You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Win7 missing after Yosemite upgrade

Hi Loner T,


I'm hoping you can help me, I've been searching through your threads for hours trying to figure out how I fix my Windows boot partition, here are my command dumps, I've managed to get the disk to show up during startup but it states that operating system not found:


diskutil list


/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *750.2 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Untitled 199.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 550.0 GB disk0s4


diskutil cs list


No CoreStorage logical volume groups found


sudo gpt -vv -r show /dev/disk0


gpt show: /dev/disk0: mediasize=750156374016; sectorsize=512; blocks=1465149168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1465149167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 389251256 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

389660896 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

390930432 1074216960 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1465147392 1743

1465149135 32 Sec GPT table

1465149167 1 Sec GPT header


sudo fdisk /dev/disk0


Disk: /dev/disk0 geometry: 91201/255/63 [1465149168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 1023 254 63 [ 1 - 390930431] <Unknown ID>

*2: 07 1023 254 63 - 1023 254 63 [ 390930432 - 1074216960] HPFS/QNX/AUX

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused


Unfortunately this bit looks worrying because there is no NTFS preamble:


sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C


00000000 39 4a 2f 71 72 42 72 37 2f 38 39 50 4c 34 71 69 |9J/qrBr7/89PL4qi|

00000010 6e 50 68 72 5a 55 31 53 6d 75 42 66 65 6d 6a 5a |nPhrZU1SmuBfemjZ|

00000020 78 59 4c 72 32 31 76 31 35 6e 5a 64 61 6e 74 71 |xYLr21v15nZdantq|

00000030 49 7a 55 50 44 55 2b 4e 50 43 34 48 52 6e 44 30 |IzUPDU+NPC4HRnD0|

00000040 52 6b 79 4a 41 53 67 79 59 6c 77 71 5a 35 37 63 |RkyJASgyYlwqZ57c|

00000050 4d 76 57 4d 79 35 30 6c 68 6a 44 63 73 42 4a 49 |MvWMy50lhjDcsBJI|

00000060 34 64 73 76 6f 2b 6d 76 63 48 45 74 63 53 55 54 |4dsvo+mvcHEtcSUT|

00000070 79 57 41 41 30 44 48 54 31 65 42 5a 47 39 75 38 |yWAA0DHT1eBZG9u8|

00000080 41 31 43 67 6b 49 33 5a 69 4b 64 70 77 42 34 4d |A1CgkI3ZiKdpwB4M|

00000090 77 46 50 2f 51 39 61 44 73 4e 6d 72 56 45 63 49 |wFP/Q9aDsNmrVEcI|

000000a0 6e 64 73 49 61 52 2b 48 74 6b 68 76 4f 6e 53 33 |ndsIaR+HtkhvOnS3|

000000b0 63 6d 4c 36 70 76 55 4c 74 6e 49 34 71 39 62 67 |cmL6pvULtnI4q9bg|

000000c0 36 6f 61 33 62 4a 34 2f 37 4e 4f 35 2f 49 48 44 |6oa3bJ4/7NO5/IHD|

000000d0 47 73 70 33 52 6f 58 34 50 4b 4b 4f 2b 55 53 38 |Gsp3RoX4PKKO+US8|

000000e0 41 42 4b 73 54 50 74 77 51 30 65 4f 4b 39 49 49 |ABKsTPtwQ0eOK9II|

000000f0 77 65 61 49 4f 66 54 37 54 44 4a 41 51 43 43 53 |weaIOfT7TDJAQCCS|

00000100 4b 69 52 56 34 77 6d 63 41 77 75 46 4e 46 55 4d |KiRV4wmcAwuFNFUM|

00000110 4b 54 38 67 74 65 30 4d 6f 76 67 50 54 75 4f 57 |KT8gte0MovgPTuOW|

00000120 48 58 67 66 32 76 74 62 37 36 37 4d 38 5a 70 57 |HXgf2vtb767M8ZpW|

00000130 45 5a 69 42 2f 59 66 52 55 47 2b 57 66 4f 77 53 |EZiB/YfRUG+WfOwS|

00000140 50 39 6e 56 4f 70 34 54 30 37 6d 51 42 79 6e 7a |P9nVOp4T07mQBynz|

00000150 38 4f 76 4a 64 63 67 57 49 70 54 44 57 54 37 46 |8OvJdcgWIpTDWT7F|

00000160 4f 50 6a 6c 57 66 35 36 68 6f 6f 58 69 33 42 7a |OPjlWf56hooXi3Bz|

00000170 7a 6a 4a 76 35 65 62 71 67 44 79 5a 6b 50 51 72 |zjJv5ebqgDyZkPQr|

00000180 63 52 56 64 44 79 78 57 71 6f 57 7a 63 42 30 6c |cRVdDyxWqoWzcB0l|

00000190 4a 69 4a 72 44 7a 4e 75 67 2f 36 69 48 49 47 47 |JiJrDzNug/6iHIGG|

000001a0 64 61 52 51 30 42 30 34 35 41 55 50 77 41 4f 56 |daRQ0B045AUPwAOV|

000001b0 63 41 64 4c 76 57 42 41 6d 56 6a 49 35 4e 35 58 |cAdLvWBAmVjI5N5X|

000001c0 44 38 49 35 36 64 74 70 4e 57 39 6b 35 39 41 61 |D8I56dtpNW9k59Aa|

000001d0 4a 48 53 57 75 41 5a 4b 55 6d 54 78 35 56 73 35 |JHSWuAZKUmTx5Vs5|

000001e0 61 48 70 39 73 76 33 56 36 74 6a 64 74 63 70 56 |aHp9sv3V6tjdtcpV|

000001f0 79 36 75 55 6f 72 50 31 47 76 75 5a 46 70 4c 38 |y6uUorP1GvuZFpL8|

00000200


Any help would be greatly appreciated!!!!

MacBook Pro, OS X Yosemite (10.10), bootcamp windows 7

Posted on Nov 7, 2014 1:27 AM

Reply
35 replies

Nov 7, 2014 4:30 AM in response to jjkeele

Thank you for starting a new thread.

1. If the Gpt command output has 4 entries (GPT#1,#2,#3 and #4), there is a corresponding entry in the Fdisk output. You have only 2. Is this the state created by Yosemite?


2. The Rdisk0s4 dd looks incorrect.


3. Can you describe in a bit more detail what was done post-Yosemite to arrive at this point?

Nov 7, 2014 8:30 PM in response to Loner T

Doing that now, thanks for the help. You have no idea how much this means to me. All I want is the data back from the bootcamp partition. I've taken the drive out and plugged it in separately on a PC. I'm using Testdisk now and these are the results so far:


TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63

Analyse cylinder 24418/91200: 26%

check_FAT: Unusual media descriptor (0xf0!=0xf8)

Warning: number of heads/cylinder mismatches 16 (FAT) != 255 (HD)

Warning: number of sectors per track mismatches 32 (FAT) != 63 (HD)

EFI System 40 409639 409600 [EFI]

Mac HFS 409640 389660895 389251256

Mac HFS 389660896 390930431 1269536


Should I be worried about the messages in bold?

Nov 8, 2014 4:00 AM in response to jjkeele

The Cylinder/Heads/Sectors (CHS) geometry was valid on very old disks, and is no longer valid on more modern disks. The MBR used for bootcamp still uses such entries which confuse Testdisk. Here is an example. The CHS numbers make very little sense now. Notice the "geometry" entry and the individual entries being different. You can safely ignore such error messages.


sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 31130/255/63 [500118192 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AC 1023 254 63 - 1023 254 63 [ 409640 - 250392096] <Unknown ID>

3: AB 1023 254 63 - 1023 254 63 [ 250801736 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 252071936 - 248045568] HPFS/QNX/AUX

Nov 8, 2014 5:26 AM in response to jjkeele

jjkeele wrote:


I've taken the drive out and plugged it in separately on a PC.

I suggest putting it back in the Mac once Testdisk finishes, because some of the changes that may be necessary to resurrect Windows require changes to the GPT and MBR and Windows can be fussy about hardware path changes for boot manager/loader. Please also look at PhotoRec while the scan is running. Testdisk has the ability to find files and copy them to external disks.

Nov 10, 2014 12:20 AM in response to Loner T

Hi Loner T,


The Testdisk scan just finished and here are the results:


TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63

The harddisk (750 GB / 698 GiB) seems too small! (< 1300 GB / 1210 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 978094912 2052367167 1074272256

MS Data 1016634272 2090906527 1074272256

MS Data 1041079520 2115351775 1074272256

MS Data 1465145343 2539417598 1074272256

[ Continue ]

NTFS, blocksize=4096, 550 GB / 512 GiB


Does this mean nothing is recoverable?

Nov 10, 2014 12:22 AM in response to jjkeele

Oh wait! I pressed enter and now I have this screen:


TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63

Partition Start End Size in sectors

>P EFI System 40 409639 409600 [EFI]

P Mac HFS 409640 389660895 389251256

D Mac HFS 389660896 390930431 1269536

D MS Data 390873088 1465145343 1074272256

D MS Data 392574081 402265937 9691857 [NO NAME]

D MS Data 407107131 407113304 6174

D MS Data 407113304 407119477 6174 [Boot]

D MS Data 426526507 426547245 20739 [NO NAME]

D MS Data 451358403 451364576 6174

D MS Data 451364576 451370749 6174 [Boot]

D MS Data 451364595 451370768 6174

D MS Data 451370768 451376941 6174 [Boot]

D MS Data 451370787 451376960 6174

D MS Data 451376960 451383133 6174 [Boot]

D MS Data 451383136 451386015 2880 [EFISECTOR]

D MS Data 451386016 451388895 2880 [EFISECTOR]

D MS Data 987425840 987437359 11520

D MS Data 1028990352 1029001871 11520

D MS Data 1244741696 1371684864 126943169

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue


Could one of these be the 550GB Bootcamp partition?!!

Nov 10, 2014 4:28 AM in response to jjkeele

From Testdisk


D MS Data 390873088 1465145343 1074272256


The last number that is size indicates a 530+ GiB chunk. This following is from your original GPT entries. The 1269536 bytes part contains some of the NTFS information as 1212192 bytes is the difference between GPT3 Start and Testdisk Start. If everything worked as intended, it should have been 1269536 bytes.


389660896 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

390930432 1074216960 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7



Just a word of warning, some of the other posters with this situation are still unable to get their data out and it is a WIP. No promises that this will come back well. 😉


Do not use right/left cursor keys, which deletes partitions, but just up/down keys. Look in each MS Data entry for familiar Windows files. You should at least see a "System Volume Information" entry. The 6174 and 2880 entries are not useful, but you can look inside them.



Nov 10, 2014 9:54 AM in response to Loner T

Hi Loner T,


Understood! No guarantees! ;-) I am a little confused though, where do I go from here? Do I now need to set the partition start and end manually? If so, do I use Testdisk or Gdisk? Apologies for the novice questions here but as you probably guessed I have no idea what I am doing!


Kind regards

James

Nov 10, 2014 10:20 AM in response to jjkeele

Your are going to delete GPT#3 and GPT#4 using Gdisk and create a new GPT#3. Here are the commands. After these changes, please reboot.


After Reboot, verify that you can see a Bootcamp volume in Finder and see familiar files. Also verify that you can see the NTFS header using


sudo dd if=/dev/rdisk0s3 count=1 2>/dev/null | hexdump -C


sudo gdisk /dev/disk0

p

d

3

d

4

n

3

390873088

1465145343

0700

p

w

y

Win7 missing after Yosemite upgrade

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.