Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Missing Bootcamp Partition (with pastes!)

Ok, here's another one of these horrible Yosemite upgrade disasters.


I did my best to learn from the other threads and get started on my own trying to recover this, but I'm in over my head. I would appreciate any help that could be thrown my way.


First: diskutil list

Mac:~ dwilson$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 740.0 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 107.6 GB disk0s4


Then: diskutil cs list

iMac:~ dwilson$ diskutil cs list

No CoreStorage logical volume groups found


Then the hexdump:


iMac:~ dwilson$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 a0 e0 28 3c 06 03 11 ad 2d 94 00 a8 18 01 c0 7d |..(<....-......}|

00000010 13 42 47 80 aa 27 bc 20 22 fe a6 00 a0 10 01 00 |.BG..'. ".......|

00000020 de 20 01 bc 06 01 4e 94 c1 81 10 01 00 80 05 f1 |. ....N.........|

00000030 a4 2d 94 ab de 7a 5a fc 15 04 31 b5 4e 9c 0a 8b |.-...zZ...1.N...|

00000040 ed 2b be 06 28 2e 28 bc de 7f 35 ad a9 29 27 bc |.+..(.(...5..)'.|

00000050 61 7c 35 01 27 26 be f4 fe 07 10 ad 5d 35 0b 10 |a|5.'&......]5..|

00000060 01 40 0a 03 f0 ac c9 93 80 e8 10 01 c0 3f 04 cf |.@...........?..|

00000070 ac 48 7b 57 7a 96 27 3c 26 22 ff 64 97 09 08 29 |.H{Wz.'<&".d...)|

00000080 7c 0a 02 6e 9c 03 2b a7 27 fc 3f 1a 03 29 50 50 ||..n..+.'.?..)PP|

00000090 52 10 01 00 e0 7c ed 29 fc 19 7c f9 5c fd 27 bc |R....|.)..|.\.'.|

000000a0 35 7d 95 aa 2e 7c 1e 29 3c 79 7e 03 ff ff 28 fc |5}...|.)<y~...(.|

000000b0 52 7d e9 bf 2d 7c 1f 2f 3c 20 29 3c 01 7c 05 2f |R}..-|./< )<.|./|

000000c0 7d 1f af 10 01 c0 9a 7c 11 2a bc 14 2e 3c 00 bc |}......|.*...<..|

000000d0 0f 10 02 c0 98 2d bc 1d dc 0b 27 fc 5a 9c 05 29 |.....-....'.Z..)|

000000e0 7c 21 7c 01 2e be 1d bf ea 2c bc 40 2a 7c 02 7d ||!|......,.@*|.}|

000000f0 05 ff 3d 7e 1f af fa 28 fc 3d bc 05 38 7c 02 dc |..=~...(.=..8|..|

00000100 03 17 80 1d bd 01 7f 28 3c 00 01 53 63 4b ea 29 |.......(<..ScK.)|

00000110 3c 1b 22 3c 5a 2a fc bd 23 bc 3e 29 3f 39 64 63 |<."<Z*..#.>)?9dc|

00000120 83 2b 3c 7f 7d 03 df 29 fc 00 7f d9 55 57 57 27 |.+<.}..)....UWW'|

00000130 3c 04 7d f9 a8 2d fc 1f 01 fe 7e 5e 5e fc d1 01 |<.}..-....~^^...|

00000140 44 4b 43 4b 5c 1f 25 34 2c 03 00 00 43 4b 23 43 |DKCK\.%4,...CK#C|

00000150 22 fc 70 06 22 00 49 90 e4 49 92 24 43 5c ff 00 |".p.".I..I.$C\..|

00000160 35 7a fa fe 7e fc 01 00 20 00 05 90 01 e3 5b 61 |5z..~... .....[a|

00000170 2a 2b 2f 2f b7 ff e0 00 00 40 00 a4 05 03 5c 02 |*+//.....@....\.|

00000180 3b a8 fa b7 35 fe 49 4b 25 00 00 00 00 44 64 a4 |;...5.IK%....Dd.|

00000190 4b b5 09 00 00 ff 01 00 00 60 80 0e 38 45 64 c4 |K........`..8Ed.|

000001a0 53 e0 e0 f0 f6 7d 00 48 22 3c 80 04 24 05 5c c4 |S....}.H"<..$.\.|

000001b0 53 5f 5f 28 7c 02 22 3c 40 2a fc 22 7d 01 bf 29 |S__(|."<@*."}..)|

000001c0 3e 03 c3 53 1a 43 ca ea aa 11 23 fe 20 12 24 7e |>..S.C....#. .$~|

000001d0 01 aa aa 10 01 40 00 7c ff 2a bc 00 7e ff ff ff |.....@.|.*..~...|

000001e0 28 7c 84 22 fe 2b fe fe 18 01 40 de 22 3c 20 2a |(|.".+....@."< *|

000001f0 7c 40 22 bd 47 d7 27 34 34 22 7f 64 64 4b ea 29 ||@".G.'44".ddK.)|

00000200


Now. It's my understanding at this point that there is no NTFS header. I ran testdisk and here's what it found.


Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

Partition Start End Size in sectors

>P EFI System 40 409639 409600 [EFI]

D Mac HFS 409640 1445749127 1445339488

D MS Data 940517384 1447020544 506503161

D Mac HFS 1445749128 1447018671 1269544

D MS Data 1447020544 1953523704 506503161

D MS Data 1743407104 1953523711 210116608


That's as far as I am able to on my own. Can someone more educated carry me the rest of the way? I'd really appreciate any help that is available.

iMac (21.5-inch Mid 2010), OS X Yosemite (10.10.1)

Posted on Nov 22, 2014 12:14 PM

Reply
27 replies

Nov 23, 2014 7:55 AM in response to Loner T

Thanks for responding. Here's what I got.


sudo gpt -vv -r show /dev/disk0

iMac:testdisk-7.0-WIP dwilson$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 1445339488 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

1445749128 1269544 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

1447018672 296388432

1743407104 210116608 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

sudo fdisk /dev/disk0

iMac:testdisk-7.0-WIP dwilson$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 1445339488] HFS+

3: AB 1023 254 63 - 1023 254 63 [1445749128 - 1269544] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [1743407104 - 210116608] Win95 FAT32L

Nov 23, 2014 10:31 AM in response to dwilson00

This is a Yosemite bug. The large gap between GPT#3 and GPT#4 indicates a 'lost' NTFS header in that gap. Was windows or OSX resized at any point after the initial installation and before the Yosemite upgrade?


Can you follow the steps in Bootcamp partition has disappeared after upgrade to Yosemite 10.10? If you need any help with specifics or have questions let me know.

Nov 24, 2014 7:33 AM in response to Loner T

This is a Yosemite bug. The large gap between GPT#3 and GPT#4 indicates a 'lost' NTFS header in that gap. Was windows or OSX resized at any point after the initial installation and before the Yosemite upgrade?

Yeah. I underestimated my needs when I created the original bootcamp partition and resized it and the OSX partition at some point.


Can you follow the steps in Bootcamp partition has disappeared after upgrade to Yosemite 10.10? If you need any help with specifics or have questions let me know.

That's the document I was originally trying to follow. Am I correct that my next step would be to do the deep scan?

Nov 25, 2014 7:25 AM in response to Loner T

Okay. Here's what I got from the Testdisk Deeper Scan.


Disk /dev/disk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)


The harddisk (1000 GB / 931 GiB) seems too small! (< 1640 GB / 1527 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...


The following partitions can't be recovered:

Partition Start End Size in sectors

> Mac HFS 1445749124 2891088611 1445339488

Mac HFS 1534815006 3204213395 1669398390 [D$^D~KU ~I^T$ ~_

MS Data 1953523704 2460026864 506503161

MS Data 1953523711 2163640318 210116608



D MS Data 1542307720 1542313893 6174 [Boot]

D MS Data 1542418155 1542424328 6174

>D MS Data 1542424328 1542430501 6174 [Boot]


The first one labelled "Boot" contains the system volume information file.

Nov 25, 2014 7:49 AM in response to dwilson00

The BOOT is too small for a NTFS file system and does not match the size of 107GB that diskutil list shows. The following two are close to 1953525168 which is the size of your disk, but should be checked. These are most likely damaged.


MS Data 1953523704 2460026864 506503161

MS Data 1953523711 2163640318 210116608


Most likely NTFS 'lost' partition should be in the following gap.

1447018672 296388432


The combined size of the following gap and GPT4 is about 250Gb, which also adds up to 740+250 GB = 990Gb which the size of your 1TB disk.

1447018672 296388432

1743407104 210116608 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

Nov 26, 2014 9:33 AM in response to Loner T

Okay, I think I found what we're looking for.


ttp://www.cgsecurity.org

MS Data 1447020544 1953523704 506503161

Directory /

Previous

dr-xr-xr-x 0 0 0 19-Nov-2014 03:01 ..

dr-xr-xr-x 0 0 0 28-Apr-2013 17:56 $Recycle.Bin

dr-xr-xr-x 0 0 0 20-Jan-2014 16:37 AMD

dr-xr-xr-x 0 0 0 25-Aug-2013 17:43 ArcTemp

dr-xr-xr-x 0 0 0 28-Apr-2013 18:39 Boot

dr-xr-xr-x 0 0 0 29-Apr-2013 07:08 Intel

dr-xr-xr-x 0 0 0 28-Apr-2013 17:49 MSOCache

dr-xr-xr-x 0 0 0 13-Jul-2009 22:20 PerfLogs

dr-xr-xr-x 0 0 0 10-Nov-2014 15:20 Program Files

dr-xr-xr-x 0 0 0 12-Nov-2014 18:41 Program Files (x86)

dr-xr-xr-x 0 0 0 2-Nov-2014 18:39 ProgramData

dr-xr-xr-x 0 0 0 28-Apr-2013 17:47 Recovery

dr-xr-xr-x 0 0 0 29-Apr-2013 17:42 Riot Games

>dr-xr-xr-x 0 0 0 20-Jul-2013 18:57 System Volume Information


While I had it open I went through and copied over the few files I didn't have an existing backup for. So the worst case scenario is have to spend a day off nuking and starting over.


I mean look at this:


Disk /dev/disk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

Partition Start End Size in sectors

D MS Data 1447020544 1953523704 506503161

>D MS Data 1449671610 1459363466 9691857 [NO NAME]

D Mac HFS 1449793540 1458182149 8388610 [ D^A]

D MS Data 1456557928 1456560807 2880 [EFISECTOR]

D MS Data 1458071584 1458074463 2880 [EFISECTOR]

D MS Data 1459169704 1459177777 8074 [GParted-EFI]

D MS Data 1466775491 1466796229 20739 [NO NAME]

D MS Data 1530456721 1531828704 1371984 [GW ث݊ b~^dS

D MS Data 1530456722 1531828705 1371984 [GW ث݊ b~^dS

D MS Data 1542301547 1542307720 6174

D MS Data 1542307720 1542313893 6174 [Boot]

D MS Data 1542418155 1542424328 6174


The output for my deep scan is an absolute mess compared to everyone else's. I'd still rather recover (for now) and do a full format when it's not holiday season and I can use some vacation time.

Nov 26, 2014 9:54 AM in response to dwilson00

The first entry you posted is the correct one. Glad to see you found it. I have this table to make sure no existing partitions are lost.


GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartByte OffsetNTFS SizeNTFS End
144574912812695441447018672144702054418725065031611953523705


The 'Byte Offset' being positive is good. A negative value means you lose GPT#3. The NTFS size is roughly 250GB which is good.


You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message.


Rebuild using start/end offsets from Testdisk DeepSearch using GPT Fdisk (http://sourceforge.net/projects/gptfdisk/)

  1. Sudo gdisk /dev/rdisk0
  2. P (print the full list of parts)
  3. D (delete)
  4. 4 (part 4)
  5. N (new part)
  6. 4 (part 4)
  7. 1447020544 - Start offset in bytes (start point for Bootcamp part)
  8. +506503161 (Size offset as opposed to End offset)
  9. 0700 (Windows part type)
  10. P (print list of all parts just to see what changes will be made)
  11. W (Write the new GPT)
  12. Y (Yes! really write the new GPT)


This will delete and re-write the GPT partition info for /dev/disk0s4.

Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR

  1. Sudo gdisk /dev/disk0
  2. P (Print list of parts)
  3. R (Recover)
  4. H (chooses Hybrid)
  5. Partitions numbers to be hybridized: 2 3 4
  6. Y (Good for GRUB question)
  7. N (part 2 flag)
  8. N (part 3 flag)
  9. Y (part 4 flag make bootable partition)
  10. W (Write the new MBR)
  11. Y (Yes! write the new MBR)
  12. Reboot

Test 1 - Does Bootcamp Volume show up in Finder?

Test 2 - Can you files in Bootcamp Volume?

Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

If you see a hanging underline cursor at the top left on a black screen, and it does not proceed further, you may need Windows Startup Repair or a tool called EasyBCD.

Mar 17, 2015 5:57 AM in response to jochems

jochems wrote:


Hi, thanks for the help! My Windows partition is back after following these steps, but I'm getting a error when trying to boot it.


"a disk read error occurred"


When I'm trying to access it in Disk Utility it is still grayed out.


Any idea what to do next? Thanks

Can you start a new discussion and post the output of the commands used in this thread? You may need Windows Startup Repair.

Missing Bootcamp Partition (with pastes!)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.