Bootcamp disappeared after Yosemite upgrade

Question

mannygomez Author

Level 1

0 points

Bootcamp disappeared after Yosemite upgrade

Hi Loner,

Unfortunately, should have read this before upgrading the yosemite while having the bootcamp.

I have noticed you have successfully advised some users on recovering the windows files and data.

I have followed your notes:

diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *251.0 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_CoreStorage 130.7 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 20.0 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS Macintosh HD *130.3 GB disk1

Logical Volume on disk0s2

D1498301-E94E-48FF-B819-BF4B24BDAE9C

Unlocked Encrypted

diskutil cs list

sudo fdisk /dev/rdisk0s4

sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 490234751

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 255259680 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

255669320 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

256938856 194233496

451172352 39061504 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

490233856 863

490234719 32 Sec GPT table

490234751 1 Sec GPT header

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

But after this step, instead of obtaining the first row with NFTS files, I got the following:

Manuels-MacBook-Pro:~ manuelgomes$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

*

00000200

Does that mean that all is lost??

Could you please elucidate me whether it is possible to recover the data I had in the bootcamp partition and what should be the next steps?

Many thanks,

Manny

MacBook Pro, iOS 8, Upgrade to Yosemite completed

Posted on Nov 1, 2014 3:26 AM

Reply

Answer 1

mannygomez Author

Level 1

0 points

Nov 1, 2014 3:30 AM in response to mannygomez

Dear Loner,

Many thanks for your prompt response. In reply to your steps:

1. Ok, done.

2. I'm new to Mac, so please bear with me. I will install TestDisk and GPT Fdisk and follow the instructions on the link you sent.

3. That sounds encouraging!

Manny

Reply

Answer 2

mannygomez Author

Level 1

0 points

Nov 1, 2014 3:31 AM in response to mannygomez

OK, I've created a new thread atBootcamp disappeared after Yosemite upgrade

Reply

Answer 3

mannygomez Author

Level 1

0 points

Nov 1, 2014 4:55 AM in response to mannygomez

Hi Loner,

After running Testdisk I got the following output:

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO)

The harddisk (251 GB / 233 GiB) seems too small! (< 370 GB / 345 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 490233855 723527671 233293817

Mac HFS 490234708 491504243 1269536logout

[Process completed]

[ Continue ]

NTFS, blocksize=4096, 119 GB / 111 GiB

What should be the next steps? If I press enter (continue) nothing happens..

Then I run:

sudo gdisk /dev/disk0

Manuels-MacBook-Pro:~ manuelgomes$ sudo gdisk /dev/disk0

Password:

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): p

Disk /dev/disk0: 490234752 sectors, 233.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): AED95BC6-A8C7-45F6-B111-5CAE2EBAD67F

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 490234718

Partitions will be aligned on 8-sector boundaries

Total free space is 194234365 sectors (92.6 GiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 255669319 121.7 GiB AF05 Macintosh HD

3 255669320 256938855 619.9 MiB AB00 Recovery HD

4 451172352 490233855 18.6 GiB 0700 BOOTCAMP

Command (? for help):

What should I enter?

I will wait for your response before proceeding.

Reply

Answer 4

Loner T

Level 9

59,471 points

Nov 1, 2014 6:27 AM in response to mannygomez

Disk would be needed later. Testdisk is the primary tool.

What you are currently looking at does not contain a NTFS header that is usable.

Start Testdisk (sudo testdisk) and select the device rdisk0 . Select EFI partition type. Do not use left/right cursor keys under any circumstances (these delete partitions). Please look at the Deeper Search option at this link http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#A_partition_is_still_missin g:_Deeper_Search

.

This is a very slow and time consuming process, and depending on your disk size and speed can take up to 10+ hours, so please be patient.

Reply

Answer 5

mannygomez Author

Level 1

0 points

Nov 3, 2014 12:03 AM in response to Loner T

Hi Loner,

Okay, I ran a test disk on rdisk0 rather than disk0. After a while I got something similar to hexagram92 Bootcamp win8.1 autorepair fail after yosemite upgrade:

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO)

Partition Start End Size in sectors

P EFI System 40 409639 409600 [EFI]

D MS Data 23646216 256940032 233293817

D Mac HFS 255669320 256938855 1269536

>D MS Data 256940032 490233848 233293817

D MS Data 256940039 490233855 233293817

D Mac HFS 488965176 490234711 1269536

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

NTFS, blocksize=4096, 119 GB / 111 GiB

The details of the selected partition are as follows:

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

MS Data 256940032 490233848 233293817

Directory /

>dr-xr-xr-x 0 0 0 31-Oct-2014 20:49 .

dr-xr-xr-x 0 0 0 31-Oct-2014 20:49 ..

dr-xr-xr-x 0 0 0 21-Nov-2013 09:53 $Recycle.Bin

dr-xr-xr-x 0 0 0 21-Nov-2013 17:05 Boot

dr-xr-xr-x 0 0 0 5-Oct-2014 16:29 Gomes

dr-xr-xr-x 0 0 0 4-Dec-2013 23:39 Intel

dr-xr-xr-x 0 0 0 6-Jan-2014 15:48 MSOCache

dr-xr-xr-x 0 0 0 14-Jul-2009 04:20 PerfLogs

dr-xr-xr-x 0 0 0 12-Sep-2014 22:59 Program Files

dr-xr-xr-x 0 0 0 31-Oct-2014 20:38 Program Files (x86)

dr-xr-xr-x 0 0 0 12-Sep-2014 22:58 ProgramData

dr-xr-xr-x 0 0 0 21-Nov-2013 09:23 Recovery

dr-xr-xr-x 0 0 0 28-Oct-2014 23:12 System Volume Information

dr-xr-xr-x 0 0 0 21-Nov-2013 09:23 Users

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

Is this what we were looking for? Or do I need to run a deeper search?

Reply

Answer 6

Loner T

Level 9

59,471 points

Nov 3, 2014 3:35 AM in response to mannygomez

You have three MS Data entries of 233293817. Each of them is candidate for being your lost NTFS partition. The listing you are looking at has three numbers which are 256940032/490233848/233293817. These are start/end/size numbers. Using the the size number, 233293817 / (2 * 1024 *1024) = 111+ GB. Do you recall your Windows partition size?

Scroll to the first one and enter "P", if it does not show any familiar files, go to the next MS Data entry. You have three start points to look at

23646216, 256940032 and 256940039. The last two are fairly close, and the smaller number should be used (the difference is only 7 bytes).

256938856 194233496

451172352 39061504 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

Your GPT entries are from the output of GPT command. Assuming 256940032 to be the correct NTFS start, the "hole" starts at 256938856,

which is 1,716 bytes before 256940032. This is the issue with Yosemite. It moves partitions around but leaves this hold with customer data. If it is not caught early, you will lose data.

Once you establish which of the three MS Data entries is to be used, the current GPT#4 is deleted, and a new one is created using the chosen start/end/size and the corresponding MBR rebuilt and tested.

Please post the output of the files list of the other two MS Data entries. I suspect the first one is damaged.

Reply

Answer 7

mannygomez Author

Level 1

0 points

Nov 3, 2014 6:32 AM in response to Loner T

Yes, the windows partition was about that size (111GB+).

The second MS data partition (starting 256940032) seems to be the correct one (the other 2 say the system is damaged). See output example below:

MS Data 23646216 256940032 233293817

Can't open filesystem. Filesystem seems damaged.

My last picture above show the listing of that partition, which contains the folder I'm trying to recover ("Gomes") plus all other windows files.

Should I proceed and delete current GPT#4 and create a new one? Is the code below correct to proceed?

sudo gdisk /dev/rdisk0

p

d #4

n #4

256940032

490233848

0700

p

Thanks!

Reply

Answer 8

Loner T

Level 9

59,471 points

Nov 3, 2014 6:42 AM in response to mannygomez

mannygomez wrote:

Should I proceed and delete current GPT#4 and create a new one? Is the code below correct to proceed?

sudo gdisk /dev/rdisk0

p

d #4

n #4

256940032

490233848

0700

p

Thanks!

sudo gdisk /dev/rdisk0

p

d

4

n

4

256940032

490233848

0700

p

w

y

Reply

Answer 9

mannygomez Author

Level 1

0 points

Nov 3, 2014 9:39 AM in response to Loner T

Thanks Loner T,

Bootcamp is now back in the Finder, and fortunately all the important folders seem to be there (!)

However, I cannot boot with Windows yet.

What additional steps do I need to take to boot with Windows?

Reply

Answer 10

Loner T

Level 9

59,471 points

Nov 3, 2014 9:47 AM in response to mannygomez

If you have not re-created the hybrid MBR after fixing the partitions, follow these steps.

You need to create the Hybrid MBR. Here is an example...

sudo gdisk /dev/disk0

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): p

Disk /dev/disk0: 490234752 sectors, 233.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 59BDFEEB-1EB4-4529-94FE-3CBC2C3CD513

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 490234718

Partitions will be aligned on 8-sector boundaries

Total free space is 2604 sectors (1.3 MiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EF

2 409640 401060383 191.0 GiB AF05 Macintosh HD

3 401060384 402329919 619.9 MiB AB00 Re

4 402331648 490233848 41.9 GiB 0700 Microsoft basic data

Command (? for help): r

Recovery/transformation command (? for help): h

WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

just hit the Enter key at the below prompt and your MBR partition table will

be untouched.

Type from one to three GPT partition numbers, separated by spaces, to be

added to the hybrid MBR, in sequence: 2 3 4

Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y

Creating entry for GPT partition #2 (MBR partition #2)

Enter an MBR hex code (default AF): AF

Set the bootable flag? (Y/N): n

Creating entry for GPT partition #3 (MBR partition #3)

Enter an MBR hex code (default AB): AB

Set the bootable flag? (Y/N): n

Creating entry for GPT partition #4 (MBR partition #4)

Enter an MBR hex code (default 07): 07

Set the bootable flag? (Y/N): y

Recovery/transformation command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

PARTITIONS!!

Do you want to proceed? (Y/N): y

OK; writing new GUID partition table (GPT) to /dev/disk0.

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Warning: The kernel may continue to use old or deleted partitions.

You should reboot or remove the drive.

The operation has completed successfully.

Now Reboot and verify the output of fdisk again.

Reply

Answer 11

mannygomez Author

Level 1

0 points

Nov 3, 2014 11:01 AM in response to Loner T

Thanks Loner T, I feel we are almost there!!

So I can boot with windows fine, swap startup disk, etc. The output of the fdisk now looks like this

Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 255259680] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 255669320 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 256940032 - 233293817] HPFS/QNX/AUX

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Disk /dev/disk0: 490234752 sectors, 233.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): AED95BC6-A8C7-45F6-B111-5CAE2EBAD67F

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 490234718

Partitions will be aligned on 8-sector boundaries

Total free space is 2052 sectors (1.0 MiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 255669319 121.7 GiB AF05 Macintosh HD

3 255669320 256938855 619.9 MiB AB00 Recovery HD

4 256940032 490233848 111.2 GiB 0700 Microsoft basic data

With Mac I can access both Macintosh and Bootcamp hard drives and all the data inside them, whereas when I boot with Windows, I can only access the Bootcamp drive (C:). When I click on the Macintosh drive (D:), it gives me the following message: 'You need to format the disk in Drive D: before you can use it'

What do I need to do to get around this issue?

Reply

Answer 12

Loner T

Level 9

59,471 points

Nov 3, 2014 10:58 AM in response to mannygomez

Please see windows 8 does not recognise Macintosh HD, No drive Letter. Do NOT format D: You will lose OSX.

Yosemite upgrade broke the readability of the OSX volume on Windows side, because it was converted from HFS+ to CoreStorage. This requires Apple to fix it. This is from your first post.

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS Macintosh HD *130.3 GB disk1

Logical Volume on disk0s2

D1498301-E94E-48FF-B819-BF4B24BDAE9C

Unlocked Encrypted

Reply

Answer 13

mannygomez Author

Level 1

0 points

Nov 3, 2014 11:11 AM in response to Loner T

Thanks Loner T.

Unfortunately I will have to wait for a possible fix in the future, but the most important thing was to recover the information in Bootcamp and being able to run Windows again.

Your help was invaluable, really appreciate it.

Best wishes,

Manny

Reply