Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

7 points

Bootcamp unrecognized after restoring Windows from system image

A had a major failure (not sure exactly what happened) that resulted in me not being able to boot into OS X Yosemite, but my Bootcamp partition worked fine. After a long process, complicated by other issues, I had to wipe the drive reinstall Yosemite, restore from my Time Machine backup, and reinstall Windows via Bootcamp.

The final step in the process was to restore my Windows partition from a system image. The system image was made with Window's built-in utility, and was restored via a Windows repair disc created with a built-in utility. No 3rd party software used, and no 3rd party NTFS software on my Mac.

I have now restored, and the Bootcamp partition itself works fine. However, Mac OS doesn't recognize it. It doesn't appear in my sidebar. In Disk Utility it shows up greyed out (and I can't mount it) and it is named "disk0s4" instead of "BOOTCAMP". I also cannot select it as my startup disk in System Preferences. I CAN start up my computer holding the option key and select the drive.

[REDACTED] diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *500.1 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh SSD 399.2 GB disk0s2

3: Apple_Boot 650.0 MB disk0s3

4: Microsoft Basic Data 100.0 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: FDisk_partition_scheme *500.1 GB disk1

1: Windows_NTFS Windows Backup 500.1 GB disk1s1

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: Repair disc Windows... *173.4 MB disk2

I think I might know what the problem is. When restoring Windows from the system image I was forced to reformat and repartition my drive as part of the process, but I couldn't chose what format I wanted (it claims it formatted and partitioned my drive, but OS X was unaffected). After the restore, my Windows partition is FAT (I'm pretty sure it was NTFS before). My system image is NTFS, so I'm not sure why this happened.

Has anyone run into this before? Does anyone know how I can restore Windows from a system image and have it format my drive as NTFS? Or is there another way to solve this problem? It has been a long week without a functioning computer, and I am 95% of the way back to where I started. Any help is greatly appreciated!

MacBook Pro, OS X Yosemite (10.10)

Posted on Nov 14, 2014 5:24 PM

Best reply

Loner T

Level 9

59,471 points

Posted on Nov 14, 2014 6:15 PM

Can you post the output of

diskutil cs list

sudo fdisk /dev/disk0

sudo gpt -vv -r show /dev/disk0

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

These commands show CoreStorage volumes, the MBR, GPT and show the NTFS header on the partition. You will prompted for your password.

As you can see /dev/disk1 shows the NTFS drive.

View in context

65 replies

Loner T

Level 9

59,471 points

Nov 17, 2014 3:45 PM in response to sleeknub

The numbers here refer to the old BIOS style disks with C(cylinder)/H(eads)/S(ectors) or CHS numbers. The numbers are not very useful on modern disks, but MBRs are still written that way.

Your second partition became type '07', which should have stayed HFS. The sectors have changed between the restores, which means you NTFS header is in a different location. The Windows restore could also have overwritten your GPT.

1. Can you post the output of diskutil list?

2. Please download GPT Fdisk from SourceForge and check if it will get past the error. It is tolerant of many errors, that the gpt command is not.

sleeknub Author

Level 1

7 points

Nov 17, 2014 3:56 PM in response to Loner T

Quick reply to the first question, the second part I will have to do later.

Something odd and frightening just happened. Previously I was redacting my computer and user name, which have now changed. Before it was "Main:~ Ben$" which is what it should be....look at what it is now. I checked my computer name in the sidebar of a Finder window, which should be "Main", but now it is "Main (2)". A bit unsettling...

D-173-250-161-75:~ Ben$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *500.1 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh SSD 379.2 GB disk0s2

3: Apple_Boot 650.0 MB disk0s3

4: Microsoft Basic Data 120.0 GB disk0s4

D-173-250-161-75:~ Ben$

Loner T

Level 9

59,471 points

Nov 17, 2014 4:10 PM in response to sleeknub

Your IP address is also showing. You can change it back in sharing. 😉

Did you switch between a wired and a wireless connection or connect via both?

If there is a conflict in the MAC-to-IP tables on your DHCP server, you may end up with a new name.

sleeknub Author

Level 1

7 points

Nov 17, 2014 4:27 PM in response to Loner T

That's odd I didn't change anything... I only use wireless connections with this computer. I was having connectivity issues, and was signed in at a university, so maybe that accounts for the problem.

I also want to share this screenshot. I'm pretty sure the red text didn't show up under AHCI Mode or SATA Interface before I started having problems. I never paid much attention to these areas in the past, so I can't tell you what they said, but I'm pretty sure the text was blue before.

I really appreciate your help on this. I'll download GPT Fdisk once I get home in a few hours.

Loner T

Level 9

59,471 points

Nov 17, 2014 5:03 PM in response to sleeknub

On my Mac. This is a side-effect of the restore and the drivers not being loaded. Do you have a similar screen shot before the restore?

sleeknub Author

Level 1

7 points

Nov 17, 2014 9:59 PM in response to Loner T

Huh, I would have thought the SSD drivers (firmware?) were stored on a separate chip in the disk...I guess not?

Is this what you were looking for? Or do you want the output from the 'i' command?

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

sleeknub Author

Level 1

7 points

Nov 17, 2014 10:00 PM in response to sleeknub

Command (? for help): v

Warning! Mismatched GPT and MBR partition! MBR partition 2, of type 0x07,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Warning! Mismatched GPT and MBR partition! MBR partition 3, of type 0xAB,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Warning! Mismatched GPT and MBR partition! MBR partition 4, of type 0x07,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Identified 3 problems!

Command (? for help):

Loner T

Level 9

59,471 points

Nov 18, 2014 3:09 AM in response to sleeknub

There is an option to recreate the GPT assuming the MBR is correct. Please see http://www.rodsbooks.com/gdisk/ for details. It also has an excellent explanation of hybrid MBRs.

sleeknub Author

Level 1

7 points

Nov 18, 2014 3:29 AM in response to Loner T

Do I really want to recreate the GPT assuming the MBR is correct? The way I see it everything was fine until the restored Windows from the system image, so I should be trying to go back to that state (while keeping the restored data, etc, if that makes sense). Wouldn't assuming the MBR is correct be using the corrupted partitions created by the Windows restore process, rather than the pristine ones in existence after I restored Mac OS and created a Boot Camp partition?

Loner T

Level 9

59,471 points

Nov 18, 2014 3:42 AM in response to sleeknub

Do you have a backup of your GPT when this was generated? This is the state prior to restore, but restore seems to have made irreversible changes to your GPT.

sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 740718944 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

741128584 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

742398120 1880

742400000 234373120 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

976773120 15

976773135 32 Sec GPT table

976773167 1 Sec GPT header

sleeknub Author

Level 1

7 points

Nov 18, 2014 8:40 PM in response to Loner T

I don't have a backup of the GPT, but I can always wipe the drive, restore from Time Machine, recreate a Boot Camp drive, and then backup the GPT. I'm guessing I would then restore my Windows partition then restore the GPT backup, but I'm in way over my head here. Do you know if this would work?

Loner T

Level 9

59,471 points

Nov 19, 2014 5:33 AM in response to sleeknub

Since you did post the GPT prior to your restore, I would not recommend the TM exercise to get the old GPT back. It can be reconstructed from the information you already have.

Can you post the output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C, which will show the NTFS header as it is now?

sleeknub Author

Level 1

7 points

Nov 19, 2014 10:15 AM in response to Loner T

Main:~ Ben$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 e7 0c 05 00 fe 7f 02 00 3c 18 00 00 70 0a 05 00 |........<...p...|

00000010 8b 23 04 00 3c 18 00 00 b7 09 05 00 61 02 03 00 |.#..<.......a...|

00000020 8c 18 00 00 e7 0c 05 00 fe 7f 02 00 8c 18 00 00 |................|

00000030 70 0a 05 00 8b 23 04 00 8c 18 00 00 b7 09 05 00 |p....#..........|

00000040 61 02 03 00 94 18 00 00 74 0d 05 00 2f 24 04 00 |a.......t.../$..|

00000050 94 18 00 00 78 7f 02 00 11 86 02 00 94 18 00 00 |....x...........|

00000060 18 8b 02 00 89 84 02 00 94 18 00 00 d0 16 05 00 |................|

00000070 c0 7f 02 00 94 18 00 00 9b 16 05 00 b1 82 02 00 |................|

00000080 ac 04 00 00 42 0b 05 00 44 82 02 00 94 18 00 00 |....B...D.......|

00000090 37 17 05 00 8d 83 02 00 94 18 00 00 fc 16 05 00 |7...............|

000000a0 2a 2a 04 00 94 18 00 00 c4 16 05 00 39 2f 00 00 |**..........9/..|

000000b0 94 18 00 00 68 16 05 00 b1 82 02 00 94 18 00 00 |....h...........|

000000c0 08 17 05 00 50 82 02 00 94 18 00 00 f0 16 05 00 |....P...........|

000000d0 49 86 02 00 ac 04 00 00 8e 0b 05 00 50 82 02 00 |I...........P...|

000000e0 94 18 00 00 a4 17 05 00 a9 81 02 00 94 18 00 00 |................|

000000f0 23 17 05 00 32 d4 02 00 94 18 00 00 85 16 05 00 |#...2...........|

00000100 b1 82 02 00 94 18 00 00 e2 16 05 00 44 82 02 00 |............D...|

00000110 94 18 00 00 5e 17 05 00 ff 82 02 00 94 18 00 00 |....^...........|

00000120 1f 12 05 00 ff 82 02 00 94 18 00 00 7b 17 05 00 |............{...|

00000130 ff 82 02 00 04 05 00 00 85 4a 01 00 16 2a 04 00 |.........J...*..|

00000140 04 05 00 00 80 7f 02 00 99 83 02 00 04 05 00 00 |................|

00000150 d0 16 05 00 c0 7f 02 00 04 05 00 00 44 8b 02 00 |............D...|

00000160 a9 81 02 00 0c 05 00 00 85 4a 01 00 16 2a 04 00 |.........J...*..|

00000170 0c 05 00 00 44 8b 02 00 a9 81 02 00 0c 05 00 00 |....D...........|

00000180 80 7f 02 00 99 83 02 00 9c 18 00 00 24 18 05 00 |............$...|

00000190 f3 7f 02 00 9c 18 00 00 48 18 05 00 39 2f 00 00 |........H...9/..|

000001a0 9c 18 00 00 5b 18 05 00 f3 7f 02 00 9c 18 00 00 |....[...........|

000001b0 6d 18 05 00 d4 0c 00 00 9c 18 00 00 80 18 05 00 |m...............|

000001c0 d4 0c 00 00 9c 18 00 00 8e 18 05 00 d4 0c 00 00 |................|

000001d0 9c 18 00 00 4c b6 02 00 b1 92 02 00 9c 18 00 00 |....L...........|

000001e0 e3 13 05 00 39 2f 00 00 9c 18 00 00 eb 13 05 00 |....9/..........|

000001f0 e8 28 04 00 9c 18 00 00 f0 a2 02 00 64 2a 04 00 |.(..........d*..|

00000200

Main:~ Ben$

Loner T

Level 9

59,471 points

Nov 19, 2014 10:45 AM in response to sleeknub

After the restore, there is no NTFS header. Do you want to use Testdisk and see where it is? The way it is right now, it will not boot. Your MBR before an dater restore also has an impact on this.

sleeknub Author

Level 1

7 points

Nov 19, 2014 12:20 PM in response to Loner T

Is this what you are talking about: http://www.cgsecurity.org/wiki/TestDisk?

What I think I want to do is restore from TM, repartition/install with BC, restore from system image, then immediately correct whatever problem was caused by the Windows restore (this is the step I don't know how to do, although perhaps restoring from the system image in a different way might also solve my problem). My fear is that as I have used my computer in its current state I have been corrupting my data on at least one of the two partitions, since they don't recognize each other properly. One possible sign of this is that for some reason I can no longer open Chrome in Mac OS. My guess is that the definitions of the partitions in Windows and Mac OS are different, so when I am using Windows it might be writing over parts of the drive that Mac OS thinks belong to it...

Bootcamp unrecognized after restoring Windows from system image