Boot Camp Lost After 10.10.1 Upgrade

Question

Last login: Fri Dec  5 15:49:42 on consolemichael-tyos-MacBook-Air:~ michaeltyo$ diskutil list/dev/disk0   #:                       TYPE NAME                    SIZE       IDENTIFIER   0:      GUID_partition_scheme                        *121.3 GB   disk0   1:                        EFI EFI                     209.7 MB   disk0s1   2:                  Apple_HFS Macintosh HD            24.6 GB    disk0s2   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3   4:       Microsoft Basic Data                         88.8 GB    disk0s4michael-tyos-MacBook-Air:~ michaeltyo$ diskutil cs listNo CoreStorage logical volume groups foundmichael-tyos-MacBook-Air:~ michaeltyo$ sudo gpt -vv -r show /dev/disk0WARNING: Improper use of the sudo command could lead to data lossor the deletion of important system files. Please double-check yourtyping when using sudo. Type "man sudo" for more information.To proceed, enter your password, or type Ctrl-C to abort.Password:gpt show: /dev/disk0: mediasize&#x3D;121332826112; sectorsize&#x3D;512; blocks&#x3D;236978176gpt show: /dev/disk0: Suspicious MBR at sector 0gpt show: /dev/disk0: Pri GPT at sector 1gpt show: /dev/disk0: Sec GPT at sector 236978175      start       size  index  contents          0          1         MBR          1          1         Pri GPT header          2         32         Pri GPT table         34          6                  40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B     409640   48061168      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC   48470808    1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC   49740352   13848000            63588352  173387776      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7  236976128       2015           236978143         32         Sec GPT table  236978175          1         Sec GPT headermichael-tyos-MacBook-Air:~ michaeltyo$ sudo fdisk /dev/disk0Disk: /dev/disk0 geometry: 14751/255/63 [236978176 sectors]Signature: 0xAA55         Starting       Ending #: id  cyl  hd sec -  cyl  hd sec [     start -       size]------------------------------------------------------------------------ 1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] &lt;Unknown ID&gt; 2: AF 1023 254  63 - 1023 254  63 [    409640 -   48061168] HFS+         3: AB 1023 254  63 - 1023 254  63 [  48470808 -    1269544] Darwin Boot  4: 0C 1023 254  63 - 1023 254  63 [  63588352 -  173387776] Win95 FAT32Lmichael-tyos-MacBook-Air:~ michaeltyo$ Your assistance is greatly appreciated - I need to recover this partition and be able to boot it.

adam1314 · Answer

download and run testdisk. Use test disk to find the start, end and size of the missing partition. Then follow Loner&#x27;s instruction to reset the partition table and etc.

Loner T · Answer

Thanks for the assist adam1314.Xegony42 - Please see Re: Missing Bootcamp Partition (with pastes!) for an example. Testdisk Quick Search will just show the current partitions. You need to use Deeper Search before you make any GPT/Gdisk changes.

Xegony42 · Answer

Last login: Fri Dec  5 15:53:49 on ttys000michael-tyos-MacBook-Air:~ michaeltyo$ /Users/michaeltyo/Downloads/testdisk-7.0-WIP/testdisk ; exit;TestDisk 7.0-WIP, Data Recovery Utility, October 2014Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgNo disk found.TestDisk will try to restart itself using the sudo command to getroot (superuser) privileges.sudo may ask your user password, it doesn&#x27;t ask for the root password.Usually there is no echo or &#x27;*&#x27; displayed when you type your password.Password:TestDisk 7.0-WIP, Data Recovery Utility, October 2014Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgTestDisk 7.0-WIP, Data Recovery Utility, October 2014Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgDisk /dev/disk0 - 121 GB / 113 GiB - 236978176 sectors (RO)The harddisk (121 GB / 113 GiB) seems too small! (&lt; 383 GB / 357 GiB)Check the harddisk size: HD jumpers settings, BIOS detection...The following partitions can&#x27;t be recovered:     Partition               Start        End    Size in sectors&gt;  MS Data                 50979864  238214160  187234297   MS Data                 58158048  245392344  187234297   MS Data                 79406536  252794311  173387776   MS Data                148359880  321747655  173387776   Mac HFS                160255567  749686352  589430786   MS Data                236976120  424210416  187234297   MS Data                236976127  410363902  173387776[ Continue ]NTFS, blocksize&#x3D;4096, 95 GB / 89 GiB

Xegony42 · Answer

This is what popped up after deep scan.  I&#x27;m not sure what to do next.  Not an IT guy.

Xegony42 · Answer

Last login: Fri Dec  5 15:53:49 on ttys000michael-tyos-MacBook-Air:~ michaeltyo$ /Users/michaeltyo/Downloads/testdisk-7.0-WIP/testdisk ; exit;TestDisk 7.0-WIP, Data Recovery Utility, October 2014Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgNo disk found.TestDisk will try to restart itself using the sudo command to getroot (superuser) privileges.sudo may ask your user password, it doesn&#x27;t ask for the root password.Usually there is no echo or &#x27;*&#x27; displayed when you type your password.Password:TestDisk 7.0-WIP, Data Recovery Utility, October 2014Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgTestDisk 7.0-WIP, Data Recovery Utility, October 2014Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgDisk /dev/disk0 - 121 GB / 113 GiB - 236978176 sectors (RO)     Partition               Start        End    Size in sectors D Mac HFS                 48477586   49747129    1269544 D Mac HFS                 48477651   49747194    1269544 D Mac HFS                 48477716   49747259    1269544 D Mac HFS                 48477781   49747324    1269544 D Mac HFS                 48477958   49747501    1269544 D Mac HFS                 48478127   49747670    1269544 D Mac HFS                 48478192   49747735    1269544 D Mac HFS                 48478289   49747832    1269544 D Mac HFS                 48478354   49747897    1269544 D Mac HFS                 48478427   49747970    1269544 D Mac HFS                 48478492   49748035    1269544 D Mac HFS                 48478589   49748132    1269544 D Mac HFS                 48478654   49748197    1269544 D Mac HFS                 48478743   49748286    1269544 D Mac HFS                 48478808   49748351    1269544 D Mac HFS                 48478873   49748416    1269544 D Mac HFS                 48478938   49748481    1269544 D Mac HFS                 48479011   49748554    1269544 D Mac HFS                 49740348   51009891    1269544 D MS Data                 49741824  236976120  187234297 D Mac HFS                 56660182   65048791    8388610 [    D^A] D MS Data                 58187816  231575591  173387776 D MS Data                 63588352  236976127  173387776 D Mac HFS                 65048788   73437397    8388610 [    D^A] D MS Data                 76818403   76839141      20739 [NO NAME] D MS Data                 79218267   79224440       6174 D MS Data                 79224440   79230613       6174 [Boot] D MS Data                 98772888   98775767       2880 [EFISECTOR] D MS Data                140606385  141978368    1371984 [GW  ث݊  b~^dS D MS Data                140606386  141978369    1371984 [GW  ث݊  b~^dS D MS Data                141421187  141427360       6174 D MS Data                141427360  141433533       6174 [Boot] D MS Data                141427379  141433552       6174 D MS Data                141433552  141439725       6174 [Boot] D MS Data                141433571  141439744       6174 D MS Data                141439744  141445917       6174 [Boot] D MS Data                141448800  141451679       2880 [EFISECTOR] D MS Data                169453120  169455999       2880 [EFISECTOR] D Mac HFS                210210127  210276678      66552&gt;D Mac HFS                210276675  210343226      66552Structure: Ok.  Use Up/Down Arrow keys to select partition.Use Left/Right Arrow keys to CHANGE partition characteristics:                P&#x3D;Primary  D&#x3D;DeletedKeys A: add partition, L: load backup, T: change type,      Enter: to continueHFS blocksize&#x3D;1024, 34 MB / 32 MiB

Loner T · Answer

You have a gap between these start/end blocks.49740352   13848000       Please look in this partitionD MS Data                 49741824  236976120  187234297Please do not use left/right arrow/cursor keys. Scroll down to this partition and use &#x27;P&#x27; to list files.

Xegony42 · Answer

Okay it looks like the files and disk that is missing.  Thanks! How do I get it back so I can select it on boot?TestDisk 7.0-WIP, Data Recovery Utility, October 2014Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.org     MS Data                 49741824  236976120  187234297Directory /&gt;dr-xr-xr-x     0     0         0 21-Nov-2014 14:53 . dr-xr-xr-x     0     0         0 21-Nov-2014 14:53 .. dr-xr-xr-x     0     0         0 24-Dec-2010 16:08 $AVG dr-xr-xr-x     0     0         0 24-Sep-2013 08:44 $Recycle.Bin dr-xr-xr-x     0     0         0 10-Nov-2011 19:58 .Trashes dr-xr-xr-x     0     0         0 10-Nov-2011 19:58 .fseventsd dr-xr-xr-x     0     0         0 14-Oct-2014 17:35 Boot dr-xr-xr-x     0     0         0  4-Feb-2011 15:50 CISCO64BIT dr-xr-xr-x     0     0         0 19-Nov-2014 16:59 Config.Msi dr-xr-xr-x     0     0         0  2-Jul-2013 17:56 Expat Shield dr-xr-xr-x     0     0         0 28-May-2014 02:30 GRLAWBKUP dr-xr-xr-x     0     0         0 21-Dec-2010 20:20 Intel dr-xr-xr-x     0     0         0 22-Dec-2010 11:07 MSOCache dr-xr-xr-x     0     0         0 29-Nov-2012 21:09 MacFan dr-xr-xr-x     0     0         0 22-Dec-2010 17:39 Music dr-xr-xr-x     0     0         0 29-Nov-2012 22:33 NVIDIA dr-xr-xr-x     0     0         0 13-Jul-2009 20:20 PerfLogs dr-xr-xr-x     0     0         0 17-Nov-2014 16:58 Program Files dr-xr-xr-x     0     0         0 17-Nov-2014 16:59 Program Files (x86) dr-xr-xr-x     0     0         0 17-Nov-2014 17:00 ProgramData dr-xr-xr-x     0     0         0 21-Dec-2010 20:13 Recovery dr-xr-xr-x     0     0         0  4-Dec-2014 17:21 System Volume Information dr-xr-xr-x     0     0         0 24-Sep-2013 08:44 Users dr-xr-xr-x     0     0         0 21-Nov-2014 14:53 Windows dr-xr-xr-x     0     0         0  7-Oct-2013 16:34 found.000 -r--r--r--     0     0         8 21-Nov-2014 14:53 ..:^EC0B21842-99B8-46E2-A991 -r--r--r--     0     0         8 21-Nov-2014 14:53 .:^EC0B21842-99B8-46E2-A991- -r--r--r--     0     0      6148  2-Nov-2011 12:16 .DS_Store -r--r--r--     0     0        64 10-Nov-2011 19:58 .Trashes:AFP_AfpInfo -r--r--r--     0     0      1024 26-Apr-2014 09:27 .rnd -r--r--r--     0     0      8192 22-Dec-2010 04:04 BOOTSECT.BAK -r--r--r--     0     0       508 10-Aug-2013 10:24 CKINFO.TXT -r--r--r--     0     0       355  8-Dec-2013 08:16 Computer - Shortcut.lnk -r--r--r--     0     0      2058 27-Apr-2014 04:05 RHDSetup.log -r--r--r--     0     0     41472 17-Apr-2011 09:33 Thumbs.db -r--r--r--     0     0         0 17-Apr-2011 09:33 Thumbs.db:encryptable -r--r--r--     0     0     46841 24-Jun-2011 21:46 bookmarks-2011-06-24.json -r--r--r--     0     0    383786 20-Nov-2010 04:40 bootmgr -r--r--r--     0     0    132547  6-Jan-2013 22:37 formatter.log -r--r--r--     0     0 1401917440  5-Dec-2014 01:33 hiberfil.sys -r--r--r--     0     0 1869225984  5-Dec-2014 01:33 pagefile.sys -r--r--r--     0     0    341415  7-Oct-2013 09:37 synergy.log -r--r--r--     0     0       251  3-Jun-2012 19:16 user.js                                                   NextUse Right to change directory, h to hide Alternate Data Stream    q to quit, : to select the current file, a to select all files    C to copy the selected files, c to copy the current file

Loner T · Answer

This is a table that I use to validate the Testdisk output to be reasonable. Using your valuesGPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartByte OffsetNTFS SizeNTFS End48470808126954449740352497418241472187234297236976121The 1472 byte offset is good news. You will not lose any other partition. I have plugged in the values for your specific configuration in the following steps.If you see any error messages during the following steps, please stop and post back here with the error message.Rebuild using start/end offsets from Testdisk DeepSearch using GPT Fdisk (http://sourceforge.net/projects/gptfdisk/)Sudo gdisk /dev/rdisk0P  (print the full list of parts)D  (delete)4  (part 4)N  (new part)4   (part 4)49741824 - Start offset in bytes  (start point for Bootcamp part) +187234297(Size offset as opposed to End offset)0700     (Windows part type)P           (print list of all parts just to see what changes will be made)W         (Write the new GPT)Y           (Yes! really write the new GPT)  This will delete and re-write the GPT partition info for /dev/disk0s4. Rebuild MBR to match the new GPT information thus resetting the Hybrid MBRSudo gdisk /dev/disk0P  (Print list of parts)R   (Recover)H (chooses Hybrid)Partitions numbers to be hybridized: 2 3 4Y (Good for GRUB question)N (part 2 flag)N (part 3 flag)Y  (part 4 flag make bootable partition)W  (Write the new MBR)Y    (Yes! write the new MBR)RebootTest 1 - Does Bootcamp Volume show up in Finder?Test 2 - Can you see files in Bootcamp Volume?Test 3 - Can you select Bootcamp in System Preferences -&gt; Startup Disk?Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.If you see a hanging underline cursor at the top left on a black screen, and it does not proceed further, you may need Windows Startup Repair or a tool called EasyBCD.

mmcrocetti · Answer

Hi Loner T,I have a similiar problem. I have a 2009 iMac that was running Mountain Lion on one partition, Snow leopard on another and then Windows 7 on the last bootcamp partition. However, when I upgraded to OS X Yosemite it completely deleted my bootcamp portion (so I thought). I then followed a few of your steps from the forum and I was able to get Windows to show up when I re booted and held the option key. However, when i click it it just loads a black screen.... I have attached the images for your terminal commands. let me know what to do next and if you think i will be able to get my partition and files back... I have some very important oxygen forensics files on that windows partition that i really need back.Thank you and best regards,

Loner T · Answer

I will ignore Disk1 (Stellar...).1. Is Disk2 an internal disk or an external disk? What version of OS X is on it?2. Please post the output of sudo dd if&#x3D;/dev/rdisk0s5 count&#x3D;1 2&gt;/dev/null | hexdump -C.3. Can you start a new thread/discussion and post some of these screens on the new thread, so it will avoid confusion later?

mmcrocetti · Answer

yes I will do that. Thank you so much for the quick reply!I believe that disk0s2 is my main partition of mac running osx Yosemite. Thats the one I upgraded and the original one on the computer.

mmcrocetti · Answer

Also am I putting this in terminal correctly as nothing is coming out after i press enter?

mmcrocetti · Answer

My link to new discussion for you as well.http://discussions.apple.com/thread/6770248

GPT 3 Start	GPT 3 Size	GPT 3 End	NTFS Start	Byte Offset	NTFS Size	NTFS End
48470808	1269544	49740352	49741824	1472	187234297	236976121