Windows BootCamp Partition gone after Yosemite Upgrade

Question

Level 1

0 points

Windows BootCamp Partition gone after Yosemite Upgrade

Hi Loner T,

Here is the output for the commands you request to users to assist them in recovering the windows partition in bootcamp after installing Yosemite.

I hope you can help me,

Thanks in advance,

IsaacMBPro-2:~ isaaciyune$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *320.1 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_CoreStorage 235.2 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 84.0 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS Macintosh HD *234.8 GB disk1

Logical Volume on disk0s2

FB9119F6-5472-4B02-BBAF-ABEFB1488757

Unencrypted

/dev/disk3

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *511.0 GB disk3

1: EFI EFI 209.7 MB disk3s1

2: Apple_HFS Time Machine Backups 510.7 GB disk3s2

IsaacMBPro-2:~ isaaciyune$ diskutil cs list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group E939C1EE-98B6-4A99-A793-2C0254847EE3

=========================================================

Name: Macintosh HD

Status: Online

Size: 235209998336 B (235.2 GB)

Free Space: 18989056 B (19.0 MB)

|

+-< Physical Volume 91BF8AC7-605D-415B-A7FC-456A8EF35E32

| ----------------------------------------------------

| Index: 0

| Disk: disk0s2

| Status: Online

| Size: 235209998336 B (235.2 GB)

|

+-> Logical Volume Family 965EB12D-166F-4807-A408-A41CC1DE2418

----------------------------------------------------------

Encryption Status: Unlocked

Encryption Type: AES-XTS

Conversion Status: Converting

Conversion Direction: backward

Has Encrypted Extents: Yes

Fully Secure: No

Passphrase Required: No

|

+-> Logical Volume FB9119F6-5472-4B02-BBAF-ABEFB1488757

---------------------------------------------------

Disk: disk1

Status: Online

Size (Total): 234838687744 B (234.8 GB)

Conversion Progress: 37%

Revertible: Yes (unlock and decryption required)

LV Name: Macintosh HD

Volume Name: Macintosh HD

Content Hint: Apple_HFS

IsaacMBPro-2:~ isaaciyune$ sudo gpt -vv -r show /dev/disk0

Password:

Sorry, try again.

Password:

gpt show: /dev/disk0: mediasize=320072933376; sectorsize=512; blocks=625142448

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 625142447

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 459394528 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

459804168 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

461073704 164068057 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

625141761 654

625142415 32 Sec GPT table

625142447 1 Sec GPT header

MacBook Pro (13-inch Early 2011), OS X Yosemite (10.10.1)

Posted on Nov 24, 2014 1:46 PM

Reply

Answer 1

Loner T

Level 9

59,513 points

Nov 24, 2014 1:54 PM in response to iyune

1. Was any resizing of the Bootcamp partition done between the time Windows was initially installed and the Yosemite upgrade?

2. Please post the output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C to check the current NTFS header.

Reply

Answer 2

iyune Author

Level 1

0 points

Nov 24, 2014 1:56 PM in response to Loner T

Hi Loner T,

Yes I did add more storage to the windows partition after being created,

Here is the outcome for the command:

IsaacMBPro-2:~ isaaciyune$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 c2 c0 5e d9 19 0f 65 3e a8 7f 8c 6a c9 4b 99 6a |..^...e>...j.K.j|

00000010 c4 ae 25 39 3b d6 14 d5 b0 21 fd 69 c6 bc bc 04 |..%9;....!.i....|

00000020 b4 46 78 b5 ee d5 bc ab d2 20 dd 5d ec 1e 70 7c |.Fx...... .]..p||

00000030 0e 3f e7 ac 8e 24 91 d2 08 bb cf 92 74 74 87 c7 |.?...$......tt..|

00000040 65 9a a7 75 e7 ae 51 74 65 24 0e d0 d0 1f b4 76 |e..u..Qte$.....v|

00000050 7e 18 ff ba 85 0b 7e 5e 14 1c e8 c3 16 bd 8b 1e |~.....~^........|

00000060 66 c1 57 30 8f c1 a8 cc 6b 64 2a 37 29 21 37 21 |f.W0....kd*7)!7!|

00000070 4f e4 65 64 da e0 a8 59 30 4a 00 82 ae 55 33 31 |O.ed...Y0J...U31|

00000080 59 9d d3 75 9a e7 90 54 22 67 21 d7 a2 ce 22 bb |Y..u...T"g!...".|

00000090 57 d5 08 a4 15 02 43 1c 88 e8 9e 3d 2f f7 f3 3d |W.....C....=/..=|

000000a0 f0 67 df 04 d2 50 8f 0d 8f 93 cc 7f 46 75 31 9a |.g...P......Fu1.|

000000b0 cf 8d 2d f1 cf ee ac f2 6f c0 03 d9 32 a7 58 d0 |..-.....o...2.X.|

000000c0 7a 68 3b 8b a1 12 f1 f3 c5 f4 f0 55 2b 9e 94 05 |zh;........U+...|

000000d0 bf 5e db cb 5a 60 6c b9 bf d8 05 26 05 04 84 42 |.^..Z`l....&...B|

000000e0 4b a0 14 ef d1 34 26 79 5b 49 a3 29 53 81 44 60 |K....4&y[I.)S.D`|

000000f0 38 c0 2f fb 82 b8 b8 b0 52 63 a4 15 80 67 6c 22 |8./.....Rc...gl"|

00000100 27 0d 3f d6 b8 8b c4 76 43 1a d7 40 ea 24 b8 5b |'.?....vC..@.$.[|

00000110 ef ba 01 35 ee 51 85 b3 b3 d4 5e 18 e8 6d 69 65 |...5.Q....^..mie|

00000120 fe 11 f7 56 7a 4d 7b 9c fa 98 40 6b 04 77 76 df |...VzM{...@k.wv.|

00000130 9c ff a9 f2 e7 3d f5 5e 26 ce 5a 40 d1 6f e7 61 |.....=.^&.Z@.o.a|

00000140 4b c7 53 87 80 0e d5 31 ec 88 88 fd 5a 5c d1 2b |K.S....1....Z\.+|

00000150 ee b8 b4 b0 6d 12 d3 01 a8 43 3f d8 a1 f6 29 9f |....m....C?...).|

00000160 0c 34 c3 f9 b7 cf df 7d 17 57 48 b6 98 f1 73 04 |.4.....}.WH...s.|

00000170 b3 7f 96 77 f4 02 de 00 53 05 4f b0 b6 0d 5f e5 |...w....S.O..._.|

00000180 04 b6 00 0e d6 e0 f1 14 fb cb c1 17 2d 07 6a 7a |............-.jz|

00000190 2c 2b 42 dc ce 31 1b 00 54 06 52 de 58 0d d4 61 |,+B..1..T.R.X..a|

000001a0 0a d9 81 61 f4 42 d5 51 6a 29 d0 1f 28 21 fd 1b |...a.B.Qj)..(!..|

000001b0 8b 09 02 3d 9d 6a 1b 5e 4a 93 57 f1 b9 0b db 80 |...=.j.^J.W.....|

000001c0 ca 90 32 9f 65 20 ed 4c d3 83 8e 86 47 e7 16 72 |..2.e .L....G..r|

000001d0 f4 be e9 9f ed 00 2a 83 93 83 2d 06 68 7c 9b ce |......*...-.h|..|

000001e0 71 21 fd eb 03 cb ae 43 b5 dc 75 c2 ac 99 ba 70 |q!.....C..u....p|

000001f0 75 58 34 25 2b 12 ed c8 d5 c5 68 85 23 ea ed 80 |uX4%+.....h.#...|

00000200

IsaacMBPro-2:~ isaaciyune$

Thanks

Reply

Answer 3

Loner T

Level 9

59,513 points

Nov 24, 2014 2:13 PM in response to iyune

In the referenced thread, theer are two utilities, Testdisk and GPT Fdisk. Please download both. Start with Testdisk and look for teh lost NTFS header using a EFI GPT partition type and Quick Search. I expect you will need 'Deeper Search'.

Please see http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step.

Reply

Answer 4

iyune Author

Level 1

0 points

Nov 24, 2014 3:34 PM in response to Loner T

I downloaded both, and ran testdisk an this is what I got.

Screen 1

Screen 2

Screen 3

I don´t know what to do at this point to find the lost header, any clues?

Thanks

Reply

Answer 5

Loner T

Level 9

59,513 points

Nov 24, 2014 3:51 PM in response to iyune

The three partitions of the type MS Data of size 164067321 are roughly 83+ GB, which is close to your BC partition of 84GB.

Scroll down to each MS Data partition and use 'P' to list files. Look for familiar Windows files. You also need to see 'System Volume Information' in that list.

Can you post a text version of the last screen so I can cut/paste numbers for my table to validate the bytes offsets? It will look similar to teh gpt output you posted in your first post.

Reply

Answer 6

iyune Author

Level 1

0 points

Nov 24, 2014 4:08 PM in response to Loner T

From the 3 partitions,

Partitions 1 and 3 return an error "Can't open filesystem. Filesystem seems damaged."

Partition 2 seems to have the windows OS, so this one might be

here is the text of screen 3:

TestDisk 7.0-WIP, Data Recovery Utility, October 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 320 GB / 298 GiB - 625142448 sectors (RO)

Partition Start End Size in sectors

P EFI System 40 409639 409600 [EFI]

D Mac HFS 409640 459078951 458669312

>D MS Data 297007112 461074432 164067321

D Mac HFS 459804168 461073703 1269536

D MS Data 461074432 625141752 164067321

D MS Data 461074439 625141759 164067321

D Mac HFS 623872872 625142407 1269536

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

NTFS found using backup sector, blocksize=4096, 84 GB / 78 GiB

Thanks

Reply

Answer 7

Loner T

Level 9

59,513 points

Nov 24, 2014 5:49 PM in response to iyune

Assuming that you can see familiar files, including "System Volume Information", in the following partition,

D MS Data 461074432 625141752 164067321

The following table contains the values from your GPT 3 and this entry. A negative 'byte offset' indicates potential data loss. In your case it seems to be fine.

GPT 3 Start	GPT 3 Size	GPT 3 End	NTFS Start	Byte Offset	NTFS Size	NTFS End
459804168	1269536	461073704	461074432	728	164067321	625141753

Here are the steps.

Rebuild using start/end offsets from Testdisk DeepSearch using GPT disk

Sudo gdisk /dev/rdisk0
P (print the full list of parts)
D (delete)
4 (part 4)
N (new part)
4 (part 4)
461074432
(start point for Bootcamp part)
+
164067321
(Size offset as opposed to End offset)
0700 (Windows part type)
P (print list of all parts just to see what changes will be made)
W (Write the new GPT)
Y (Yes! really write the new GPT)

This will delete and re-write the GPT partition info for /dev/disk0s4.

Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Please answer Yes to include EFI in MBR (good for GRUB question). Use defaults for partition types as suggested by Gdisk which it collects from the GPT GUIDs.

Sudo gdisk /dev/disk0
P (Print list of parts)
R (Recover)
H (chooses Hybrid)
Partitions numbers to be hybridized: 2 3 4
N (boot flag 1)
N (part 2 flag)
N (part 3 flag)
Y (part 4 flag make bootable partition)
W (Write the new MBR)
Y (Yes! write the new MBR)

Reboot

Check all partitions with fdisk on reboot.

sudo fdisk /dev/disk0 (everything should match and Bootcamp should be visible everywhere)

If you see any error messages, please stop and post back here. Post the output of the gpt show and fdisk commands before and after each reboot.

Reply

Answer 8

iyune Author

Level 1

0 points

Nov 27, 2014 7:59 AM in response to Loner T

Hi Loner T,

Sorry for the delay, but after performing the steps you mentioned, the OS did not boot, a ? sign came out when booting instead of the apple logo.

Long story short, I was able to solve it by performing a network recovery tool, opening the terminal and unmount and remount all the volumes (the OSX volume was never able to be mounted or unmounted), then rebooted and voila!!

I have my bootcamp partition booting and running like a charm! but I actually don't know if related but most of my apps are not working in Yosemite and the appstore just does not download or update anything popping out a " <name of app> failed to download. Use the purchases page to try again", and of course that does not work either.

I really appreciate your help on this manner!!

Reply

Answer 9

Loner T

Level 9

59,513 points

Nov 27, 2014 8:32 AM in response to iyune

Step 6 in the Hybrid MBR portion is a problem. It should be Y. This is in response to the question of including the EFI part in the MBR. It is unrelated to boot flags for Windows. Good to see you managed to get it back up and running.

On the OSX side, can you re-install OSX (it should leave everything else untouched)?

Be aware that Internet Recovery - OS X: About OS X Recovery - Apple Support may provide a different version of OSX than what you currently have.

Which version of OS X is installed by OS X Recovery?

If you use the Recovery System stored on your startup drive to reinstall OS X, it installs the most recent version of OS X previously installed on this computer.
If you use Internet Recovery to reinstall OS X, it installs the version of OS X that originally came with your computer. After installation is finished, use the Mac App Store to install related updates or later versions of OS X that you have previously purchased.

Reply

Answer 10

iyune Author

Level 1

0 points

Nov 27, 2014 9:07 AM in response to Loner T

How do I download Yosemite if app store is not downloading anything?

Reply

Answer 11

Loner T

Level 9

59,513 points

Nov 27, 2014 9:27 AM in response to iyune

If you can clean install the OSX version via Internet Recovery on an external disk, not the one which you are trying to fix, and upgrade it all the way to Yosemite, you can boot from this external disk, and fix your internal disk.

Reply