Bootcamp unrecognized after restoring Windows from system image

Question

Level 1

7 points

Bootcamp unrecognized after restoring Windows from system image

A had a major failure (not sure exactly what happened) that resulted in me not being able to boot into OS X Yosemite, but my Bootcamp partition worked fine. After a long process, complicated by other issues, I had to wipe the drive reinstall Yosemite, restore from my Time Machine backup, and reinstall Windows via Bootcamp.

The final step in the process was to restore my Windows partition from a system image. The system image was made with Window's built-in utility, and was restored via a Windows repair disc created with a built-in utility. No 3rd party software used, and no 3rd party NTFS software on my Mac.

I have now restored, and the Bootcamp partition itself works fine. However, Mac OS doesn't recognize it. It doesn't appear in my sidebar. In Disk Utility it shows up greyed out (and I can't mount it) and it is named "disk0s4" instead of "BOOTCAMP". I also cannot select it as my startup disk in System Preferences. I CAN start up my computer holding the option key and select the drive.

[REDACTED] diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *500.1 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh SSD 399.2 GB disk0s2

3: Apple_Boot 650.0 MB disk0s3

4: Microsoft Basic Data 100.0 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: FDisk_partition_scheme *500.1 GB disk1

1: Windows_NTFS Windows Backup 500.1 GB disk1s1

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: Repair disc Windows... *173.4 MB disk2

I think I might know what the problem is. When restoring Windows from the system image I was forced to reformat and repartition my drive as part of the process, but I couldn't chose what format I wanted (it claims it formatted and partitioned my drive, but OS X was unaffected). After the restore, my Windows partition is FAT (I'm pretty sure it was NTFS before). My system image is NTFS, so I'm not sure why this happened.

Has anyone run into this before? Does anyone know how I can restore Windows from a system image and have it format my drive as NTFS? Or is there another way to solve this problem? It has been a long week without a functioning computer, and I am 95% of the way back to where I started. Any help is greatly appreciated!

MacBook Pro, OS X Yosemite (10.10)

Posted on Nov 14, 2014 5:24 PM

Reply

Answer 1

Best reply

Loner T

Level 9

59,471 points

Nov 14, 2014 6:15 PM in response to sleeknub

Can you post the output of

diskutil cs list

sudo fdisk /dev/disk0

sudo gpt -vv -r show /dev/disk0

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

These commands show CoreStorage volumes, the MBR, GPT and show the NTFS header on the partition. You will prompted for your password.

As you can see /dev/disk1 shows the NTFS drive.

Reply

Answer 2

sleeknub Author

Level 1

7 points

Nov 14, 2014 11:43 PM in response to Loner T

So I screwed up and had to redo the process. Right now I don't have a bootcamp partition, just Mac OS 10.10, but I'll give you the output anyway. I'll continue with the process to get back to where I was and give the information again (which will take a few hours), unless you know how I can fix the problem from this point.

[REDACTED] diskutil cs list

No CoreStorage logical volume groups found

[REDACTED] sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 976773167] <Unknown ID>

2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

[REDACTED] sudo gpt -vv -r show dev/disk0

gpt show: unable to open device 'dev/disk0': No such file or directory

[REDACTED] sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -c

[REDACTED]

Reply

Answer 3

Loner T

Level 9

59,471 points

Nov 15, 2014 6:53 AM in response to sleeknub

This one should be

[REDACTED] sudo gpt -vv -r show /dev/disk0

Without seeing the GPT, if you are in the middle of a restore, it would not help much. Let us wait till you finish the restore.

Reply

Answer 4

sleeknub Author

Level 1

7 points

Nov 15, 2014 10:58 AM in response to Loner T

Ok, now everything is as it should be: Mac OS 10.10 working fine, Boot Camp partition with Windows installed working as it should. All that remains is restoring Windows from a system image (Windows is installed, but it is a clean install). Last time I restored from a system image (which itself is NTFS), it reformatted my Boot Camp partition to FAT, which I think caused my problem.

I am hesitant to restore from the system image, because it didn't work properly last time. Do you know how I might be able to restore it without it reformatting my partition? Thanks for your help.

[REDACTED] diskutil cs list

No CoreStorage logical volume groups found

[REDACTED] sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 740718944] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 741128584 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 742400000 - 234373120] HPFS/QNX/AUX

[REDACTED] sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 740718944 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

741128584 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

742398120 1880

742400000 234373120 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

976773120 15

976773135 32 Sec GPT table

976773167 1 Sec GPT header

[REDACTED] sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|

00000010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 20 40 2c |........?.... @,|

00000020 00 00 00 00 80 00 80 00 ff 3f f8 0d 00 00 00 00 |.........?......|

00000030 00 00 0c 00 00 00 00 00 02 00 00 00 00 00 00 00 |................|

00000040 f6 00 00 00 01 00 00 00 55 28 d3 98 57 d3 98 22 |........U(..W.."|

00000050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|

00000060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|

00000070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|

00000080 55 aa 75 06 f7 c1 01 00 75 03 e9 dd 00 1e 83 ec |U.u.....u.......|

00000090 18 68 1a 00 b4 48 8a 16 0e 00 8b f4 16 1f cd 13 |.h...H..........|

000000a0 9f 83 c4 18 9e 58 1f 72 e1 3b 06 0b 00 75 db a3 |.....X.r.;...u..|

000000b0 0f 00 c1 2e 0f 00 04 1e 5a 33 db b9 00 20 2b c8 |........Z3... +.|

000000c0 66 ff 06 11 00 03 16 0f 00 8e c2 ff 06 16 00 e8 |f...............|

000000d0 4b 00 2b c8 77 ef b8 00 bb cd 1a 66 23 c0 75 2d |K.+.w......f#.u-|

000000e0 66 81 fb 54 43 50 41 75 24 81 f9 02 01 72 1e 16 |f..TCPAu$....r..|

000000f0 68 07 bb 16 68 70 0e 16 68 09 00 66 53 66 53 66 |h...hp..h..fSfSf|

00000100 55 16 16 16 68 b8 01 66 61 0e 07 cd 1a 33 c0 bf |U...h..fa....3..|

00000110 28 10 b9 d8 0f fc f3 aa e9 5f 01 90 90 66 60 1e |(........_...f`.|

00000120 06 66 a1 11 00 66 03 06 1c 00 1e 66 68 00 00 00 |.f...f.....fh...|

00000130 00 66 50 06 53 68 01 00 68 10 00 b4 42 8a 16 0e |.fP.Sh..h...B...|

00000140 00 16 1f 8b f4 cd 13 66 59 5b 5a 66 59 66 59 1f |.......fY[ZfYfY.|

00000150 0f 82 16 00 66 ff 06 11 00 03 16 0f 00 8e c2 ff |....f...........|

00000160 0e 16 00 75 bc 07 1f 66 61 c3 a0 f8 01 e8 09 00 |...u...fa.......|

00000170 a0 fb 01 e8 03 00 f4 eb fd b4 01 8b f0 ac 3c 00 |..............<.|

00000180 74 09 b4 0e bb 07 00 cd 10 eb f2 c3 0d 0a 41 20 |t.............A |

00000190 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 |disk read error |

000001a0 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d |occurred...BOOTM|

000001b0 47 52 20 69 73 20 6d 69 73 73 69 6e 67 00 0d 0a |GR is missing...|

000001c0 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 |BOOTMGR is compr|

000001d0 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 |essed...Press Ct|

000001e0 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 |rl+Alt+Del to re|

000001f0 73 74 61 72 74 0d 0a 00 8c a9 be d6 00 00 55 aa |start.........U.|

00000200

[REDACTED]

Reply

Answer 5

Loner T

Level 9

59,471 points

Nov 15, 2014 11:22 AM in response to sleeknub

1. Are you restoring the Volume from OS X side?

2. If you switch to your clean Windows installation, and run a Restore what happens? Is there a difference in the size of volumes in the System Image and current Bootcamp volume? There should be no changes required in your MBR when you restore.

http://windows.microsoft.com/en-us/windows/restore-computer-from-system-image-ba ckup#1TC=windows-7

Reply

Answer 6

sleeknub Author

Level 1

7 points

Nov 15, 2014 8:21 PM in response to Loner T

Thanks again for your help.

1. I am backing up/restoring using Windows' built-in software. Basically I am booting from a Windows repair disc (DVD), and using that to restore my Windows partition from a system image (which was created using Windows 7's built-in backup software). If there is another way to restore the drive using my system image I'm more than happy to give it a try.

2. Both times I tried to restore from within Windows I was told I had to boot from a repair or installation disc (probably because I was restoring the boot disk), which I did as I mentioned above. When I did this (only actually did it once onto a Boot Camp partition), I was told that Windows would reformat and partition the drive (assuming it meant the physical drive), but the process didn't remove my OS X partition, which worked fine after the process was complete. The only problem is that the Boot Camp partition was now formatted in FAT instead of NTFS, and Mac OS didn't recognize it (couldn't select in as a startup disk couldn't see Boot Camp drive on desktop - or anywhere for that matter). Disk Utility did show a greyed out partition named disk0s4, but couldn't mount it.

My current partition is as big, or bigger, than the partition I made a system image of. The system image file itself is smaller than the partition, but I think it is about the size of the amount of data I had on the partition.

Reply

Answer 7

Loner T

Level 9

59,471 points

Nov 15, 2014 8:38 PM in response to sleeknub

Can you post your current GPT, before you start a restore? On the Macs, I personally prefer to use Winclone, but PCs seem to handle Windows System Images better, and there is no GPT v MBR involved.

There is supposed to be a chkdsk run automatically when you are try to bring it up the first time after a restore. You may want to post the MBR before and after the restore for comparison.

Reply

Answer 8

sleeknub Author

Level 1

7 points

Nov 16, 2014 2:04 PM in response to Loner T

Could you be more specific on which commands I should use? Are you talking about this command?

sudo gpt -vv -r show /dev/disk0

Thanks.

Reply

Answer 9

Loner T

Level 9

59,471 points

Nov 16, 2014 4:29 PM in response to sleeknub

Yes, that command will show us the GPT.

Reply

Answer 10

sleeknub Author

Level 1

7 points

Nov 16, 2014 4:41 PM in response to Loner T

And what about the MBR? I don't believe I have a MBR, and I don't think I will... I think I should have a GPT with three partitions, Mac OS (HFS+), Windows (NTFS), and the Mac Recovery Partition (HFS+?).

Here's the GPT before:

[REDACTED] sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 740718944 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

741128584 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

742398120 1880

742400000 234373120 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

976773120 15

976773135 32 Sec GPT table

976773167 1 Sec GPT header

[REDACTED]

Reply

Answer 11

Loner T

Level 9

59,471 points

Nov 16, 2014 6:03 PM in response to sleeknub

You currently have GTP1-EFI, GPT2-OSX(HFS+), GPT3 - Apple Boot (Recovery HD), GPT4 - Microsoft Basic Data.

Since you have a clean install of Windows, there should also be an equivalent MBR, so Fdisk should also provide a matching MBR. The intent is to record both before a restore, to and ensure it does not get corrupted after the restore.

Reply

Answer 12

sleeknub Author

Level 1

7 points

Nov 16, 2014 8:30 PM in response to Loner T

Ok, here's the output of the fdisk command:

[REDACTED] sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 740718944] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 741128584 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 742400000 - 234373120] HPFS/QNX/AUX

[REDACTED]

Reply

Answer 13

sleeknub Author

Level 1

7 points

Nov 16, 2014 9:20 PM in response to sleeknub

Ok, now back in the same situation as before. Windows has been restored and appears to be working fine (I didn't test it much, though), and can I choose to boot to the Windows partition if I hold option at startup. In Windows I can use the Boot Camp utility to select either the Mac OS X or Windows partition, and Windows appears to show its partition as NTFS. On the Mac side, the Boot Camp partition does not show up as a startup disk in System Preferences. The drive does not appear in the Finder, and it shows up in Disk Utility greyed out, unmountable, and named disk0s4. Mac OS apparently sees the drive as a FAT partition.

Both commands below produce different results.

[REDACTED] sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: error: bogus map

gpt show: unable to open device '/dev/disk0': Undefined error: 0

[REDACTED] sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: 07 25 127 15 - 1023 254 63 [ 409640 - 739227824] HPFS/QNX/AUX

3: AB 1023 254 63 - 1023 254 63 [ 739637464 - 1269544] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 740907008 - 235866112] HPFS/QNX/AUX

[REDACTED]

Reply

Answer 14

Loner T

Level 9

59,471 points

Nov 17, 2014 4:22 AM in response to sleeknub

Before Restore...

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 740718944] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 741128584 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 742400000 - 234373120] HPFS/QNX/AUX

After Restore...

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: 07 25 127 15 - 1023 254 63 [ 409640 - 739227824] HPFS/QNX/AUX

3: AB 1023 254 63 - 1023 254 63 [ 739637464 - 1269544] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 740907008 - 235866112] HPFS/QNX/AUX

Notice the highlighted entries.

Can you post the output of sudo gpt -vv -r show /dev/disk0 to show what the GPT has?

Reply

Answer 15

sleeknub Author

Level 1

7 points

Nov 17, 2014 3:35 PM in response to Loner T

Yeah, the output for the GPT is actually also in my above post. The first several lines of terminal output are for that command. You'll notice a line that says "got show: error: bogus map"

Also, the numbers following the "EE" in the line below from the MBR are different.

Before:

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

After:

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

Not sure what they mean though.

Reply