HFS 1764519300 3528628963 1764109664

HFS+ blocksize=4096, 903 GB / 841 GiB

This partition ends after the disk limits. (start=1764519300, size=1764109664, end=3528628963, disk end=1953525168)

HFS+ magic value at 1764519302/0/1

part_size 1764109664

Mac HFS 409640 1764519303 1764109664

HFS+ found using backup sector!, 903 GB / 841 GiB

HFS+ magic value at 1764519304/0/1

part_size 83886080

Mac HFS 1764519304 1848405383 83886080

HFS+ blocksize=4096 + Backup, 42 GB / 40 GiB

FAT32 at 1848405384/0/1

check_FAT: Unusual media descriptor (0xf0!=0xf8)

FAT1 : 32-10261

FAT2 : 10262-20491

start_rootdir : 20492 root cluster : 2

Data : 20492-10485755

sectors : 10485760

cluster_size : 8

no_of_cluster : 1308158 (2 - 1308159)

fat_length 10230 calculated 10220

heads/cylinder 255 (FAT) != 1 (HD)

sect/track 63 (FAT) != 1 (HD)

FAT32 at 1848405384/0/1

MS Data 1848405384 1858891143 10485760 [DIAG]

FAT32, blocksize=4096, 5368 MB / 5120 MiB

HFS+ magic value at 1858891144/0/1

part_size 94371840

Mac HFS 1858891144 1953262983 94371840

HFS+ blocksize=4096, 48 GB / 45 GiB

NTFS at 1953519615/0/1

heads/cylinder 255 (NTFS) != 1 (HD)

sect/track 63 (NTFS) != 1 (HD)

filesystem size 552955904

sectors_per_cluster 8

mft_lcn 786432

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

MS Data 1400563712 1953519615 552955904

NTFS found using backup sector, blocksize=4096, 283 GB / 263 GiB

NTFS at 1953519615/0/1

heads/cylinder 255 (NTFS) != 1 (HD)

sect/track 63 (NTFS) != 1 (HD)

filesystem size 552955904

sectors_per_cluster 8

mft_lcn 786432

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

NTFS: Can't read MFT

MS Data 1953519615 2506475518 552955904

NTFS, blocksize=4096, 283 GB / 263 GiB

This partition ends after the disk limits. (start=1953519615, size=552955904, end=2506475518, disk end=1953525168)

NTFS at 1953523711/0/1

heads/cylinder 255 (NTFS) != 1 (HD)

sect/track 63 (NTFS) != 1 (HD)

filesystem size 1093476352

sectors_per_cluster 8

mft_lcn 786432

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

MS Data 860047360 1953523711 1093476352

NTFS found using backup sector, blocksize=4096, 559 GB / 521 GiB

NTFS at 1953523711/0/1

heads/cylinder 255 (NTFS) != 1 (HD)

sect/track 63 (NTFS) != 1 (HD)

filesystem size 1093476352

sectors_per_cluster 8

mft_lcn 786432

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

NTFS: Can't read MFT

MS Data 1953523711 3047000062 1093476352

NTFS, blocksize=4096, 559 GB / 521 GiB

This partition ends after the disk limits. (start=1953523711, size=1093476352, end=3047000062, disk end=1953525168)

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

Check the harddisk size: HD jumpers settings, BIOS detection...

The harddisk (1000 GB / 931 GiB) seems too small! (< 1806 GB / 1682 GiB)

The following partitions can't be recovered:

Mac HFS 886859759 2120804336 1233944578

HFS blocksize=16777216, 631 GB / 588 GiB

Mac HFS 905665415 2139609992 1233944578

HFS blocksize=16777216, 631 GB / 588 GiB

Mac HFS 1161907512 2138664807 976757296

HFS+ blocksize=4096, 500 GB / 465 GiB

Mac HFS 1162577688 2139334983 976757296

HFS+ blocksize=4096, 500 GB / 465 GiB

Mac HFS 1764519300 3528628963 1764109664

HFS+ blocksize=4096, 903 GB / 841 GiB

MS Data 1953519615 2506475518 552955904

NTFS, blocksize=4096, 283 GB / 263 GiB

MS Data 1953523711 3047000062 1093476352

NTFS, blocksize=4096, 559 GB / 521 GiB

Results

P EFI System 40 409639 409600 [EFI]

FAT32, blocksize=512, 209 MB / 200 MiB

Mac HFS 409640 858777823 858368184

HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

Mac HFS 409640 1764519303 1764109664

HFS+ found using backup sector!, 903 GB / 841 GiB

Mac HFS 185150220 1161907515 976757296

HFS+ found using backup sector!, 500 GB / 465 GiB

Mac HFS 185820396 1162577691 976757296

HFS+ found using backup sector!, 500 GB / 465 GiB

MS Data 683935713 1163069408 479133696

NTFS found using backup sector, blocksize=4096, 245 GB / 228 GiB

Mac HFS 858777824 860047359 1269536

HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

MS Data 860047360 1953523711 1093476352

NTFS found using backup sector, blocksize=4096, 559 GB / 521 GiB

MS Data 868847979 868868717 20739 [NO NAME]

FAT12, blocksize=4096, 10 MB / 10 MiB

Mac HFS 871635660 880024269 8388610 [ÿÿÿºD ]

HFS blocksize=16777216, 4294 MB / 4096 MiB

MS Data 893746232 893749111 2880 [EFISECTOR]

FAT12, blocksize=512, 1474 KB / 1440 KiB

MS Data 893820027 893826200 6174

NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

MS Data 893826200 893832373 6174 [Boot]

NTFS, blocksize=512, 3161 KB / 3087 KiB

MS Data 897548777 898920760 1371984 [GW¹¤Ø«Ý½Í(bdSÜ]

cramfs, 702 MB / 669 MiB

MS Data 932034859 932041032 6174

NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

MS Data 932041032 932047205 6174 [Boot]

NTFS, blocksize=512, 3161 KB / 3087 KiB

MS Data 952570280 952573159 2880 [EFISECTOR]

FAT12, blocksize=512, 1474 KB / 1440 KiB

MS Data 979937371 979943544 6174

NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

MS Data 979943544 979949717 6174 [Boot]

NTFS, blocksize=512, 3161 KB / 3087 KiB

MS Data 1013826976 1013829855 2880 [EFISECTOR]

FAT12, blocksize=512, 1474 KB / 1440 KiB

MS Data 1134393777 1144085633 9691857 [NO NAME]

FAT32, blocksize=4096, 4962 MB / 4732 MiB

MS Data 1163069408 1642203103 479133696

NTFS, blocksize=4096, 245 GB / 228 GiB

MS Data 1400563712 1953519615 552955904

NTFS found using backup sector, blocksize=4096, 283 GB / 263 GiB

Mac HFS 1764519304 1848405383 83886080

HFS+ blocksize=4096 + Backup, 42 GB / 40 GiB

MS Data 1848405384 1858891143 10485760 [DIAG]

FAT32, blocksize=4096, 5368 MB / 5120 MiB

Mac HFS 1858891144 1953262983 94371840

HFS+ blocksize=4096, 48 GB / 45 GiB

interface_write()

1 P EFI System 40 409639 409600 [EFI]

simulate write!

Interface Advanced

hdr_size=92

hdr_lba_self=1

hdr_lba_alt=1953525167 (expected 1953525167)

hdr_lba_start=34

hdr_lba_end=1953525134

hdr_lba_table=2

hdr_entries=128

hdr_entsz=128

check_part_gpt failed for partition

4 P MS Data 860047360 1953523711 1093476352 [BOOTCAMP]

1 P EFI System 40 409639 409600 [EFI System Partition]

2 P Mac HFS 409640 858777823 858368184 [Mac OSX]

HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

3 P Mac Boot 858777824 860047359 1269536 [Recovery HD]

4 P MS Data 860047360 1953523711 1093476352 [BOOTCAMP]

New options :

Dump : No

Align partition: Yes

Expert mode : No

Analyse Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

hdr_size=92

hdr_lba_self=1

hdr_lba_alt=1953525167 (expected 1953525167)

hdr_lba_start=34

hdr_lba_end=1953525134

hdr_lba_table=2

hdr_entries=128

hdr_entsz=128

check_part_gpt failed for partition

4 P MS Data 860047360 1953523711 1093476352 [BOOTCAMP]

Current partition structure:

1 P EFI System 40 409639 409600 [EFI System Partition]

2 P Mac HFS 409640 858777823 858368184 [Mac OSX]

3 P Mac Boot 858777824 860047359 1269536 [Recovery HD]

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

4 P MS Data 860047360 1953523711 1093476352 [BOOTCAMP]

search_part()

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

FAT32 at 40/0/1

check_FAT: Unusual media descriptor (0xf0!=0xf8)

FAT1 : 32-3182

FAT2 : 3183-6333

start_rootdir : 6334 root cluster : 2

Data : 6334-409599

sectors : 409600

cluster_size : 1

no_of_cluster : 403266 (2 - 403267)

fat_length 3151 calculated 3151

heads/cylinder 16 (FAT) != 1 (HD)

sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1

EFI System 40 409639 409600 [EFI]

FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1

part_size 858368184

Mac HFS 409640 858777823 858368184

HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

HFS+ magic value at 858777824/0/1

part_size 1269536

Mac HFS 858777824 860047359 1269536

HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

Search for partition aborted

Results

P EFI System 40 409639 409600 [EFI]

FAT32, blocksize=512, 209 MB / 200 MiB

P Mac HFS 409640 858777823 858368184

HFS+ blocksize=4096 + Backup, 439 GB / 409 GiB

P Mac HFS 858777824 860047359 1269536

HFS+ blocksize=4096 + Backup, 650 MB / 619 MiB

Reply

Answer 8

Loner T

Level 9

59,513 points

Oct 27, 2014 4:44 PM in response to Redeagles-143

The following entries are interesting ones. You will still need Testdisk to look inside these partitions for familiar files though.

MS Data 683935713 1163069408 479133696

MS Data 1163069408 1642203103 479133696

4 P MS Data 860047360 1953523711 1093476352 [BOOTCAMP]

Reply

Answer 9

Oct 27, 2014 5:34 PM in response to Loner T

Sorry to be a pain, but when using test disk, am I looking for familiar files of the windows partition with all the user accounts in it (hence will have my sons user account with the data I want to recover) or am I just looking for familiar files in my sons user account ?

Reply

Answer 10

Loner T

Level 9

59,513 points

Oct 27, 2014 6:32 PM in response to Redeagles-143

You are looking for familiar files that belongs to Windows, typically system files, since they are usually the first files to be installed and written. My suggestion is to have Windows up and running then you can backup/extract files as you choose.

Reply

Answer 11

Oct 29, 2014 7:32 AM in response to Loner T

I looked in both the ms data folders and found nothing familiar.

I am currently doing a deep search of the drive, its been 7 hours now and only done about 40%. Will update you when finish. Any suggestions?

Reply

Answer 12

Loner T

Level 9

59,513 points

Oct 29, 2014 7:55 AM in response to Redeagles-143

The Deeper Search is a slow process.

Reply

Answer 13

Oct 30, 2014 3:06 AM in response to Loner T

Found something interesting after the Deeper Search,

I only went into the the first MS DATA partition "MS Data 1953519615 2506475518 552955904" from the 1st screen shot.

I can't get back into the original screen to select "MS data 1953523711 3047000062 1093476352" to look in there.

I will have to do the Deeper Search again if you need me to look there ( which its going to take 36 hours ".

When i went into the users directory, I didn't see all the user names listed and not the user data I wanted to recover "Jake". Do you think this the the right one?

Reply

Answer 14

Loner T

Level 9

59,513 points

Oct 30, 2014 4:39 AM in response to Redeagles-143

It is not very useful to do a second Deeper Search, it will lead to the same results, because each is a sector-by-sector scan. Think of yourself sitting on the branch of a tree, irrespective of the "path-of-descent" chosen, you goal is to get to trunk towards the root to get to the surface on which the three is planted.

Once you get to Deeper Search, you can look at each MS Data in that set of results to exhaust each entry in the list.

The entry at start/end/size of 781864960/1257201663/475336704 is roughly 226+ GB. Is that about the correct size of your Windows partition?

If Windows will come up properly, you should be able to find all your users.

Reply

Answer 15

Oct 30, 2014 6:02 AM in response to Loner T

Can you tell me what the next step will by?

Reply