You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

jjkeele Author

Level 1

0 points

Win7 missing after Yosemite upgrade

Hi Loner T,

I'm hoping you can help me, I've been searching through your threads for hours trying to figure out how I fix my Windows boot partition, here are my command dumps, I've managed to get the disk to show up during startup but it states that operating system not found:

diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *750.2 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Untitled 199.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 550.0 GB disk0s4

diskutil cs list

No CoreStorage logical volume groups found

sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=750156374016; sectorsize=512; blocks=1465149168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1465149167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 389251256 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

389660896 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

390930432 1074216960 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1465147392 1743

1465149135 32 Sec GPT table

1465149167 1 Sec GPT header

sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 91201/255/63 [1465149168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 1023 254 63 [ 1 - 390930431] <Unknown ID>

*2: 07 1023 254 63 - 1023 254 63 [ 390930432 - 1074216960] HPFS/QNX/AUX

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Unfortunately this bit looks worrying because there is no NTFS preamble:

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000 39 4a 2f 71 72 42 72 37 2f 38 39 50 4c 34 71 69 |9J/qrBr7/89PL4qi|

00000010 6e 50 68 72 5a 55 31 53 6d 75 42 66 65 6d 6a 5a |nPhrZU1SmuBfemjZ|

00000020 78 59 4c 72 32 31 76 31 35 6e 5a 64 61 6e 74 71 |xYLr21v15nZdantq|

00000030 49 7a 55 50 44 55 2b 4e 50 43 34 48 52 6e 44 30 |IzUPDU+NPC4HRnD0|

00000040 52 6b 79 4a 41 53 67 79 59 6c 77 71 5a 35 37 63 |RkyJASgyYlwqZ57c|

00000050 4d 76 57 4d 79 35 30 6c 68 6a 44 63 73 42 4a 49 |MvWMy50lhjDcsBJI|

00000060 34 64 73 76 6f 2b 6d 76 63 48 45 74 63 53 55 54 |4dsvo+mvcHEtcSUT|

00000070 79 57 41 41 30 44 48 54 31 65 42 5a 47 39 75 38 |yWAA0DHT1eBZG9u8|

00000080 41 31 43 67 6b 49 33 5a 69 4b 64 70 77 42 34 4d |A1CgkI3ZiKdpwB4M|

00000090 77 46 50 2f 51 39 61 44 73 4e 6d 72 56 45 63 49 |wFP/Q9aDsNmrVEcI|

000000a0 6e 64 73 49 61 52 2b 48 74 6b 68 76 4f 6e 53 33 |ndsIaR+HtkhvOnS3|

000000b0 63 6d 4c 36 70 76 55 4c 74 6e 49 34 71 39 62 67 |cmL6pvULtnI4q9bg|

000000c0 36 6f 61 33 62 4a 34 2f 37 4e 4f 35 2f 49 48 44 |6oa3bJ4/7NO5/IHD|

000000d0 47 73 70 33 52 6f 58 34 50 4b 4b 4f 2b 55 53 38 |Gsp3RoX4PKKO+US8|

000000e0 41 42 4b 73 54 50 74 77 51 30 65 4f 4b 39 49 49 |ABKsTPtwQ0eOK9II|

000000f0 77 65 61 49 4f 66 54 37 54 44 4a 41 51 43 43 53 |weaIOfT7TDJAQCCS|

00000100 4b 69 52 56 34 77 6d 63 41 77 75 46 4e 46 55 4d |KiRV4wmcAwuFNFUM|

00000110 4b 54 38 67 74 65 30 4d 6f 76 67 50 54 75 4f 57 |KT8gte0MovgPTuOW|

00000120 48 58 67 66 32 76 74 62 37 36 37 4d 38 5a 70 57 |HXgf2vtb767M8ZpW|

00000130 45 5a 69 42 2f 59 66 52 55 47 2b 57 66 4f 77 53 |EZiB/YfRUG+WfOwS|

00000140 50 39 6e 56 4f 70 34 54 30 37 6d 51 42 79 6e 7a |P9nVOp4T07mQBynz|

00000150 38 4f 76 4a 64 63 67 57 49 70 54 44 57 54 37 46 |8OvJdcgWIpTDWT7F|

00000160 4f 50 6a 6c 57 66 35 36 68 6f 6f 58 69 33 42 7a |OPjlWf56hooXi3Bz|

00000170 7a 6a 4a 76 35 65 62 71 67 44 79 5a 6b 50 51 72 |zjJv5ebqgDyZkPQr|

00000180 63 52 56 64 44 79 78 57 71 6f 57 7a 63 42 30 6c |cRVdDyxWqoWzcB0l|

00000190 4a 69 4a 72 44 7a 4e 75 67 2f 36 69 48 49 47 47 |JiJrDzNug/6iHIGG|

000001a0 64 61 52 51 30 42 30 34 35 41 55 50 77 41 4f 56 |daRQ0B045AUPwAOV|

000001b0 63 41 64 4c 76 57 42 41 6d 56 6a 49 35 4e 35 58 |cAdLvWBAmVjI5N5X|

000001c0 44 38 49 35 36 64 74 70 4e 57 39 6b 35 39 41 61 |D8I56dtpNW9k59Aa|

000001d0 4a 48 53 57 75 41 5a 4b 55 6d 54 78 35 56 73 35 |JHSWuAZKUmTx5Vs5|

000001e0 61 48 70 39 73 76 33 56 36 74 6a 64 74 63 70 56 |aHp9sv3V6tjdtcpV|

000001f0 79 36 75 55 6f 72 50 31 47 76 75 5a 46 70 4c 38 |y6uUorP1GvuZFpL8|

00000200

Any help would be greatly appreciated!!!!

MacBook Pro, OS X Yosemite (10.10), bootcamp windows 7

Posted on Nov 7, 2014 1:27 AM

35 replies

jjkeele Author

Level 1

0 points

Nov 10, 2014 5:32 PM in response to Loner T

Yes, and the files were there! But now the terminal is closed.

Loner T

Level 9

59,513 points

Nov 10, 2014 5:38 PM in response to jjkeele

Can you post the output of sudo gpt -vv -r show /dev/disk0?

jjkeele Author

Level 1

0 points

Nov 10, 2014 5:49 PM in response to Loner T

Sure! Thanks for the continued help, I can see that you are trying so hard to help so many people.

sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=750156374016; sectorsize=512; blocks=1465149168

gpt show: /dev/disk0: PMBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1465149167

start size index contents

0 1 PMBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 389251256 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

389660896 1212192

390873088 1074272256 3 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1465145344 3791

1465149135 32 Sec GPT table

1465149167 1 Sec GPT header

Loner T

Level 9

59,513 points

Nov 10, 2014 5:52 PM in response to jjkeele

Does diskutil list show GPT#3 as disk0s3?

jjkeele Author

Level 1

0 points

Nov 10, 2014 6:08 PM in response to Loner T

Here are the details:

Verifying volume “disk0s3”

Verifying file system.

** /dev/rdisk0s3

Invalid BS_jmpBoot in boot block: 449fb2

File system check exit code is 8.

Error: This disk needs to be repaired. Click Repair Disk.

Updating boot support partitions for the volume as required.

Error: Disk Utility can’t repair this disk. Back up as many of your files as possible, reformat the disk, and restore your backed-up files.

Loner T

Level 9

59,513 points

Nov 10, 2014 6:20 PM in response to jjkeele

This is an NTFS volume, Disk Utility cannot be used to manipulate it. From the OS X terminal, can you post the output of diskutil list command?

jjkeele Author

Level 1

0 points

Nov 10, 2014 6:31 PM in response to Loner T

:-( I wasn't kidding when I said I was having difficulties!

diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *750.2 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Untitled 199.3 GB disk0s2

3: Microsoft Basic Data 550.0 GB disk0s3

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: FDisk_partition_scheme *1.5 TB disk1

1: DOS_FAT_32 HELP 1.5 TB disk1s1

Loner T

Level 9

59,513 points

Nov 10, 2014 6:37 PM in response to jjkeele

I would recommend disconnecting your external disk to avoid any accidental damage.

Can post the output of (you can triple-click on the command line and use Command+C(Copy) and Command+V(Paste) into the Terminal window.

sudo dd if=/dev/rdisk0s3 count=1 2>/dev/null | hexdump -C

jjkeele Author

Level 1

0 points

Nov 10, 2014 6:56 PM in response to Loner T

00000000 44 9f b2 1d 7a 84 0f 7e 8f 99 fb 24 15 64 6b 31 |D...z..~...$.dk1|

00000010 65 e0 65 16 95 43 61 8a ed ef 99 8d fa 87 d2 fe |e.e..Ca.........|

00000020 3d b3 2a fe 13 11 cd d6 1f 19 2e df 32 bc 94 24 |=.*.........2..$|

00000030 15 f5 64 f4 b2 56 54 a2 a1 be b9 22 7c aa 91 be |..d..VT...."|...|

00000040 b1 42 c3 f9 9b bb 34 9c c5 5b 18 ce d5 ef 9a f5 |.B....4..[......|

00000050 ef d4 4d 1a 86 ec 07 ef aa c8 ee ba cb 80 6c 10 |..M...........l.|

00000060 5e c8 8b 02 ff a3 af 2d d4 df cd 74 da 64 ca c1 |^......-...t.d..|

00000070 cd 28 be e0 5b 03 5a 33 df 35 de 89 ae d4 d0 ea |.(..[.Z3.5......|

00000080 6b 44 ab b7 8e 56 07 1d ad b3 e9 0c ad bb 08 ad |kD...V..........|

00000090 ca e6 68 59 34 b4 72 8d 68 bd 72 17 a3 a1 46 f1 |..hY4.r.h.r...F.|

000000a0 43 4a c3 82 48 52 6e 81 77 ef 7a ec 6d c0 b4 11 |CJ..HRn.w.z.m...|

000000b0 b7 c9 63 2d 14 e9 ea 80 ea 46 6c df 12 46 6b 74 |..c-.....Fl..Fkt|

000000c0 5b 53 aa fc ce c4 79 7f 50 14 70 ec 90 dd 0c 2e |[S....y.P.p.....|

000000d0 7a 8b 22 72 ad 66 b9 da bb a4 f5 c4 e9 b2 6f 29 |z."r.f........o)|

000000e0 39 a0 da 18 a8 e3 c2 b4 f8 17 a2 42 87 f4 8b 88 |9..........B....|

000000f0 1a bf 69 d4 e8 56 6e 56 e3 ff a4 94 13 29 40 3a |..i..VnV.....)@:|

00000100 b5 44 75 01 cf bf 72 8e f5 66 a4 b8 75 81 39 fc |.Du...r..f..u.9.|

00000110 11 ed 53 90 3c 6a 50 ea e7 ab a4 40 dd 40 27 c5 |..S.<jP....@.@'.|

00000120 db 59 4d 49 71 72 7e 24 29 4a e6 93 c7 dd a6 38 |.YMIqr~$)J.....8|

00000130 07 bb 00 22 0b cb e8 90 28 12 a2 96 25 ae a7 91 |..."....(...%...|

00000140 20 dd c9 66 f8 de 9c ea 63 2e 16 7d ca 15 f7 66 | ..f....c..}...f|

00000150 67 3b 30 77 b7 e9 8b ca dc 41 65 d0 07 38 51 6f |g;0w.....Ae..8Qo|

00000160 a1 43 13 95 83 87 2e 66 ab 17 b4 b3 56 9e 9c 6f |.C.....f....V..o|

00000170 d6 43 9d da 8a 4e 68 54 e1 cb b4 fd 18 20 c2 d5 |.C...NhT..... ..|

00000180 3b 49 8b 84 e4 dd bd d8 01 5c f2 7c b3 21 77 ce |;I.......\.|.!w.|

00000190 c1 9f 19 e5 98 09 ee 9f f3 54 92 2c ea 67 20 c9 |.........T.,.g .|

000001a0 d2 7e 44 12 8c 9f 87 48 ec 9b 67 36 58 ed 2d 61 |.~D....H..g6X.-a|

000001b0 8d dc a3 7c 31 4f 6f ba 53 9a 80 b7 9a 24 9a 6a |...|1Oo.S....$.j|

000001c0 95 ef e7 32 fd 12 a7 1a d2 2f f1 87 44 c4 08 95 |...2...../..D...|

000001d0 7b 43 2d f8 37 0f c1 4f 3a 7f 64 d3 ad 5a 46 04 |{C-.7..O:.d..ZF.|

000001e0 9d 9a d0 a8 4f 06 a3 51 d7 f7 19 8d 22 6b cc a5 |....O..Q...."k..|

000001f0 1a 9d e2 1f d2 12 56 e9 ee bf 2b 8d 4e e1 a3 0e |......V...+.N...|

00000200

Loner T

Level 9

59,513 points

Nov 10, 2014 7:04 PM in response to jjkeele

You may have to run Testdisk again and find it again and verify that it is the correct header. If the DU verification tried to make any changes and corrupted anything, there may be trouble. Let Testdisk find out. There is very little choice. Please post the output of Testdisk when you find the files, so it is recorded on this thread.

jjkeele Author

Level 1

0 points

Nov 13, 2014 8:10 AM in response to Loner T

Thanks LonerT! I've run Testdisk again and this what it gave me:

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 750 GB / 698 GiB - 1465149168 sectors (RO)

The harddisk (750 GB / 698 GiB) seems too small! (< 1300 GB / 1210 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

MS Data 978094912 2052367167 1074272256

> MS Data 1016634272 2090906527 1074272256

MS Data 1041079520 2115351775 1074272256

MS Data 1465145343 2539417598 1074272256

[ Continue ]

NTFS, blocksize=4096, 550 GB / 512 GiB

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 750 GB / 698 GiB - 1465149168 sectors (RO)

Partition Start End Size in sectors

>P EFI System 40 409639 409600 [EFI]

P Mac HFS 409640 389660895 389251256

D Mac HFS 389660896 390930431 1269536

D MS Data 390873088 1465145343 1074272256

D MS Data 392574081 402265937 9691857 [NO NAME]

D MS Data 407107131 407113304 6174

D MS Data 407113304 407119477 6174 [Boot]

D MS Data 426526507 426547245 20739 [NO NAME]

D MS Data 451358403 451364576 6174

D MS Data 451364576 451370749 6174 [Boot]

D MS Data 451364595 451370768 6174

D MS Data 451370768 451376941 6174 [Boot]

D MS Data 451370787 451376960 6174

D MS Data 451376960 451383133 6174 [Boot]

D MS Data 451383136 451386015 2880 [EFISECTOR]

D MS Data 451386016 451388895 2880 [EFISECTOR]

D MS Data 987425840 987437359 11520

D MS Data 1028990352 1029001871 11520

D MS Data 1244741696 1371684864 126943169

Loner T

Level 9

59,513 points

Nov 13, 2014 9:39 AM in response to jjkeele

Can you look into the following?The first one looks the most likely candidate.

D MS Data 390873088 1465145343 1074272256

D MS Data 1244741696 1371684864 126943169

jjkeele Author

Level 1

0 points

Nov 13, 2014 11:45 AM in response to Loner T

I was able to look into the first one and a couple of others but unfortunately the "q" key has different effects depending on the partition I am viewing and I accidentally exited testdisk back to the main menu and lost all the analysis. I wish there was a way of preserving the analysis so that I could "p" / view the files for all of the partitions without accidentally exiting test disk.

I wasn't able to view the second partition you specified.

Is there a way I can view the files in testdisk or another application simply by stating the start and end cylinder results that I obtained from testdisk. I did find a partition that contain a "system volume information" folders.

Loner T

Level 9

59,513 points

Nov 13, 2014 12:37 PM in response to jjkeele

Unless you dump every block on the disk and scan through such dumps, it is painful. One option is to look at the Testdisk log, that you create/append to on the first screen that Testdisk shows.

jjkeele Author

Level 1

0 points

Nov 13, 2014 2:55 PM in response to Loner T

Well, it was worth asking! Interestingly, whenever I start analysis it always starts from 26% at about cylinder 25,000. Why is this?

Win7 missing after Yosemite upgrade