caresi

Q: Yosemite deleted my bootcamp

Hello!

 

So I updated my MBP late 2011 yesterday and now when I boot into "alt" menu, I can only see my macbook disk and not my windows.

I have searched the internet and tried using testdisk but im not a computer geek so I didnt understand how to use it. Im really sad because I had files that I forgot to backup on the disk. I dont necessarily have to be able to boot to windows again if there is no way but I really like to have a way to access the lost files and save the ones I want and then do a clean install. However if there is a way to save windows 100% I'd love you forever.

 

Here is a dump:

 

Simon$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=750156374016; sectorsize=512; blocks=1465149168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1465149167

       start        size  index  contents

           0           1         MBR

           1           1         Pri GPT header

           2          32         Pri GPT table

          34           6        

          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

      409640  1110359120      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

  1110768760     1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

  1112038296   157219944        

  1269258240   195889152      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  1465147392        1743        

  1465149135          32         Sec GPT table

  1465149167           1         Sec GPT header

 

 

Cheers!

Simon

MacBook Pro, OS X Yosemite (10.10)

Posted on Nov 11, 2014 12:49 AM

Close

Q: Yosemite deleted my bootcamp

  • All replies
  • Helpful answers

  • by Loner T,

    Loner T Loner T Nov 11, 2014 3:42 AM in response to caresi
    Level 7 (24,202 points)
    Safari
    Nov 11, 2014 3:42 AM in response to caresi

    You seem to have been bitten by the Yosemite bug.

     

    The GAP between GPT#3 and GPT#4 usually indicates that Yosemite corrupted the NTFS headers during its partition movement trick.

     

    Can you look at Re: Boot camp lost after upgrading to Yosemite from mountain lion as reference and download Testdisk and GPT Fdisk and start with Testdisk?

  • by caresi,

    caresi caresi Nov 11, 2014 3:54 AM in response to Loner T
    Level 1 (0 points)
    Nov 11, 2014 3:54 AM in response to Loner T

    Hello Loner T!

     

    I have GPT and testdisk.

     

    When im in testdisk, im pressing anylize and scan. then after selecting Ms data once i get a list of msdata. One of them Im able to press P and see my lovley files such as program files, windows, user etc.

     

    however where do I get my start end section if i have more than one MSData in list?

     

    Only one of the items will show my files, the others says cant show files becuase of some error :/ **** i should have backuped!

     

    Im in forever favour if you just would help me with a push start!

     

    Cheers mate!

    Simon

  • by Loner T,

    Loner T Loner T Nov 11, 2014 3:59 AM in response to caresi
    Level 7 (24,202 points)
    Safari
    Nov 11, 2014 3:59 AM in response to caresi

    Can you post the start/end/size that Testdisk reports where you can see your files? Copy/Paste from the Testdisk terminal window with the files listed will be even better.

  • by caresi,

    caresi caresi Nov 11, 2014 4:08 AM in response to Loner T
    Level 1 (0 points)
    Nov 11, 2014 4:08 AM in response to Loner T

    I will report when I have it. Its currently freezing in quickscan :s

     

    Cheers

    Simon

  • by caresi,

    caresi caresi Nov 11, 2014 4:50 AM in response to Loner T
    Level 1 (0 points)
    Nov 11, 2014 4:50 AM in response to Loner T

    Hello is this what you mean?

     

    first i get:

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 750 GB / 698 GiB - 1465149168 sectors (RO)

     

    The harddisk (750 GB / 698 GiB) seems too small! (< 850 GB / 792 GiB)

    Check the harddisk size: HD jumpers settings, BIOS detection...

     

    The following partitions can't be recovered:

         Partition               Start        End    Size in sectors

    >  MS Data               1465147391 1661036542  195889152

       Mac HFS               1465149124 1466418659    1269536

     

    then I press MSdata ill get:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 750 GB / 698 GiB - 1465149168 sectors (RO)

         Partition               Start        End    Size in sectors

    >P EFI System                    40     409639     409600 [EFI]

    D Mac HFS                   409640 1110043687 1109634048

    D MS Data                759113736 1112039424  352925689

    D Mac HFS               1110768760 1112038295    1269536

    D MS Data               1112039424 1464965112  352925689

    D MS Data               1269258240 1465147391  195889152

    D Mac HFS               1463879592 1465149127    1269536

     

     

     

     

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

    FAT32, blocksize=512, 209 MB / 200 MiB

     

    and the one with my files looks like this:

     

    TestDisk 7.0-WIP, Data Recovery Utility, October 2014

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

         MS Data               1112039424 1464965112  352925689

    Directory /

                                                       Previous

    dr-xr-xr-x     0     0         0  6-Apr-2014 20:39 Games

    dr-xr-xr-x     0     0         0 27-Jun-2012 13:40 Intel

    >dr-xr-xr-x     0     0         0 14-Jul-2009 05:20 PerfLogs

    dr-xr-xr-x     0     0         0  9-Oct-2014 22:25 Program Files

    dr-xr-xr-x     0     0         0  5-Nov-2014 16:23 Program Files (x86)

    dr-xr-xr-x     0     0         0  6-Nov-2014 18:00 ProgramData

    dr-xr-xr-x     0     0         0 27-Jun-2012 13:28 Recovery

    dr-xr-xr-x     0     0         0  5-Nov-2014 16:23 System Volume Information

    dr-xr-xr-x     0     0         0 27-Jun-2012 13:29 Users

    dr-xr-xr-x     0     0         0  3-Nov-2014 09:44 Windows

    -r--r--r--     0     0      8192 27-Jun-2012 23:17 BOOTSECT.BAK

    -r--r--r--     0     0         0 20-Aug-2014 13:21 Cookies

                                                       Next

    Use Right to change directory, h to hide Alternate Data Stream

        q to quit, : to select the current file, a to select all files

        C to copy the selected files, c to copy the current file

     

    I will be forever in your favour if you help me out!

     

    Cheers!

    Simon

  • by Loner T,Helpful

    Loner T Loner T Nov 11, 2014 5:45 AM in response to caresi
    Level 7 (24,202 points)
    Safari
    Nov 11, 2014 5:45 AM in response to caresi

    From your current GPT output, you have

     

    1112038296   157219944        

    1269258240   195889152      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7'


    From your Testdisk output you have

     

    MS Data               1112039424 1464965112  352925689


    The difference is 1128 bytes. Please use the following steps and test.



    1. Delete the old entry and create a new entry at GPT#4.

     

    sudo gdisk /dev/disk0

    p

    d

    4

    n

    4

    1112039424

    1464965112

    0700

    p

    w

    y

     

    Here is an example of the delete/new...

     

    Command (? for help): d

    Partition number (1-4): 4

     

    Command (? for help): n

    Partition number (4-128, default 4): 4

    First sector (34-1954210086, default = 1454210080) or {+-}size{KMGTP}: 1454211072

    Last sector (1454211072-1954210086, default = 1954210086) or {+-}size{KMGTP}: 1954209791

    Current type is 'Apple HFS/HFS+'

    Hex code or GUID (L to show codes, Enter = AF00): 0700

    Changed type of partition to 'Microsoft basic data'

     

    Command (? for help): p

    Disk /dev/disk0: 1954210120 sectors, 931.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): 6ED0C429-00D1-4759-B50E-04B6FB80D0E3

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 1954210086

    Partitions will be aligned on 8-sector boundaries

    Total free space is 1293 sectors (646.5 KiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EFI System Partition

       2          409640      1452940543   692.6 GiB   AF00  Customer

       3      1452940544      1454210079   619.9 MiB   AB00  Recovery HD

       4      1454211072      1954209791   238.4 GiB   0700  Microsoft basic data



    2. This is a tedious process and you want to check after the second 'p'rint command that it looks reasonable, before the 'w'rite and 'y'es to confirm.

     

    3. You will need to reboot after the change, because the disk you are booted from is the one being modified. Reboot will rebuild disk0s4 using the start/end you entered.

     

    4. Run the dd command - sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C and check that the first line contains "R.NTFS".

     

    5. Once you have a working GPT#4, a new hybrid MBR needs to be created which will overwrite what you see in your Fdisk output. This is also done using GPT Fdisk (Gdisk). Your numbers will look different than what are in the following example. In most cases, you will use the default except entry 4, which should have a 'y' for bootable flag.

     

    sudo gdisk /dev/disk0

    GPT fdisk (gdisk) version 0.8.10

     

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Partition table scan:

      MBR: hybrid

      BSD: not present

      APM: not present

      GPT: present

     

    Found valid GPT with hybrid MBR; using GPT.

     

    Command (? for help): p

    Disk /dev/disk0: 490234752 sectors, 233.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): 59BDFEEB-1EB4-4529-94FE-3CBC2C3CD513

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 490234718

    Partitions will be aligned on 8-sector boundaries

    Total free space is 2604 sectors (1.3 MiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EF

       2          409640       401060383   191.0 GiB   AF05  Macintosh HD

       3       401060384       402329919   619.9 MiB   AB00  Re

       4       402331648       490233848   41.9 GiB    0700  Microsoft basic data

     

    Command (? for help): r

     

    Recovery/transformation command (? for help): h

     

    WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

    just hit the Enter key at the below prompt and your MBR partition table will

    be untouched.

     

    Type from one to three GPT partition numbers, separated by spaces, to be

    added to the hybrid MBR, in sequence: 2 3 4

    Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y

     

    Creating entry for GPT partition #2 (MBR partition #2)

    Enter an MBR hex code (default AF): AF

    Set the bootable flag? (Y/N): n

     

    Creating entry for GPT partition #3 (MBR partition #3)

    Enter an MBR hex code (default AB): AB

    Set the bootable flag? (Y/N): n

     

    Creating entry for GPT partition #4 (MBR partition #4)

    Enter an MBR hex code (default 07): 07

    Set the bootable flag? (Y/N): y

     

    Recovery/transformation command (? for help): w

     

    Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

    PARTITIONS!!

     

    Do you want to proceed? (Y/N): y

    OK; writing new GUID partition table (GPT) to /dev/disk0.

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Warning: The kernel may continue to use old or deleted partitions.

    You should reboot or remove the drive.

    The operation has completed successfully.

     

    6. a. Test 1 - Can you see your Bootcamp volume in Finder.

        b. Test 2 - Can you files in the Bootcamp volume?

        c. Test 3 - Can you see Bootcamp in your System Preferences -> Startup Disk.

        d. Test 4 - If Test 1-3 are successful, select Bootcamp and click on Restart. You may need Windows startup repair, if you see a hanging underline cursor at the top left corner of your screen. In most cases, it is not required.

  • by caresi,

    caresi caresi Nov 11, 2014 6:20 AM in response to Loner T
    Level 1 (0 points)
    Nov 11, 2014 6:20 AM in response to Loner T

    Hi!

     

    I did step 4 and it showed right in dump! I can now see the drive in the finder Do I have to continue? with step 5 and so on?

     

    Cheers

    Simon

     

    Edit:

    Why should only partion 4 be set as bootable? I want to be able to boot my Mac in OSX as well.

  • by Loner T,Solvedanswer

    Loner T Loner T Nov 11, 2014 6:29 AM in response to caresi
    Level 7 (24,202 points)
    Safari
    Nov 11, 2014 6:29 AM in response to caresi

    Yes, you need step 5. Do tests 6 a,b and c work?

     

    OSX boot-ability is determined by the EFI using GPT while Windows boot ability is determined by the Hybrid MBR, due to the use of the CSM-BIOS layer used by Bootcamp.

  • by caresi,

    caresi caresi Nov 11, 2014 10:14 AM in response to Loner T
    Level 1 (0 points)
    Nov 11, 2014 10:14 AM in response to Loner T

    Hi!

     

    Thank you so much! You just saved everything! Im forever in your favor! The world needs more nice people like you

     

    Cheers!

  • by Loner T,

    Loner T Loner T Nov 11, 2014 10:22 AM in response to caresi
    Level 7 (24,202 points)
    Safari
    Nov 11, 2014 10:22 AM in response to caresi

    Glad to see it work.

     

    Please switch between OSX and Windows and ensure it works both ways. Please backup Windows and OSX, before any further changes are made.