Level 1

0 points

Missing Bootcamp Partition (with pastes!)

Ok, here's another one of these horrible Yosemite upgrade disasters.

I did my best to learn from the other threads and get started on my own trying to recover this, but I'm in over my head. I would appreciate any help that could be thrown my way.

First: diskutil list

Mac:~ dwilson$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 740.0 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 107.6 GB disk0s4

Then: diskutil cs list

iMac:~ dwilson$ diskutil cs list

No CoreStorage logical volume groups found

Then the hexdump:

iMac:~ dwilson$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 a0 e0 28 3c 06 03 11 ad 2d 94 00 a8 18 01 c0 7d |..(<....-......}|

00000010 13 42 47 80 aa 27 bc 20 22 fe a6 00 a0 10 01 00 |.BG..'. ".......|

00000020 de 20 01 bc 06 01 4e 94 c1 81 10 01 00 80 05 f1 |. ....N.........|

00000030 a4 2d 94 ab de 7a 5a fc 15 04 31 b5 4e 9c 0a 8b |.-...zZ...1.N...|

00000040 ed 2b be 06 28 2e 28 bc de 7f 35 ad a9 29 27 bc |.+..(.(...5..)'.|

00000050 61 7c 35 01 27 26 be f4 fe 07 10 ad 5d 35 0b 10 |a|5.'&......]5..|

00000060 01 40 0a 03 f0 ac c9 93 80 e8 10 01 c0 3f 04 cf |.@...........?..|

00000070 ac 48 7b 57 7a 96 27 3c 26 22 ff 64 97 09 08 29 |.H{Wz.'<&".d...)|

00000080 7c 0a 02 6e 9c 03 2b a7 27 fc 3f 1a 03 29 50 50 ||..n..+.'.?..)PP|

00000090 52 10 01 00 e0 7c ed 29 fc 19 7c f9 5c fd 27 bc |R....|.)..|.\.'.|

000000a0 35 7d 95 aa 2e 7c 1e 29 3c 79 7e 03 ff ff 28 fc |5}...|.)<y~...(.|

000000b0 52 7d e9 bf 2d 7c 1f 2f 3c 20 29 3c 01 7c 05 2f |R}..-|./< )<.|./|

000000c0 7d 1f af 10 01 c0 9a 7c 11 2a bc 14 2e 3c 00 bc |}......|.*...<..|

000000d0 0f 10 02 c0 98 2d bc 1d dc 0b 27 fc 5a 9c 05 29 |.....-....'.Z..)|

000000e0 7c 21 7c 01 2e be 1d bf ea 2c bc 40 2a 7c 02 7d ||!|......,.@*|.}|

000000f0 05 ff 3d 7e 1f af fa 28 fc 3d bc 05 38 7c 02 dc |..=~...(.=..8|..|

00000100 03 17 80 1d bd 01 7f 28 3c 00 01 53 63 4b ea 29 |.......(<..ScK.)|

00000110 3c 1b 22 3c 5a 2a fc bd 23 bc 3e 29 3f 39 64 63 |<."<Z*..#.>)?9dc|

00000120 83 2b 3c 7f 7d 03 df 29 fc 00 7f d9 55 57 57 27 |.+<.}..)....UWW'|

00000130 3c 04 7d f9 a8 2d fc 1f 01 fe 7e 5e 5e fc d1 01 |<.}..-....~^^...|

00000140 44 4b 43 4b 5c 1f 25 34 2c 03 00 00 43 4b 23 43 |DKCK\.%4,...CK#C|

00000150 22 fc 70 06 22 00 49 90 e4 49 92 24 43 5c ff 00 |".p.".I..I.$C\..|

00000160 35 7a fa fe 7e fc 01 00 20 00 05 90 01 e3 5b 61 |5z..~... .....[a|

00000170 2a 2b 2f 2f b7 ff e0 00 00 40 00 a4 05 03 5c 02 |*+//.....@....\.|

00000180 3b a8 fa b7 35 fe 49 4b 25 00 00 00 00 44 64 a4 |;...5.IK%....Dd.|

00000190 4b b5 09 00 00 ff 01 00 00 60 80 0e 38 45 64 c4 |K........`..8Ed.|

000001a0 53 e0 e0 f0 f6 7d 00 48 22 3c 80 04 24 05 5c c4 |S....}.H"<..$.\.|

000001b0 53 5f 5f 28 7c 02 22 3c 40 2a fc 22 7d 01 bf 29 |S__(|."<@*."}..)|

000001c0 3e 03 c3 53 1a 43 ca ea aa 11 23 fe 20 12 24 7e |>..S.C....#. .$~|

000001d0 01 aa aa 10 01 40 00 7c ff 2a bc 00 7e ff ff ff |.....@.|.*..~...|

000001e0 28 7c 84 22 fe 2b fe fe 18 01 40 de 22 3c 20 2a |(|.".+....@."< *|

000001f0 7c 40 22 bd 47 d7 27 34 34 22 7f 64 64 4b ea 29 ||@".G.'44".ddK.)|

00000200

Now. It's my understanding at this point that there is no NTFS header. I ran testdisk and here's what it found.

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

Partition Start End Size in sectors

>P EFI System 40 409639 409600 [EFI]

D Mac HFS 409640 1445749127 1445339488

D MS Data 940517384 1447020544 506503161

D Mac HFS 1445749128 1447018671 1269544

D MS Data 1447020544 1953523704 506503161

D MS Data 1743407104 1953523711 210116608

That's as far as I am able to on my own. Can someone more educated carry me the rest of the way? I'd really appreciate any help that is available.

iMac (21.5-inch Mid 2010), OS X Yosemite (10.10.1)

Posted on Nov 22, 2014 12:14 PM

27 replies

Apr 11, 2015 3:06 AM in response to Loner T

Hi Loner T,

I saw that U helped out so many people with your expert knowledge.

Apple should pay you for that:-)!

I have same problem I think after the newest Yosemite update to 10.10.3.

My bootcamp partition isn't bootable anymore :-( but it's in the finder and in the startvolume menu. I think something in the partition table is not in the right order now. Could you please help me?

Here is what I've got:

disk0:

Last login: Fri Apr 10 23:12:23 on ttys002

iMac:~ Markus$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=121332826112; sectorsize=512; blocks=236978176

gpt show: /dev/disk0: PMBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 236978175

start size index contents

0 1 PMBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 236306352 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

236715992 262144 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

236978136 7

236978143 32 Sec GPT table

236978175 1 Sec GPT header

But my Bootcamp is in disks3 (I have a fusion drive with a 2TB partition of my HDD and the 128GB Flash drive. The bootcamp is on second partition from HDD with approx. 1TB.

iMac:~ Markus$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *121.3 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_CoreStorage 121.0 GB disk0s2

3: Apple_Boot Boot OS X 134.2 MB disk0s3

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *3.0 TB disk1

1: EFI EFI 209.7 MB disk1s1

2: Apple_CoreStorage 1.9 TB disk1s2

3: Apple_Boot Recovery HD 650.1 MB disk1s3

4: Microsoft Basic Data BOOTCAMP 1.1 TB disk1s4

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS Macintosh FD *2.0 TB disk2

Logical Volume on disk0s2, disk1s2

74B8DD80-6F5B-489F-85AB-F57E0C0FD149

Unencrypted Fusion Drive

iMac:~ Markus$ diskutil cs list

CoreStorage logical volume groups (1 found)

+-- Logical Volume Group 8C547F85-7149-4ADF-9450-7EA11B09FD73

=========================================================

Name: FusionDrive

Status: Online

Size: 1993813827584 B (2.0 TB)

Free Space: 32768 B (32.8 KB)

+-< Physical Volume 2B8927FA-EE85-41B5-B967-1CADF7B316DE

| ----------------------------------------------------

| Index: 0

| Disk: disk0s2

| Status: Online

| Size: 120988852224 B (121.0 GB)

+-< Physical Volume 50C0CD50-92FD-4EFF-BDAD-1DED693C6C14

| ----------------------------------------------------

| Index: 1

| Disk: disk1s2

| Status: Online

| Size: 1872824975360 B (1.9 TB)

+-> Logical Volume Family 8DCD864B-090E-4DA4-AE0E-ABC0BB44609E

----------------------------------------------------------

Encryption Status: Unlocked

Encryption Type: None

Conversion Status: NoConversion

Conversion Direction: -none-

Has Encrypted Extents: No

Fully Secure: No

Passphrase Required: No

+-> Logical Volume 74B8DD80-6F5B-489F-85AB-F57E0C0FD149

---------------------------------------------------

Disk: disk2

Status: Online

Size (Total): 1987958538240 B (2.0 TB)

Conversion Progress: -none-

Revertible: No

LV Name: Macintosh FD

Volume Name: Macintosh FD

Content Hint: Apple_HFS

disk3:

iMac:~ Markus$ sudo gpt -vv -r show /dev/disk3

Password:

gpt show: /dev/disk3: mediasize=3000592982016; sectorsize=512; blocks=5860533168

gpt show: /dev/disk3: PMBR at sector 0

gpt show: /dev/disk3: Pri GPT at sector 1

gpt show: /dev/disk3: Sec GPT at sector 5860533167

start size index contents

0 1 PMBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 4688164392 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

4688574032 262144 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

4688836176 432

4688836608 1171695616 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

5860532224 911

5860533135 32 Sec GPT table

5860533167 1 Sec GPT header

Testdisk brings that up after deeper scan:

Is these "bad jump into Fat" the problem?

Apr 11, 2015 3:20 AM in response to markusfrombremen

And here is what gpt says:

disk1:

iMac:~ Markus$ sudo gpt -vv -r show /dev/disk1

gpt show: /dev/disk1: mediasize=3000592982016; sectorsize=512; blocks=5860533168

gpt show: /dev/disk1: PMBR at sector 0

gpt show: /dev/disk1: Pri GPT at sector 1

gpt show: /dev/disk1: Sec GPT at sector 5860533167

start size index contents

0 1 PMBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 3657861280 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

3658270920 1269760 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

3659540680 1848

3659542528 2200989696 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

5860532224 911

5860533135 32 Sec GPT table

5860533167 1 Sec GPT header

and fdisk here:

iMac:~ Markus$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 14751/255/63 [236978176 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 236978175] <Unknown ID>

2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

iMac:~ Markus$ sudo fdisk /dev/disk1

Disk: /dev/disk1 geometry: 97451/255/63 [1565565872 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 4294967294] <Unknown ID>

2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Loner T

Level 9

59,536 points

Apr 11, 2015 4:57 AM in response to markusfrombremen

You do not have a valid MBR on disk1. With a 3TB fusion drive, the Windows part should at least start before the 2TB boundary. I also do not see a disk3, even though you have posted a GPT for it.

You should use /dev/rdisk1 not /dev/disk1 for Testdisk, but you may not need Testdisk, but just a new Hybrid MBR.

Can you post the output of

sudo dd if=/dev/rdisk1s4 count=1 2>/dev/null | hexdump -C

Apr 11, 2015 7:05 AM in response to Loner T

Thank you very much for your response !

Here is the output from:

iMac:~ Markus$ sudo fdisk /dev/disk1

Disk: /dev/disk1 geometry: 97451/255/63 [1565565872 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 4294967294] <Unknown ID>

2: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

iMac:~ Markus$ sudo dd if=/dev/rdisk1s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|

00000010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 30 20 da |........?....0 .|

00000020 00 00 00 00 80 00 80 00 f8 6f 30 83 00 00 00 00 |.........o0.....|

00000030 00 00 0c 00 00 00 00 00 02 00 00 00 00 00 00 00 |................|

00000040 f6 00 00 00 01 00 00 00 59 b0 8f 58 78 b4 42 cb |........Y..Xx.B.|

00000050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|

00000060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|

00000070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|

00000080 55 aa 75 06 f7 c1 01 00 75 03 e9 dd 00 1e 83 ec |U.u.....u.......|

00000090 18 68 1a 00 b4 48 8a 16 0e 00 8b f4 16 1f cd 13 |.h...H..........|

000000a0 9f 83 c4 18 9e 58 1f 72 e1 3b 06 0b 00 75 db a3 |.....X.r.;...u..|

000000b0 0f 00 c1 2e 0f 00 04 1e 5a 33 db b9 00 20 2b c8 |........Z3... +.|

000000c0 66 ff 06 11 00 03 16 0f 00 8e c2 ff 06 16 00 e8 |f...............|

000000d0 4b 00 2b c8 77 ef b8 00 bb cd 1a 66 23 c0 75 2d |K.+.w......f#.u-|

000000e0 66 81 fb 54 43 50 41 75 24 81 f9 02 01 72 1e 16 |f..TCPAu$....r..|

000000f0 68 07 bb 16 68 70 0e 16 68 09 00 66 53 66 53 66 |h...hp..h..fSfSf|

00000100 55 16 16 16 68 b8 01 66 61 0e 07 cd 1a 33 c0 bf |U...h..fa....3..|

00000110 28 10 b9 d8 0f fc f3 aa e9 5f 01 90 90 66 60 1e |(........_...f`.|

00000120 06 66 a1 11 00 66 03 06 1c 00 1e 66 68 00 00 00 |.f...f.....fh...|

00000130 00 66 50 06 53 68 01 00 68 10 00 b4 42 8a 16 0e |.fP.Sh..h...B...|

00000140 00 16 1f 8b f4 cd 13 66 59 5b 5a 66 59 66 59 1f |.......fY[ZfYfY.|

00000150 0f 82 16 00 66 ff 06 11 00 03 16 0f 00 8e c2 ff |....f...........|

00000160 0e 16 00 75 bc 07 1f 66 61 c3 a0 f8 01 e8 09 00 |...u...fa.......|

00000170 a0 fb 01 e8 03 00 f4 eb fd b4 01 8b f0 ac 3c 00 |..............<.|

00000180 74 09 b4 0e bb 07 00 cd 10 eb f2 c3 0d 0a 41 20 |t.............A |

00000190 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 |disk read error |

000001a0 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d |occurred...BOOTM|

000001b0 47 52 20 69 73 20 6d 69 73 73 69 6e 67 00 0d 0a |GR is missing...|

000001c0 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 |BOOTMGR is compr|

000001d0 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 |essed...Press Ct|

000001e0 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 |rl+Alt+Del to re|

000001f0 73 74 61 72 74 0d 0a 00 8c a9 be d6 00 00 55 aa |start.........U.|

00000200

Apr 11, 2015 7:35 AM in response to markusfrombremen

What can I do to rebuild the MBR?

Is there a chance to do so or do you think it would be better to start Boot Camp Assistant again and restore a Winclone Image?

Loner T

Level 9

59,536 points

Apr 11, 2015 7:52 AM in response to markusfrombremen

Please try the following steps, before you decide to re-install Windows.

Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Use defaults for other questions (like partition codes). The only values that need modifications are the Boot flags and step 6. Accept all other defaults that Gdisk offers.

Sudo gdisk /dev/disk1
P (Print list of parts)
R (Recover)
H (chooses Hybrid)
Partitions numbers to be hybridized: 2 3 4
Y (Good for GRUB question)
N (part 2 boot flag)
N (part 3 boot flag)
Y (part 4 boot flag make NTFS bootable partition)
W (Write the new MBR)
Y (Yes! write the new MBR)
Reboot

Test 1 - Does Bootcamp Volume show up in Finder?

Test 2 - Can you see files in Bootcamp Volume?

Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

Apr 11, 2015 8:08 AM in response to Loner T

Ok, I have done these steps and rebooted.

Now Bootcamp is not in System Preferences -> Startup Disk (Test3) anymore.

Test 1 - Does Bootcamp Volume show up in Finder? Check!

Test 2 - Can you see files in Bootcamp Volume? Check!

Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk? NO!

Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

What can I do next?

Loner T

Level 9

59,536 points

Apr 11, 2015 8:14 AM in response to markusfrombremen

Do you have any third-party NTFS software?

Apr 11, 2015 8:31 AM in response to Loner T

What kind of sw do you mean?

NTFS-3G or tuxer?

BTW.

New results of:

sudo fdisk /dev/disk1

Disk: /dev/disk1 geometry: 97451/255/63 [1565565872 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 3657861280] HFS+

3: AB 1023 254 63 - 1023 254 63 [3658270920 - 1269760] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [3659542528 - 2200989696] HPFS/QNX/AUX

Apr 11, 2015 8:34 AM in response to markusfrombremen

Do you have an Paypal account?

I want to send you a few bucks for helping me so kindly.

Thanx

Apr 11, 2015 9:19 AM in response to dwilson00

It is running! 🙂!!!

U are my hero Loner. Thanx a lot. The Entry in system bootdevice ist still not there but when I boot with ALT the Bootcamp is coming up again. Then after a chkdsk my windows7 was back on my mac!!

Great!

Thank u so much

Loner T

Level 9

59,536 points

Apr 11, 2015 9:33 AM in response to markusfrombremen

markusfrombremen wrote:

I want to send you a few bucks for helping me so kindly.

Please donate money to you favorite local charity. You can also donate to grenier@cgsecurity.org (the author of Testdisk), if you prefer.

The Entry in system bootdevice ist still not there but when I boot with ALT the Bootcamp is coming up again. Then after a chkdsk my windows7 was back on my mac!!

If you have Tuxera, NTFS-3g, Paragon, NTFS-Free, MacDrive,... the Apple NTFS driver will not allow the Windows volume to show up in Startup Disk. Alt/Option is a bit more tedious to switch between the two systems. In Disk Utility, if you click on the Windows partition, and anything other than NTFS is controlling the partition, it will be missing.

The following configuration is the only on that will work with Startup Disk.

Glad to see it working. Please backup OS X and Windows (to separate hard disks, if possible). Use this for future recovery as a base line backup.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Missing Bootcamp Partition (with pastes!)