You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Boot camp missing when update to Yosemite

Hi, I was update to Yosemite and didn't notice the Boot camp bug, is it possible to recover back my windows 7? Because I have important data inside...

Thanks


GPT output

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 488281248 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

488690888 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

489960424 232907800

722868224 253904896 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

976773120 15

976773135 32 Sec GPT table

976773167 1 Sec GPT header

LunaSea:~ Sugizo$

Fdisk output

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AC 1023 254 63 - 1023 254 63 [ 409640 - 488281248] <Unknown ID>

3: AB 1023 254 63 - 1023 254 63 [ 488690888 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 722868224 - 253904896] Win95 FAT32L

MacBook Pro (13-inch Mid 2012), OS X Yosemite (10.10)

Posted on Nov 12, 2014 5:56 AM

Reply
30 replies

Nov 12, 2014 7:04 AM in response to RockingGarage

Start with Testdisk. Here is a step-by-step guide. http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step


You need to use the EFI partition and use Deeper Search to locate your 'lost partition'. You are looking for familiar Windows files in MS Data partitions including 'System Volume Information'.


Once it is found, the GPT (GUID partition table) is manipulated to point to the correct partition location 9by deleting the current GPT#4 and creating a new one). A new Hybrid MBR is created using GPT Fdisk (gdisk) and then tested to make sure Windows can be resurrected.

Nov 12, 2014 7:08 PM in response to Loner T

Dear Loner T,


Thanks for your help, I already run the testdisk, below is the result, what should I do next?


Disk /dev/disk0 - 500 GB / 465 GiB - 976773168 sectors (RO)

Partition Start End Size in sectors

>P DOS_FAT_32 40 409639 409600 [EFI]

P HFS 488690888 489960423 1269536


Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

FAT32, blocksize=512, 209 MB / 200 MiB

Nov 12, 2014 7:25 PM in response to RockingGarage

1. Do not use left/right cursor keys anywhere in Testdisk, because these change partition types among other things.

2. Press Enter/Return to continue.

3. You will get a list of MS Data partitions. The start/end/size will look very similar to your GPT output as shown in your original post.

4. Look in each MS Data entry for familiar files. You may see some at the top level, but use the step-by-step by guide and run a deeper search, which will show you 'lost' MS Data partitions as well. These are the ones you should look into for familiar files.

Nov 13, 2014 9:44 AM in response to Loner T

Hi Toner L,


I hope I am doing it right, I got the result below


Disk /dev/disk0 - 500 GB / 465 GiB - 976773168 sectors (RO)

Partition Start End Size in sectors

P EFI System 40 409639 409600 [EFI]

D MS Data 3149832 489961472 486811641

D Mac HFS 488690888 489960423 1269536

>D MS Data 489961472 976773112 486811641

D MS Data 722868224 976773119 253904896

D Mac HFS 975503592 976773127 1269536


Only the second MS Data have the windows file as below


MS Data 489961472 976773112 486811641

Directory /

Previous

dr-xr-xr-x 0 0 0 18-Oct-2014 10:42 Boot

dr-xr-xr-x 0 0 0 16-Oct-2014 22:08 Config.Msi

dr-xr-xr-x 0 0 0 19-May-2014 22:16 DirectX End user

dr-xr-xr-x 0 0 0 20-Jan-2014 11:21 Intel

dr-xr-xr-x 0 0 0 19-May-2014 23:27 MSOCache

dr-xr-xr-x 0 0 0 14-Jul-2009 11:20 PerfLogs

dr-xr-xr-x 0 0 0 4-Oct-2014 22:49 Program Files

dr-xr-xr-x 0 0 0 1-Nov-2014 06:45 Program Files (x86)

dr-xr-xr-x 0 0 0 1-Nov-2014 06:46 ProgramData

dr-xr-xr-x 0 0 0 31-Mar-2014 00:46 QvodPlayer

dr-xr-xr-x 0 0 0 20-Jan-2014 11:15 Recovery

>dr-xr-xr-x 0 0 0 17-Oct-2014 20:17 System Volume Information

dr-xr-xr-x 0 0 0 1-Nov-2014 06:47 Users

dr-xr-xr-x 0 0 0 1-Nov-2014 06:45 Windows


So what is the next step?

Nov 13, 2014 9:56 AM in response to RockingGarage

Based on what you have posted...


GPT 3 Start GPT 3 Size GPT 3 End NTFS Start Byte Offset NTFS Size NTFS End
488690888 1269536 489960424 489961472 1048 486811641 976773113


Please use the following steps and test.

1. Delete the old entry and create a new entry at GPT#4.


sudo gdisk /dev/disk0

p

d

4

n

4

489961472

976773112

0700

p

w

y


Here is an example of the delete/new...


Command (? for help): d

Partition number (1-4): 4


Command (? for help): n

Partition number (4-128, default 4): 4

First sector (34-1954210086, default = 1454210080) or {+-}size{KMGTP}: 1454211072

Last sector (1454211072-1954210086, default = 1954210086) or {+-}size{KMGTP}: 1954209791

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): 0700

Changed type of partition to 'Microsoft basic data'


Command (? for help): p

Disk /dev/disk0: 1954210120 sectors, 931.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 6ED0C429-00D1-4759-B50E-04B6FB80D0E3

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 1954210086

Partitions will be aligned on 8-sector boundaries

Total free space is 1293 sectors (646.5 KiB)


Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 1452940543 692.6 GiB AF00 Customer

3 1452940544 1454210079 619.9 MiB AB00 Recovery HD

4 1454211072 1954209791 238.4 GiB 0700 Microsoft basic data

2. This is a tedious process and you want to check after the second 'p'rint command that it looks reasonable, before the 'w'rite and 'y'es to confirm.


3. You will need to reboot after the change, because the disk you are booted from is the one being modified. Reboot will rebuild disk0s4 using the start/end you entered.


4. Run the dd command - sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C and check that the first line contains "R.NTFS".


5. Once you have a working GPT#4, a new hybrid MBR needs to be created which will overwrite what you see in your Fdisk output. This is also done using GPT Fdisk (Gdisk). Your numbers will look different than what are in the following example. In most cases, you will use the default except entry 4, which should have a 'y' for bootable flag.


sudo gdisk /dev/disk0

GPT fdisk (gdisk) version 0.8.10


Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present


Found valid GPT with hybrid MBR; using GPT.


Command (? for help): p

Disk /dev/disk0: 490234752 sectors, 233.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 59BDFEEB-1EB4-4529-94FE-3CBC2C3CD513

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 490234718

Partitions will be aligned on 8-sector boundaries

Total free space is 2604 sectors (1.3 MiB)


Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EF

2 409640 401060383 191.0 GiB AF05 Macintosh HD

3 401060384 402329919 619.9 MiB AB00 Re

4 402331648 490233848 41.9 GiB 0700 Microsoft basic data


Command (? for help): r


Recovery/transformation command (? for help): h


WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

just hit the Enter key at the below prompt and your MBR partition table will

be untouched.


Type from one to three GPT partition numbers, separated by spaces, to be

added to the hybrid MBR, in sequence: 2 3 4

Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y


Creating entry for GPT partition #2 (MBR partition #2)

Enter an MBR hex code (default AF): AF

Set the bootable flag? (Y/N): n


Creating entry for GPT partition #3 (MBR partition #3)

Enter an MBR hex code (default AB): AB

Set the bootable flag? (Y/N): n


Creating entry for GPT partition #4 (MBR partition #4)

Enter an MBR hex code (default 07): 07

Set the bootable flag? (Y/N): y


Recovery/transformation command (? for help): w


Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

PARTITIONS!!


Do you want to proceed? (Y/N): y

OK; writing new GUID partition table (GPT) to /dev/disk0.

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Warning: The kernel may continue to use old or deleted partitions.

You should reboot or remove the drive.

The operation has completed successfully.


Reboot after this step.


6. a. Test 1 - Can you see your Bootcamp volume in Finder.

b. Test 2 - Can you files in the Bootcamp volume?

c. Test 3 - Can you see Bootcamp in your System Preferences -> Startup Disk.

d. Test 4 - If Test 1-3 are successful, select Bootcamp and click on Restart. You may need Windows startup repair, if you see a hanging underline cursor at the top left corner of your screen. In most cases, it is not required.

Nov 13, 2014 3:07 PM in response to Loner T

LunaSea:~ Sugizo$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 488281248 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

488690888 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

489960424 1048

489961472 486811641 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

976773113 22

976773135 32 Sec GPT table

976773167 1 Sec GPT header

LunaSea:~ Sugizo$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 488281248] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 488690888 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 489961472 - 486811641] HPFS/QNX/AUX

LunaSea:~ Sugizo$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null|hexdump -C

00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|

00000010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 38 34 1d |........?....84.|

00000020 00 00 00 00 80 00 80 00 f8 27 04 1d 00 00 00 00 |.........'......|

00000030 45 07 00 00 00 00 00 00 44 07 00 00 00 00 00 00 |E.......D.......|

00000040 f6 00 00 00 01 00 00 00 00 6d 7c 9d 73 1b cf 01 |.........m|.s...|

00000050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|

00000060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|

00000070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|

00000080 55 aa 75 06 f7 c1 01 00 75 03 e9 dd 00 1e 83 ec |U.u.....u.......|

00000090 18 68 1a 00 b4 48 8a 16 0e 00 8b f4 16 1f cd 13 |.h...H..........|

000000a0 9f 83 c4 18 9e 58 1f 72 e1 3b 06 0b 00 75 db a3 |.....X.r.;...u..|

000000b0 0f 00 c1 2e 0f 00 04 1e 5a 33 db b9 00 20 2b c8 |........Z3... +.|

000000c0 66 ff 06 11 00 03 16 0f 00 8e c2 ff 06 16 00 e8 |f...............|

000000d0 4b 00 2b c8 77 ef 0e 68 30 10 cb 66 23 c0 75 2d |K.+.w..h0..f#.u-|

000000e0 66 81 fb 54 43 50 41 75 24 81 f9 02 01 72 1e 16 |f..TCPAu$....r..|

000000f0 68 07 bb 16 68 70 0e 16 68 09 00 66 53 66 53 66 |h...hp..h..fSfSf|

00000100 55 16 16 16 68 b8 01 66 61 0e 07 cd 1a 33 c0 bf |U...h..fa....3..|

00000110 28 10 b9 d8 0f fc f3 aa e9 5f 01 90 90 66 60 1e |(........_...f`.|

00000120 06 66 a1 11 00 66 03 06 1c 00 1e 66 68 00 00 00 |.f...f.....fh...|

00000130 00 66 50 06 53 68 01 00 68 10 00 b4 42 8a 16 0e |.fP.Sh..h...B...|

00000140 00 16 1f 8b f4 cd 13 66 59 5b 5a 66 59 66 59 1f |.......fY[ZfYfY.|

00000150 0f 82 16 00 66 ff 06 11 00 03 16 0f 00 8e c2 ff |....f...........|

00000160 0e 16 00 75 bc 07 1f 66 61 c3 a0 f8 01 e8 09 00 |...u...fa.......|

00000170 a0 fb 01 e8 03 00 f4 eb fd b4 01 8b f0 ac 3c 00 |..............<.|

00000180 74 09 b4 0e bb 07 00 cd 10 eb f2 c3 0d 0a 41 20 |t.............A |

00000190 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 |disk read error |

000001a0 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d |occurred...BOOTM|

000001b0 47 52 20 69 73 20 6d 69 73 73 69 6e 67 00 0d 0a |GR is missing...|

000001c0 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 |BOOTMGR is compr|

000001d0 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 |essed...Press Ct|

000001e0 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 |rl+Alt+Del to re|

000001f0 73 74 61 72 74 0d 0a 00 8c a9 be d6 00 00 55 aa |start.........U.|

00000200

Boot camp missing when update to Yosemite

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.