Redeagles-143

Q: Bootcamp not working after Yosemite update

Hi,

 

I have similar problem after updating to Yosemite, now  I can't boot into windows. There is no Windows option at startup when holding on ALT button and in disk utility, it showed Mac OS X partition with disks greyed out. I updated to Yosemite on my 11 inch Mac air and Mac Pro with no problem, before I decided to update my sons iMac (which has his school work) and ran into this problem. I remembered I use a third party program called Paragon NTFS. Could this be the problem?

 

Please Help.

Posted on Oct 27, 2014 5:19 AM

Close

Q: Bootcamp not working after Yosemite update

  • All replies
  • Helpful answers

first Previous Page 4 of 4
  • by Loner T,

    Loner T Loner T Nov 6, 2014 6:17 AM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Nov 6, 2014 6:17 AM in response to Redeagles-143

    This is what I would expect Testdisk to find once it found the correct partition headers.

     

    Bootcamp-Volume-Files.png

     

    I am surprised that this one is no longer showing up - 781864960/1257201663/475336704.

     

    The only choice was to not use this size, but give it the entire disk. One option is to use this exact same size and just recreate the GPT#3 and see what files can be seen.

     

    Does the Bootcamp volume show up in Finder and show files in it?

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Nov 6, 2014 2:50 PM in response to Loner T
    Level 1 (0 points)
    Nov 6, 2014 2:50 PM in response to Loner T

    Loner T,

     

    This the first screen after the Deeper Scan,

     

    deeper scan.jpg

     

    The first time, I went into  MS Data      19353519615     2306475518     552955904

    and found familiar files under 781864960 / 1257201663 / 475336704

    found similiar files.jpg

     

    And when we create a new GPT3 using the above start address but with the size of the whole disk, we found no NTFS header.

     

    The last Deeper Scan I did, I went into the MS Data      1953523711     3047000062     1093476352

    to look for MS Data with sizes close to 559 GB and found these,

     

    D MS Data                787781632 1953523711 1165742080 [BOOTCAMP]

    D MS Data                787781638 1953523717 1165742080 [BOOTCAMP]

     

    but there is no 781864960 / 1257201663 / 475336704 to be found.

     

    Does it matter which set of MS Data I look into?

    If so, how do I go back to the first screen after the Deeper Scan? Pressing quit or Escape take me back to the screen where I have to Analyse the disk again.

     

    Do you want me to try and use 781864960/1257201663/475336704 as GPR3?

  • by Loner T,

    Loner T Loner T Nov 6, 2014 3:27 PM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Nov 6, 2014 3:27 PM in response to Redeagles-143

    You have entries like

     

    MS Data                860047360 1953523711 1093476352

    NTFS found using backup sector, blocksize=4096, 559 GB / 521 GiB

     

    This is the GPT right after upgrade, as seen in your first screen shot. If you look at the first screen you posted before any changes were made, 1953523711 is one byte before 1953523712 where your GPT 4 ends. NTFS stores information at the beginning and the end of the partition, and this is why this number was chosen.


    Each MS Data is self-contained. 781864960/1257201663/475336704 this seems to be invalid, even though it was discovered at some point. Looking at the image on the first page, you are in the /Users directory, not at the partition header, so this indicates an incorrect choice. The other missing piece is that there is no "System Volume Information" in this partition, because it is the beginning of a directory. The confusing part is that this now shows up as "/" and also has "System Volume information". It does not hurt to try this one. Please try this, but it will not be the whole partition.


    Was any partitioning executed within Windows, if you can recall?


    You also have the following two, which are inside your OSX partition (This may indicate a bug in Testdisk). But the first line ends at the correct byte to indicate a backup NTFS entry. The second entry is 5 bytes beyond the GPT and is likely invalid.


    D MS Data                787781632 1953523711 1165742080 [BOOTCAMP]

    D MS Data                787781638 1953523717 1165742080 [BOOTCAMP]

  • by jjkeele,

    jjkeele jjkeele Nov 7, 2014 1:29 AM in response to Loner T
    Level 1 (0 points)
    Nov 7, 2014 1:29 AM in response to Loner T

    Hi Loner T ... desperate for assistance if possible!!  I've posted all my dumps here:

     

    Win7 missing after Yosemite upgrade

     

    But I'm not seeing the same NTFS preamble as the others!

     

    Please help!

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Nov 7, 2014 5:12 PM in response to Loner T
    Level 1 (0 points)
    Nov 7, 2014 5:12 PM in response to Loner T

    Loner T,

     

    I tried with this 787781632 1953523711 1165742080

     

    and I have Bootcamp showing on Deskyop and also in Finder, but when I go in there it is empty.

     

    Last login: Sat Nov  8 01:03:20 on console

    An-Duongs-iMac:~ akduong$ diskutil list

    /dev/disk0

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:      GUID_partition_scheme                        *1.0 TB     disk0

       1:                        EFI EFI                     209.7 MB   disk0s1

       2:                  Apple_HFS Mac OSX                 400.1 GB   disk0s2

       3:       Microsoft Basic Data BOOTCAMP                596.9 GB   disk0s3

    An-Duongs-iMac:~ akduong$ sudo gpt -vv -r show /dev/disk0

    Password:

    gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

    gpt show: /dev/disk0: PMBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 1953525167

           start        size  index  contents

               0           1         PMBR

               1           1         Pri GPT header

               2          32         Pri GPT table

              34           6        

              40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

          409640   781455320      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

       781864960     5916672        

       787781632  1165742080      3  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      1953523712        1423        

      1953525135          32         Sec GPT table

      1953525167           1         Sec GPT header

    An-Duongs-iMac:~ akduong$ sudo fdisk /dev/disk0

    Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE    0   0   2 - 1023 255  63 [         1 - 1953525167] <Unknown ID>

    2: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    3: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    4: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    An-Duongs-iMac:~ akduong$ sudo dd if=/dev/rdisk0s3 count=1 2>/dev/null | hexdump -C

    00000000  eb 58 90 42 53 44 20 20  34 2e 34 00 02 40 20 00  |.X.BSD  4.4..@ .|

    00000010  02 00 00 00 00 f0 00 00  20 00 ff 00 00 00 00 00  |........ .......|

    00000020  00 d0 7b 45 bc 2b 02 00  00 00 00 00 02 00 00 00  |..{E.+..........|

    00000030  01 00 06 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

    00000040  00 00 29 06 12 39 78 42  4f 4f 54 43 41 4d 50 20  |..)..9xBOOTCAMP |

    00000050  20 20 46 41 54 33 32 20  20 20 fa 31 c0 8e d0 bc  |  FAT32   .1....|

    00000060  00 7c fb 8e d8 e8 00 00  5e 83 c6 19 bb 07 00 fc  |.|......^.......|

    00000070  ac 84 c0 74 06 b4 0e cd  10 eb f5 30 e4 cd 16 cd  |...t.......0....|

    00000080  19 0d 0a 4e 6f 6e 2d 73  79 73 74 65 6d 20 64 69  |...Non-system di|

    00000090  73 6b 0d 0a 50 72 65 73  73 20 61 6e 79 20 6b 65  |sk..Press any ke|

    000000a0  79 20 74 6f 20 72 65 62  6f 6f 74 0d 0a 00 00 00  |y to reboot.....|

    000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

    *

    000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|

    00000200

    An-Duongs-iMac:~ akduong$

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Nov 7, 2014 5:21 PM in response to Loner T
    Level 1 (0 points)
    Nov 7, 2014 5:21 PM in response to Loner T

    I also tried with this781864960/1257201663/475336704 and nothing come up after reboot.

    Last login: Sat Nov  8 01:17:26 on console

    An-Duongs-iMac:~ akduong$ pdiskutil list

    -bash: pdiskutil: command not found

    An-Duongs-iMac:~ akduong$ diskutil list

    /dev/disk0

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:      GUID_partition_scheme                        *1.0 TB     disk0

       1:                        EFI EFI                     209.7 MB   disk0s1

       2:                  Apple_HFS Mac OSX                 400.1 GB   disk0s2

       3:       Microsoft Basic Data                         243.4 GB   disk0s3

    An-Duongs-iMac:~ akduong$ sudo gpt -vv -r show /dev/disk0

    Password:

    gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

    gpt show: /dev/disk0: PMBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 1953525167

           start        size  index  contents

               0           1         PMBR

               1           1         Pri GPT header

               2          32         Pri GPT table

              34           6        

              40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

          409640   781455320      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

       781864960   475336704      3  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      1257201664   696323471        

      1953525135          32         Sec GPT table

      1953525167           1         Sec GPT header

    An-Duongs-iMac:~ akduong$ sudo fdisk /dev/disk0

    Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE    0   0   2 - 1023 255  63 [         1 - 1953525167] <Unknown ID>

    2: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    3: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    4: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    An-Duongs-iMac:~ akduong$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

    An-Duongs-iMac:~ akduong$ sudo dd if=/dev/rdisk0s3 count=1 2>/dev/null | hexdump -C

    00000000  21 8b 74 24 10 8b 0e 68  c8 47 44 00 ff 15 4c 31  |!.t$...h.GD...L1|

    00000010  43 00 0f b6 c8 f7 d9 1b  c9 23 4c 24 0c 89 0e 5e  |C........#L$...^|

    00000020  5d c3 8b 44 24 10 5e c7  00 c8 47 44 00 c6 40 04  |]..D$.^...GD..@.|

    00000030  00 c6 40 05 00 5d c3 8b  74 24 10 57 8b 7c 24 10  |..@..]..t$.W.|$.|

    00000040  85 f6 74 1a 8b 17 89 16  8b 4f 04 89 4e 04 85 c9  |..t......O..N...|

    00000050  74 06 8b 01 8b 10 ff d2  8b 47 08 89 46 08 83 fd  |t........G..F...|

    00000060  01 75 11 8b 4f 04 85 c9  74 0a 8b 11 8b 42 04 5f  |.u..O...t....B._|

    00000070  5e 5d ff e0 5f 5e 5d c3  cc cc cc cc cc cc cc cc  |^].._^].........|

    00000080  8b 44 24 0c 83 f8 04 74  09 89 44 24 0c e9 3e ff  |.D$....t..D$..>.|

    00000090  ff ff 8b 44 24 08 32 c9  c7 00 c8 47 44 00 88 48  |...D$.2....GD..H|

    000000a0  04 88 48 05 c3 cc cc cc  cc cc cc cc cc cc cc cc  |..H.............|

    000000b0  6a ff 68 f8 11 43 00 64  a1 00 00 00 00 50 64 89  |j.h..C.d.....Pd.|

    000000c0  25 00 00 00 00 51 56 57  8b f9 8b 4c 24 1c 8d 47  |%....QVW...L$..G|

    000000d0  08 50 83 ec 0c 8b f4 89  0e 8b 54 24 30 89 56 04  |.P........T$0.V.|

    000000e0  8b 4c 24 30 c7 44 24 24  00 00 00 00 89 64 24 18  |.L$0.D$$.....d$.|

    000000f0  85 c9 74 06 8b 01 8b 10  ff d2 8b 44 24 34 b9 34  |..t........D$4.4|

    00000100  49 44 00 89 46 08 e8 25  bf fe ff 0f b6 c8 f7 d9  |ID..F..%........|

    00000110  1b c9 81 e1 34 49 44 00  89 0f 8b 4c 24 20 c7 44  |....4ID....L$ .D|

    00000120  24 14 ff ff ff ff 85 c9  74 07 8b 11 8b 42 04 ff  |$.......t....B..|

    00000130  d0 8b 4c 24 0c 5f 64 89  0d 00 00 00 00 5e 83 c4  |..L$._d......^..|

    00000140  10 c2 0c 00 cc cc cc cc  cc cc cc cc cc cc cc cc  |................|

    00000150  6a ff 68 f8 11 43 00 64  a1 00 00 00 00 50 64 89  |j.h..C.d.....Pd.|

    00000160  25 00 00 00 00 51 56 57  8b f9 8b 44 24 1c 83 ec  |%....QVW...D$...|

    00000170  0c 8b f4 c7 07 00 00 00  00 89 06 8b 4c 24 2c 89  |............L$,.|

    00000180  4e 04 8b 4c 24 2c c7 44  24 20 00 00 00 00 89 64  |N..L$,.D$ .....d|

    00000190  24 14 85 c9 74 06 8b 11  8b 02 ff d0 8b 4c 24 30  |$...t........L$0|

    000001a0  89 4e 08 8b cf e8 06 ff  ff ff 8b 4c 24 20 c7 44  |.N.........L$ .D|

    000001b0  24 14 ff ff ff ff 85 c9  74 07 8b 11 8b 42 04 ff  |$.......t....B..|

    000001c0  d0 8b 4c 24 0c 8b c7 5f  64 89 0d 00 00 00 00 5e  |..L$..._d......^|

    000001d0  83 c4 10 c2 10 00 cc cc  cc cc cc cc cc cc cc cc  |................|

    000001e0  6a ff 68 f8 11 43 00 64  a1 00 00 00 00 50 64 89  |j.h..C.d.....Pd.|

    000001f0  25 00 00 00 00 51 56 57  8b f9 8b 44 24 1c 6a 00  |%....QVW...D$.j.|

    00000200

    An-Duongs-iMac:~ akduong$

  • by Loner T,

    Loner T Loner T Nov 7, 2014 5:49 PM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Nov 7, 2014 5:49 PM in response to Redeagles-143

    1. This is becoming very interesting now. The OS X partition was shrunk, but it still boots. This means there is quite a bit of unused contiguous space in the OS X partition which has never been touched.

    2. The 781864960 seems to be one of the numbers that should be used.

    3. The Secondary GPT is still intact at 1953525135 . This allows 1953523717 to be a valid end for NTFS instead of 1953523712 being the limit. You found an entry that had the end "17" but I had suggested that you discard it, because I was afraid of corrupting the secondary GPT.


    D MS Data                787781638 1953523717 1165742080 [BOOTCAMP]


    The entry was 6 bytes further than the following one and is worth a test since you have already tested the one starting at 1632.


    D MS Data                787781632 1953523711 1165742080 [BOOTCAMP]

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Nov 7, 2014 6:19 PM in response to Loner T
    Level 1 (0 points)
    Nov 7, 2014 6:19 PM in response to Loner T

    Thanks for the quick reply, are you suggesting that I should tryD MS Data                787781638 1953523717 1165742080 [BOOTCAMP]?

  • by Loner T,

    Loner T Loner T Nov 7, 2014 6:30 PM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Nov 7, 2014 6:30 PM in response to Redeagles-143

    Yes, please. It is worth a quick test.

  • by Redeagles-143,

    Redeagles-143 Redeagles-143 Nov 9, 2014 4:25 AM in response to Loner T
    Level 1 (0 points)
    Nov 9, 2014 4:25 AM in response to Loner T

    Tried D MS Data                787781638 1953523717 1165742080 [BOOTCAMP]

    with the end address 1953523711

     

    Last login: Sun Nov  9 12:19:17 on console

    An-Duongs-iMac:~ akduong$ pdiskutil list

    -bash: pdiskutil: command not found

    An-Duongs-iMac:~ akduong$ diskutil list

    /dev/disk0

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:      GUID_partition_scheme                        *1.0 TB     disk0

       1:                        EFI EFI                     209.7 MB   disk0s1

       2:                  Apple_HFS Mac OSX                 400.1 GB   disk0s2

       3:       Microsoft Basic Data BOOTCAMP                596.9 GB   disk0s3

    An-Duongs-iMac:~ akduong$ sudo gpt -vv -r show /dev/disk0

    Password:

    gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

    gpt show: /dev/disk0: PMBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 1953525167

           start        size  index  contents

               0           1         PMBR

               1           1         Pri GPT header

               2          32         Pri GPT table

              34           6        

              40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

          409640   781455320      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

       781864960     5916672        

       787781632  1165742080      3  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      1953523712        1423        

      1953525135          32         Sec GPT table

      1953525167           1         Sec GPT header

    An-Duongs-iMac:~ akduong$ sudo fdisk /dev/disk0

    Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE    0   0   2 - 1023 255  63 [         1 - 1953525167] <Unknown ID>

    2: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    3: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    4: 00    0   0   0 -    0   0   0 [         0 -          0] unused     

    An-Duongs-iMac:~ akduong$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

    An-Duongs-iMac:~ akduong$ sudo dd if=/dev/rdisk0s3 count=1 2>/dev/null | hexdump -C

    00000000  eb 58 90 42 53 44 20 20  34 2e 34 00 02 40 20 00  |.X.BSD  4.4..@ .|

    00000010  02 00 00 00 00 f0 00 00  20 00 ff 00 00 00 00 00  |........ .......|

    00000020  00 d0 7b 45 bc 2b 02 00  00 00 00 00 02 00 00 00  |..{E.+..........|

    00000030  01 00 06 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

    00000040  00 00 29 06 12 39 78 42  4f 4f 54 43 41 4d 50 20  |..)..9xBOOTCAMP |

    00000050  20 20 46 41 54 33 32 20  20 20 fa 31 c0 8e d0 bc  |  FAT32   .1....|

    00000060  00 7c fb 8e d8 e8 00 00  5e 83 c6 19 bb 07 00 fc  |.|......^.......|

    00000070  ac 84 c0 74 06 b4 0e cd  10 eb f5 30 e4 cd 16 cd  |...t.......0....|

    00000080  19 0d 0a 4e 6f 6e 2d 73  79 73 74 65 6d 20 64 69  |...Non-system di|

    00000090  73 6b 0d 0a 50 72 65 73  73 20 61 6e 79 20 6b 65  |sk..Press any ke|

    000000a0  79 20 74 6f 20 72 65 62  6f 6f 74 0d 0a 00 00 00  |y to reboot.....|

    000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

    *

    000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|

    00000200

    An-Duongs-iMac:~ akduong$

     

     

    Bootcamp showed up with not files.

     

    Anything else we could try?

  • by Loner T,

    Loner T Loner T Nov 9, 2014 5:45 AM in response to Redeagles-143
    Level 7 (24,601 points)
    Safari
    Nov 9, 2014 5:45 AM in response to Redeagles-143

    The entry in GPT is

     

    787781632  1165742080      3  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

     

    which mismatches

     

    D MS Data                787781638 1953523717 1165742080 [BOOTCAMP]

     

    You can try it.

     

    One other entry to try would be start/size 781864960/1165742080

     

    It is impractical to access 580+Gb over the internet. Do you want to retry PhotoRec? I will ask the Testdisk developer to look at this thread as well.

first Previous Page 4 of 4