Bootcamp unrecognized after restoring Windows from system image

Okay, I finally got a chance to get back to this. Computer is back to the state just before restoring Windows from the system image (Boot Camp and clean install of Windows in place). If I understand what you are telling me correctly, I will be able to repair my GPT using the information below after restoring Windows from a system image (which seems to be damaging the GPT). Anything else I need before going through with it? It there any chance I would overwrite/corrupt any of the data on the OS X side by doing the Windows system image restore, or just the GPT header?

Main:~ Ben$ sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 738765824] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 739175464 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 740446208 - 236326912] HPFS/QNX/AUX

Main:~ Ben$ sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 738765824 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

739175464 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

740445000 1208

740446208 236326912 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

976773120 15

976773135 32 Sec GPT table

976773167 1 Sec GPT header

Main:~ Ben$ sudo dd if=/dev/rdisk0s4 count=1 2>null | hexdump -C

00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|

00000010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 50 22 2c |........?....P",|

00000020 00 00 00 00 80 00 80 00 ff 0f 16 0e 00 00 00 00 |................|

00000030 00 00 0c 00 00 00 00 00 02 00 00 00 00 00 00 00 |................|

00000040 f6 00 00 00 01 00 00 00 52 82 db 78 c3 db 78 34 |........R..x..x4|

00000050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|

00000060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|

00000070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|

00000080 55 aa 75 06 f7 c1 01 00 75 03 e9 dd 00 1e 83 ec |U.u.....u.......|

00000090 18 68 1a 00 b4 48 8a 16 0e 00 8b f4 16 1f cd 13 |.h...H..........|

000000a0 9f 83 c4 18 9e 58 1f 72 e1 3b 06 0b 00 75 db a3 |.....X.r.;...u..|

000000b0 0f 00 c1 2e 0f 00 04 1e 5a 33 db b9 00 20 2b c8 |........Z3... +.|

000000c0 66 ff 06 11 00 03 16 0f 00 8e c2 ff 06 16 00 e8 |f...............|

000000d0 4b 00 2b c8 77 ef b8 00 bb cd 1a 66 23 c0 75 2d |K.+.w......f#.u-|

000000e0 66 81 fb 54 43 50 41 75 24 81 f9 02 01 72 1e 16 |f..TCPAu$....r..|

000000f0 68 07 bb 16 68 70 0e 16 68 09 00 66 53 66 53 66 |h...hp..h..fSfSf|

00000100 55 16 16 16 68 b8 01 66 61 0e 07 cd 1a 33 c0 bf |U...h..fa....3..|

00000110 28 10 b9 d8 0f fc f3 aa e9 5f 01 90 90 66 60 1e |(........_...f`.|

00000120 06 66 a1 11 00 66 03 06 1c 00 1e 66 68 00 00 00 |.f...f.....fh...|

00000130 00 66 50 06 53 68 01 00 68 10 00 b4 42 8a 16 0e |.fP.Sh..h...B...|

00000140 00 16 1f 8b f4 cd 13 66 59 5b 5a 66 59 66 59 1f |.......fY[ZfYfY.|

00000150 0f 82 16 00 66 ff 06 11 00 03 16 0f 00 8e c2 ff |....f...........|

00000160 0e 16 00 75 bc 07 1f 66 61 c3 a0 f8 01 e8 09 00 |...u...fa.......|

00000170 a0 fb 01 e8 03 00 f4 eb fd b4 01 8b f0 ac 3c 00 |..............<.|

00000180 74 09 b4 0e bb 07 00 cd 10 eb f2 c3 0d 0a 41 20 |t.............A |

00000190 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 |disk read error |

000001a0 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d |occurred...BOOTM|

000001b0 47 52 20 69 73 20 6d 69 73 73 69 6e 67 00 0d 0a |GR is missing...|

000001c0 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 |BOOTMGR is compr|

000001d0 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 |essed...Press Ct|

000001e0 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 |rl+Alt+Del to re|

000001f0 73 74 61 72 74 0d 0a 00 8c a9 be d6 00 00 55 aa |start.........U.|

00000200

Main:~ Ben$

When I have tried to restore while booted into Windows I'm told I need to boot from a repair or install disk, so I'll do that (unless you have something else in mind).

Windows system image restored. Here's the result of those commands:

Main:~ Ben$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: 07 25 127 15 - 1023 254 63 [ 409640 - 739227824] HPFS/QNX/AUX

3: AB 1023 254 63 - 1023 254 63 [ 739637464 - 1269544] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 740907008 - 235866112] HPFS/QNX/AUX

Main:~ Ben$ sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: error: bogus map

gpt show: unable to open device '/dev/disk0': Undefined error: 0

Main:~ Ben$ sudo dd if=/dev/rdisk0s4 count=1 2>null | hexdump -C

00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|

00000010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 50 22 2c |........?....P",|

00000020 00 00 00 00 80 00 80 00 ff 0f 16 0e 00 00 00 00 |................|

00000030 00 00 0c 00 00 00 00 00 02 00 00 00 00 00 00 00 |................|

00000040 f6 00 00 00 01 00 00 00 52 82 db 78 c3 db 78 34 |........R..x..x4|

00000050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|

00000060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|

00000070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|

00000080 55 aa 75 06 f7 c1 01 00 75 03 e9 dd 00 1e 83 ec |U.u.....u.......|

00000090 18 68 1a 00 b4 48 8a 16 0e 00 8b f4 16 1f cd 13 |.h...H..........|

000000a0 9f 83 c4 18 9e 58 1f 72 e1 3b 06 0b 00 75 db a3 |.....X.r.;...u..|

000000b0 0f 00 c1 2e 0f 00 04 1e 5a 33 db b9 00 20 2b c8 |........Z3... +.|

000000c0 66 ff 06 11 00 03 16 0f 00 8e c2 ff 06 16 00 e8 |f...............|

000000d0 4b 00 2b c8 77 ef b8 00 bb cd 1a 66 23 c0 75 2d |K.+.w......f#.u-|

000000e0 66 81 fb 54 43 50 41 75 24 81 f9 02 01 72 1e 16 |f..TCPAu$....r..|

000000f0 68 07 bb 16 68 70 0e 16 68 09 00 66 53 66 53 66 |h...hp..h..fSfSf|

00000100 55 16 16 16 68 b8 01 66 61 0e 07 cd 1a 33 c0 bf |U...h..fa....3..|

00000110 28 10 b9 d8 0f fc f3 aa e9 5f 01 90 90 66 60 1e |(........_...f`.|

00000120 06 66 a1 11 00 66 03 06 1c 00 1e 66 68 00 00 00 |.f...f.....fh...|

00000130 00 66 50 06 53 68 01 00 68 10 00 b4 42 8a 16 0e |.fP.Sh..h...B...|

00000140 00 16 1f 8b f4 cd 13 66 59 5b 5a 66 59 66 59 1f |.......fY[ZfYfY.|

00000150 0f 82 16 00 66 ff 06 11 00 03 16 0f 00 8e c2 ff |....f...........|

00000160 0e 16 00 75 bc 07 1f 66 61 c3 a0 f8 01 e8 09 00 |...u...fa.......|

00000170 a0 fb 01 e8 03 00 f4 eb fd b4 01 8b f0 ac 3c 00 |..............<.|

00000180 74 09 b4 0e bb 07 00 cd 10 eb f2 c3 0d 0a 41 20 |t.............A |

00000190 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 |disk read error |

000001a0 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d |occurred...BOOTM|

000001b0 47 52 20 69 73 20 6d 69 73 73 69 6e 67 00 0d 0a |GR is missing...|

000001c0 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 |BOOTMGR is compr|

000001d0 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 |essed...Press Ct|

000001e0 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 |rl+Alt+Del to re|

000001f0 73 74 61 72 74 0d 0a 00 8c a9 be d6 00 00 55 aa |start.........U.|

00000200

Main:~ Ben$

And some gdisk output:

Main:~ Ben$ sudo gdisk /dev/disk0

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): ?

b back up GPT data to a file

c change a partition's name

d delete a partition

i show detailed information on a partition

l list known partition types

n add a new partition

o create a new empty GUID partition table (GPT)

p print the partition table

q quit without saving changes

r recovery and transformation options (experts only)

s sort partitions

t change a partition's type code

v verify disk

w write table to disk and exit

x extra functionality (experts only)

? print this menu

Command (? for help): v

Warning! Mismatched GPT and MBR partition! MBR partition 2, of type 0x07,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Warning! Mismatched GPT and MBR partition! MBR partition 3, of type 0xAB,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Warning! Mismatched GPT and MBR partition! MBR partition 4, of type 0x07,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Identified 3 problems!

Command (? for help): p

Disk /dev/disk0: 976773168 sectors, 465.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 16FAE83A-FAAD-430A-9D2F-02CA074B06DD

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 976773134

Partitions will be aligned on 8-sector boundaries

Total free space is 1229 sectors (614.5 KiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 739175463 352.3 GiB AF00 Macintosh SSD

3 739175464 740444999 619.9 MiB AB00 Recovery HD

4 740446208 976773119 112.7 GiB 0700 BOOTCAMP

Command (? for help): i

Partition number (1-4): 1

Partition GUID code: C12A7328-F81F-11D2-BA4B-00A0C93EC93B (EFI System)

Partition unique GUID: DAB649BD-6A6B-4D36-9436-53EF18539C5D

First sector: 40 (at 20.0 KiB)

Last sector: 409639 (at 200.0 MiB)

Partition size: 409600 sectors (200.0 MiB)

Attribute flags: 0000000000000000

Partition name: 'EFI System Partition'

Command (? for help): i

Partition number (1-4): 2

Partition GUID code: 48465300-0000-11AA-AA11-00306543ECAC (Apple HFS/HFS+)

Partition unique GUID: A2A5784E-D010-46DA-B9CF-6970E5F90FAC

First sector: 409640 (at 200.0 MiB)

Last sector: 739175463 (at 352.5 GiB)

Partition size: 738765824 sectors (352.3 GiB)

Attribute flags: 0000000000000000

Partition name: 'Macintosh SSD'

Command (? for help): i

Partition number (1-4): 3

Partition GUID code: 426F6F74-0000-11AA-AA11-00306543ECAC (Apple boot)

Partition unique GUID: 039B202A-3BBB-4BBB-9B8D-B8A3BFE80FF7

First sector: 739175464 (at 352.5 GiB)

Last sector: 740444999 (at 353.1 GiB)

Partition size: 1269536 sectors (619.9 MiB)

Attribute flags: 0000000000000000

Partition name: 'Recovery HD'

Command (? for help): i

Partition number (1-4): 4

Partition GUID code: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (Microsoft basic data)

Partition unique GUID: D6415257-3B02-4F03-A453-7FC9EA10F64A

First sector: 740446208 (at 353.1 GiB)

Last sector: 976773119 (at 465.8 GiB)

Partition size: 236326912 sectors (112.7 GiB)

Attribute flags: 0000000000000000

Partition name: 'BOOTCAMP'

Command (? for help): q

Main:~ Ben$

Why recreate the GPT based on the MBR, rather than the other way around? It looks like the GPT hasn't changed from before to after based on the start sectors. I just don't like the idea of having boot camp reach out and impact the Mac side of my computer rather than stay in the box the Mac created for it (the Boot Camp partition). I'm happy to give it a try given that I have good backups, but os there a compelling reason to do it the way you suggest rather than the other way around? Thanks.

Just tested out Windows. The situation is exactly as before, Windows seems to be working fine other than not being recognized from the Mac side (and the issues shown in the Samsung Magician screenshot I posted before).

I still don't understand why we can't use the GPT to rebuilt the MBR, instead of doing it the other way around, or the hierarchy between the two partition types (if there is one), but I'll give those commands a try tomorrow and let you know how it goes. I'm very concerned about losing data on the Mac side and potentially not realizing it until months from now...

Thanks for sticking this out.

I can't see the Bootcamp volume or files. I'll give the method you suggested initially a try and see what happens. I can always restore.

Here's what I did and the result. Restarting now to see if it worked.

Main:~ Ben$ sudo fdisk -e /dev/disk0

Password:

fdisk: could not open MBR file /usr/standalone/i386/boot0: No such file or directory

Enter 'help' for information

fdisk: 1> setpid 2

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

2: 07 25 127 15 - 1023 254 63 [ 409640 - 739227824] HPFS/QNX/AUX

Partition id ('0' to disable) [0 - FF]: [7] (? for help) AF

fdisk:*1> p

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Offset: 0 Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 739227824] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 739637464 - 1269544] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 740907008 - 235866112] HPFS/QNX/AUX

fdisk:*1> w

Device could not be accessed exclusively.

A reboot will be needed for changes to take effect. OK? [n] y

Writing MBR at offset 0.

fdisk: 1> sudo gdisk /dev/disk0

Invalid command 'sudo'. Try 'help'.

fdisk: 1> q

Main:~ Ben$ sudo gdisk /dev/disk0

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): d

Partition number (1-4): 2

Command (? for help): d

Partition number (1-4): 3

Command (? for help): d

Partition number (1-4): 4

Command (? for help): n

Partition number (2-128, default 2): 2

First sector (34-976773134, default = 409640) or {+-}size{KMGTP}: 409640

Last sector (409640-976773134, default = 976773134) or {+-}size{KMGTP}: +739227824

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): AF00

Changed type of partition to 'Apple HFS/HFS+'

Command (? for help): n

Partition number (3-128, default 3): 3

First sector (34-976773134, default = 739637464) or {+-}size{KMGTP}: 739637464

Last sector (739637464-976773134, default = 976773134) or {+-}size{KMGTP}: +1269544

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): AB00

Changed type of partition to 'Apple boot'

Command (? for help): n

Partition number (4-128, default 4): 4

First sector (34-976773134, default = 740907008) or {+-}size{KMGTP}: 740907008

Last sector (740907008-976773134, default = 976773134) or {+-}size{KMGTP}: +235866112

Current type is 'Apple HFS/HFS+'

Hex code or GUID (L to show codes, Enter = AF00): 0700

Changed type of partition to 'Microsoft basic data'

Command (? for help): p

Disk /dev/disk0: 976773168 sectors, 465.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 16FAE83A-FAAD-430A-9D2F-02CA074B06DD

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 976773134

Partitions will be aligned on 8-sector boundaries

Total free space is 21 sectors (10.5 KiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 739637463 352.5 GiB AF00 Apple HFS/HFS+

3 739637464 740907007 619.9 MiB AB00 Apple boot

4 740907008 976773119 112.5 GiB 0700 Microsoft basic data

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

PARTITIONS!!

Do you want to proceed? (Y/N): y

OK; writing new GUID partition table (GPT) to /dev/disk0.

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Warning: The kernel may continue to use old or deleted partitions.

You should reboot or remove the drive.

The operation has completed successfully.

Main:~ Ben$

Observations:

• Initial startup after changes was slow, but subsequent restarts seemed normal
• Bootcamp appears in Finder and as a startup disk
• Recovery Drive no longer appears as a startup option (in System Preferences or when starting up holding option)
• Disk Utility reports that my hard drive has an unrecognized file system, won't allow repair
• Mac partition required repair of header (which I did)
• Windows generally seems to work okay. I tried opening several Excel files, most of which took way longer to open (or didn't seem to open at all until I tried again).
• Same problem seem in Samsung Magician

I think I might have to restore the Windows System image from the Mac side (after reinstalling, restoring Mac OS, and formatting drive with Bootcamp). Any idea how I could do that? Or any other ideas? Maybe getting back to the same point I was a little while ago and rebuilding the MBR instead of the GPT (not sure why that would work).

Could this be a hardware failure?