Yosemite Ate My Boot Camp

Question

slanidracula Author

Level 1

0 points

Yosemite Ate My Boot Camp

I recently upgraded to Yosemite and lost my Boot Camp access... Here is the output to the big four terminals commands:

Jeremys-MBP:~ jeremy$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *240.1 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_CoreStorage 200.0 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 20.0 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS 240GB *199.6 GB disk1

Logical Volume on disk0s2

EA986F01-B88B-434D-8B32-5CC9475D3A98

Unencrypted

Jeremys-MBP:~ jeremy$ diskutil cs list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group A9048871-830E-4380-AFDA-CAF641DCAEA1

=========================================================

Name: 240GB

Status: Online

Size: 200000000000 B (200.0 GB)

Free Space: 18993152 B (19.0 MB)

|

+-< Physical Volume F3A5DCC9-B59E-4E98-9D35-B1AE0068DCF3

| ----------------------------------------------------

| Index: 0

| Disk: disk0s2

| Status: Online

| Size: 200000000000 B (200.0 GB)

|

+-> Logical Volume Family ED23ED4F-3037-433D-862C-A91C82E0AC8C

----------------------------------------------------------

Encryption Status: Unlocked

Encryption Type: None

Conversion Status: NoConversion

Conversion Direction: -none-

Has Encrypted Extents: No

Fully Secure: No

Passphrase Required: No

|

+-> Logical Volume EA986F01-B88B-434D-8B32-5CC9475D3A98

---------------------------------------------------

Disk: disk1

Status: Online

Size (Total): 199628685312 B (199.6 GB)

Conversion Progress: -none-

Revertible: Yes (no decryption required)

LV Name: 240GB

Volume Name: 240GB

Content Hint: Apple_HFS

Jeremys-MBP:~ jeremy$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=240057409536; sectorsize=512; blocks=468862128

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 468862127

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 390625000 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

391034640 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

392304176 37497296

429801472 39059456 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

468860928 1167

468862095 32 Sec GPT table

468862127 1 Sec GPT header

Jeremys-MBP:~ jeremy$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 29185/255/63 [468862128 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AC 1023 254 63 - 1023 254 63 [ 409640 - 390625000] <Unknown ID>

3: AB 1023 254 63 - 1023 254 63 [ 391034640 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 429801472 - 39059456] Win95 FAT32L

Thank you in advance.

Posted on Nov 20, 2014 9:35 AM

Reply

Answer 1

Loner T

Level 9

59,513 points

Nov 20, 2014 9:57 AM in response to slanidracula

You have been bit by the Yosemite bug. The gap between GPT#3 and GPT#4 is where your 'lost' NTFS header should be.

392304176 37497296

429801472 39059456 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

You will need Testdisk and GPT Fdisk. Please see Bootcamp partition has disappeared after upgrade to Yosemite 10.10 for reference.

If you need help with Testdisk or GPT Fdisk (gdisk), please post back.

Reply

Answer 2

slanidracula Author

Level 1

0 points

Nov 20, 2014 10:15 AM in response to Loner T

I ran TestDisk in QuickSearch first, and came up with these possible deep search options within MS Data... I am running a deeper search now...

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 240 GB / 223 GiB - 468862128 sectors (RO)

Partition Start End Size in sectors

>P EFI System 40 409639 409600 [EFI]

D Mac HFS 409640 390309415 389899776

D MS Data 315748360 392304640 76556281

D Mac HFS 391034640 392304175 1269536

D MS Data 392304640 468860920 76556281

D MS Data 392304647 468860927 76556281

D Mac HFS 467592552 468862087 1269536

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

FAT32, blocksize=512, 209 MB / 200 MiB

Reply

Answer 3

Loner T

Level 9

59,513 points

Nov 20, 2014 10:38 AM in response to slanidracula

The following two look interesting. Deeper Search should provide better information.

D MS Data 392304640 468860920 76556281

D MS Data 392304647 468860927 76556281

The second one is +7 bytes after the start of the first entry. This is my little cheat sheet to validate if you will lose Recovery HD or not. A negative 'Byte Offset' column indicates you will lose Recovery HD, which is not case for you.

GPT 3 Start	GPT 3 Size	GPT 3 End	NTFS Start	Byte Offset	NTFS Size	NTFS End
391034640	1269536	392304176	392304640	464	76556281	468860921

Reply

Answer 4

slanidracula Author

Level 1

0 points

Nov 20, 2014 12:01 PM in response to Loner T

I listed files on the first entry of interest and see this:

MS Data 392304640 468860920 76556281

Directory /

>dr-xr-xr-x 0 0 0 30-Oct-2014 06:44 .

dr-xr-xr-x 0 0 0 30-Oct-2014 06:44 ..

dr-xr-xr-x 0 0 0 15-Feb-2014 19:52 $Recycle.Bin

dr-xr-xr-x 0 0 0 5-Sep-2014 15:44 Boot

dr-xr-xr-x 0 0 0 8-Mar-2014 11:49 Brother

dr-xr-xr-x 0 0 0 15-Feb-2014 19:53 Intel

dr-xr-xr-x 0 0 0 22-Aug-2013 10:22 PerfLogs

dr-xr-xr-x 0 0 0 29-Oct-2014 21:31 Program Files

dr-xr-xr-x 0 0 0 29-Oct-2014 21:31 Program Files (x86)

dr-xr-xr-x 0 0 0 25-Jul-2014 22:26 ProgramData

dr-xr-xr-x 0 0 0 15-Feb-2014 19:34 Recovery

dr-xr-xr-x 0 0 0 30-Oct-2014 06:42 System Volume Information

dr-xr-xr-x 0 0 0 15-Feb-2014 19:37 Users

dr-xr-xr-x 0 0 0 29-Oct-2014 21:31 Windows

MS Data 392304647 468860927 76556281

Can't open filesystem. Filesystem seems damaged.

I am running a deeper search now on the first MS Data ( D MS Data 392304640 468860920 76556281 ), but is it necessary if the second is damaged?

Thanks for assistance, it is appreciated...

Reply

Answer 5

Loner T

Level 9

59,513 points

Nov 20, 2014 12:05 PM in response to slanidracula

You seem to have found the correct partition. You now need to recreate the GPT4 entry using the steps in the referenced article and the start/end/size as shown. You may not need Windows Repair or BCD repair.

The second entry is not very useful since it is damaged.

Reply

Answer 6

slanidracula Author

Level 1

0 points

Nov 20, 2014 12:59 PM in response to Loner T

I performed the following with success. I really appreciate the help!

sudo gdisk /dev/rdisk0

p

d

4

n

4

392304640

468860920

0700

p

w

y

Files were there, but no boot option for Windows. To fix that I created a hybrid MBR based on the other thread:

sudo gdisk /dev/disk0

GPT fdisk (gdisk) version 0.8.10

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): p

Disk /dev/disk0: 490234752 sectors, 233.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 59BDFEEB-1EB4-4529-94FE-3CBC2C3CD513

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 490234718

Partitions will be aligned on 8-sector boundaries

Total free space is 2604 sectors (1.3 MiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EF

2 409640 401060383 191.0 GiB AF05 Macintosh HD

3 401060384 402329919 619.9 MiB AB00 Re

4 402331648 490233848 41.9 GiB 0700 Microsoft basic data

Command (? for help): r

Recovery/transformation command (? for help): h

WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

just hit the Enter key at the below prompt and your MBR partition table will

be untouched.

Type from one to three GPT partition numbers, separated by spaces, to be

added to the hybrid MBR, in sequence: 2 3 4

Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y

Creating entry for GPT partition #2 (MBR partition #2)

Enter an MBR hex code (default AF): AF

Set the bootable flag? (Y/N): n

Creating entry for GPT partition #3 (MBR partition #3)

Enter an MBR hex code (default AB): AB

Set the bootable flag? (Y/N): n

Creating entry for GPT partition #4 (MBR partition #4)

Enter an MBR hex code (default 07): 07

Set the bootable flag? (Y/N): y

Recovery/transformation command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

PARTITIONS!!

Do you want to proceed? (Y/N): y

OK; writing new GUID partition table (GPT) to /dev/disk0.

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Warning: The kernel may continue to use old or deleted partitions.

You should reboot or remove the drive.

The operation has completed successfully.

Reply

Answer 7

slanidracula Author

Level 1

0 points

Nov 20, 2014 1:01 PM in response to slanidracula

Loner T solved this, not me. Sorry about that.

Reply

Answer 8

Loner T

Level 9

59,513 points

Nov 20, 2014 1:13 PM in response to slanidracula

Glad to see it working. Please take a backup of both OSes.

Reply