jaggboy Author

Level 1

0 points

Corrupted Win7 Partition

Can someone help me recover my corrupted Win7 partition please?

Last login: Mon Jan 12 18:37:17 on console

diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 502.0 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 497.3 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: FDisk_partition_scheme *2.0 GB disk1

1: DOS_FAT_32 UNTITLED 2.0 GB disk1s1

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: GSP1RMCPRXFRER_EN_DVD *3.3 GB disk2

diskutil cs list

No CoreStorage logical volume groups found

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 980461752 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

980871392 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

982140928 971382784 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 980461752] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 980871392 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 982140928 - 971382784] HPFS/QNX/AUX

iMac (27-inch Mid 2010), OS X Yosemite (10.10.1)

Posted on Jan 12, 2015 5:02 PM

57 replies

jaggboy Author

Level 1

0 points

Jan 14, 2015 9:07 PM in response to jaggboy

Ah figured it out:

Last login: Mon Jan 12 18:37:17 on console

diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 502.0 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 497.3 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: FDisk_partition_scheme *2.0 GB disk1

1: DOS_FAT_32 UNTITLED 2.0 GB disk1s1

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: GSP1RMCPRXFRER_EN_DVD *3.3 GB disk2

diskutil cs list

No CoreStorage logical volume groups found

sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 980461752 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

980871392 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

982140928 971382784 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 980461752] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 980871392 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 982140928 - 971382784] HPFS/QNX/AUX

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 70 ff 77 b7 60 ff 71 b4 56 ff 68 af 4d ff 62 a8 |p.w.`.q.V.h.M.b.|

00000010 48 ff 65 a4 4b ff 5e 9b 48 ff f3 f7 f1 ff fd ff |H.e.K.^.H.......|

00000020 fc ff fd ff fc ff fd ff fc ff f7 fb f5 ff a4 c2 |................|

00000030 99 ff 66 9e 4e ff 69 a9 52 ff 6b ac 52 ff 6b ab |..f.N.i.R.k.R.k.|

00000040 51 ff 6a ab 50 ff 6b ae 52 ff 6e b2 55 ff 79 b9 |Q.j.P.k.R.n.U.y.|

00000050 62 ff 84 bf 6c ff 8e c3 79 ff a4 d3 92 ff a5 dc |b...l...y.......|

00000060 91 f5 44 71 2e bc 2f 38 2b 51 19 1e 18 0e 00 00 |..Dq../8+Q......|

00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

00000080 00 00 00 00 00 00 0a 0b 09 06 2b 32 2a 33 35 4d |..........+2*35M|

00000090 29 98 86 c5 71 e8 bb e3 ab ff 9c cc 89 ff 8d c2 |)...q...........|

000000a0 78 ff 81 bb 6a ff 78 b7 61 ff 71 b2 57 ff 68 ad |x...j.x.a.q.W.h.|

000000b0 4f ff 68 a8 4f ff 62 9c 4a ff f3 f7 f1 ff fd ff |O.h.O.b.J.......|

000000c0 fc ff fd ff fc ff d4 e2 cf ff 7a a8 68 ff 68 a2 |..........z.h.h.|

000000d0 53 ff 6b a8 54 ff 6d ab 53 ff 6b aa 51 ff 68 a8 |S.k.T.m.S.k.Q.h.|

000000e0 50 ff 69 aa 52 ff 70 b1 56 ff 77 b6 60 ff 84 bd |P.i.R.p.V.w.`...|

000000f0 6c ff 8c c1 77 ff 98 c9 85 ff b7 e0 a6 ff 83 c4 |l...w...........|

00000100 6c e8 35 4d 29 98 2b 32 2a 33 0a 0b 09 06 00 00 |l.5M).+2*3......|

00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

00000120 00 00 00 00 00 00 04 04 03 01 26 2c 23 1a 2f 3c |..........&,#./<|

00000130 2a 6c 58 8f 42 ce bc e8 ab fa ad d5 9d ff 98 c9 |*lX.B...........|

00000140 85 ff 8b bf 75 ff 83 bc 6b ff 78 b6 62 ff 71 b2 |....u...k.x.b.q.|

00000150 57 ff 72 b2 59 ff 69 a5 51 ff e1 eb dc ff ee f4 |W.r.Y.i.Q.......|

00000160 ea ff a5 c2 98 ff 6b a3 53 ff 71 af 5b ff 73 ae |......k.S.q.[.s.|

00000170 5b ff 71 ae 58 ff 6d ad 55 ff 6b ac 53 ff 6c ad |[.q.X.m.U.k.S.l.|

00000180 54 ff 70 b1 56 ff 77 b5 60 ff 81 bb 6a ff 8d c1 |T.p.V.w.`...j...|

00000190 78 ff 97 c8 85 ff ab d4 98 ff b9 e5 a8 fa 58 8c |x.............X.|

000001a0 41 ce 30 3c 2b 6c 26 2c 23 1a 04 04 03 01 00 00 |A.0<+l&,#.......|

000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

000001c0 00 00 00 00 00 00 00 00 00 00 13 16 10 09 34 3d |..............4=|

000001d0 31 3e 34 4d 28 a0 8c c5 77 e9 c2 e6 b4 fe aa d1 |1>4M(...w.......|

000001e0 98 ff 98 c7 85 ff 8e c1 79 ff 84 bc 6c ff 7b b7 |........y...l.{.|

000001f0 65 ff 78 b3 60 ff 77 b1 5e ff 6f ab 57 ff 6e a9 |e.x.`.w.^.o.W.n.|

00000200

Loner T

Level 9

59,536 points

Jan 15, 2015 4:39 AM in response to jaggboy

Can you provide a bit more detail on how you got to this point? Missing NTFS header, but matching GPT/MBR is very rare. A 'lost' NTFS partition on Yosemite comes with GPT gaps as clues.

jaggboy Author

Level 1

0 points

Jan 15, 2015 10:25 AM in response to Loner T

Yes I will try to remember every detail:

So my windows side was running out of space so I decided to expand it using this tool: http://www.partitionwizard.com/ following this instructional video: https://www.youtube.com/watch?v=WeKeawqxUa0. After that I used windows quite a while and it correctly showed my windows drive to the increased size. I don't think I ever went back into the mac side until one day I ran some anti-spyware programs spywarebot and malwarebytes on the windows side because my credit card numbers kept being used and I wondered if there was a keylogger on windows. After I did that I went back to the mac side to run updates and thats when I noticed my bootcamp was gone and I could not log back in. So I figured it was the partition extending I did way back. Tried everything to fix it running verify and repair but nothing. I then tried to login holding the alt option key at boot but only the mac drive showed. Even tried to get my IT guys at work to help but they were clueless. One upgraded my Mac from Lion to Mountain Lion to see if it would help. I then upgraded to Yosemite. And tried verifying and repairing again. I then restarted and pressed option key and my windows drive was showing but when I clicked on it I get the black screen saying: Missing OS.

jaggboy Author

Level 1

0 points

Jan 15, 2015 3:39 PM in response to jaggboy

Any other details you need Loner T?

Loner T

Level 9

59,536 points

Jan 15, 2015 4:51 PM in response to jaggboy

The Lion -> ML -> Yosemite upgrade may have compounded the problem. Testdisk may be the savior in this case.

The following entry looks interesting, but

D MS Data 134346752 1953523704 1819176953

This one shows a size of 867GB. Was your Windows partition shrunk?

jaggboy Author

Level 1

0 points

Jan 15, 2015 8:41 PM in response to Loner T

Shrunk no it was increased. I moved the entirety of the leftover mac side space to windows. But whats weird is it shows it still on the mac side.

Loner T

Level 9

59,536 points

Jan 16, 2015 5:40 AM in response to jaggboy

If the current size of 497GB is correct, then look for MS Data entries roughly the size of 971382784 sectors in Testdisk.

jaggboy Author

Level 1

0 points

Jan 16, 2015 12:24 PM in response to Loner T

But thats what I am saying. The current size of 497GB is not correct. I moved most of the space to the windows side where it is around 900GB now. But I will scan each MS Data entry...

Loner T

Level 9

59,536 points

Jan 17, 2015 6:45 AM in response to jaggboy

jaggboy wrote:

But thats what I am saying. The current size of 497GB is not correct. I moved most of the space to the windows side where it is around 900GB now. But I will scan each MS Data entry...

If that is the case, the following entry (of 867GB) may be of particular interest. Can you look into this one? Also, since your disk is a 1TB disk, you will lose Recovery HD and parts of Macintosh HD volumes if this turns out to be the correct entry. Recovery HD can be rebuilt by re-installing OS X once Windows has been restored. It should leave roughly 120+GB for OS X + Recovery HD.

D MS Data 134346752 1953523704 1819176953

jaggboy Author

Level 1

0 points

Jan 17, 2015 10:46 AM in response to Loner T

Thanks Loner T. Not worried about losing anything on the Mac side. 🙂 Scanning now...

jaggboy Author

Level 1

0 points

Jan 18, 2015 9:13 PM in response to jaggboy

Last login: Fri Jan 16 14:51:20 on console

TestDisk 7.0-WIP, Data Recovery Utility, December 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

No disk found.

TestDisk will try to restart itself using the sudo command to get

root (superuser) privileges.

sudo may ask your user password, it doesn't ask for the root password.

Usually there is no echo or '*' displayed when you type your password.

Password:

TestDisk 7.0-WIP, Data Recovery Utility, December 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

TestDisk 7.0-WIP, Data Recovery Utility, December 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

The harddisk (1000 GB / 931 GiB) seems too small! (< 8244231 TB / 7498084 TiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 589197655 2408374607 1819176953

MS Data 608449240 2427626192 1819176953

Mac HFS 980871388 1961333139 980461752

MS Data 1026846776 2846023728 1819176953

Mac HFS 1278484238 1994314511 715830274

Mac HFS 1364515067 4661906751 3297391685

Mac HFS 1364900009 4762958318 3398058310

Mac HFS 1365656154 2733684382 1368028229

MS Data 1533864209 16102014586812747 16102013052948538 [tem: %s

Mac HFS 1653462088 2056279113 402817026

jaggboy Author

Level 1

0 points

Jan 18, 2015 9:13 PM in response to jaggboy

Now which part to scan from here Loner T? Thanks!

Loner T

Level 9

59,536 points

Jan 19, 2015 12:55 PM in response to jaggboy

jaggboy wrote:

Last login: Fri Jan 16 14:51:20 on console

TestDisk 7.0-WIP, Data Recovery Utility, December 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

No disk found.

TestDisk will try to restart itself using the sudo command to get

root (superuser) privileges.

sudo may ask your user password, it doesn't ask for the root password.

Usually there is no echo or '*' displayed when you type your password.

Password:

TestDisk 7.0-WIP, Data Recovery Utility, December 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

TestDisk 7.0-WIP, Data Recovery Utility, December 2014

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

The harddisk (1000 GB / 931 GiB) seems too small! (< 8244231 TB / 7498084 TiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 589197655 2408374607 1819176953

MS Data 608449240 2427626192 1819176953

Mac HFS 980871388 1961333139 980461752

MS Data 1026846776 2846023728 1819176953

Mac HFS 1278484238 1994314511 715830274

Mac HFS 1364515067 4661906751 3297391685

Mac HFS 1364900009 4762958318 3398058310

Mac HFS 1365656154 2733684382 1368028229

MS Data 1533864209 16102014586812747 16102013052948538 [tem: %s

Mac HFS 1653462088 2056279113 402817026

Your GPT is

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 980461752 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

980871392 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

982140928 971382784 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

The first two MS Data entries seem to indicate a header within your OSX partition and may not be valid, but use 'P - List Files' to confirm. If the file system is damaged, ignore these two.

This one looks the most promising.

MS Data 1026846776 2846023728 1819176953

What happened to the following entry?

D MS Data 134346752 1953523704 1819176953

The following one is really damaged. It is also causing this message

MS Data 1533864209 16102014586812747 16102013052948538 [tem: %s

It is also causing the following message

The harddisk (1000 GB / 931 GiB) seems too small! (< 8244231 TB / 7498084 TiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

jaggboy Author

Level 1

0 points

Jan 20, 2015 4:54 PM in response to Loner T

Ok I will try these step by step. Here is the damaged one what do I do next?

Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

Partition Start End Size in sectors

>D EFI System 40 409639 409600 [EFI]

D EFI System 46 409645 409600 [EFI]

D Mac HFS 409640 980871391 980461752

D Mac HFS 440028 51640027 51200000

D Mac HFS 440181 51640180 51200000

D Mac HFS 440638 51640637 51200000

D Mac HFS 1167731 981629482 980461752

D Mac HFS 1167908 981629659 980461752

D Mac HFS 1168221 981629972 980461752

D Mac HFS 1168486 981630237 980461752

D Mac HFS 1168663 981630414 980461752

D Mac HFS 1168928 981630679 980461752

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

FAT32, blocksize=512, 209 MB / 200 MiB

Loner T

Level 9

59,536 points

Jan 20, 2015 5:40 PM in response to jaggboy

If you press Enter to Continue and use Deeper Search, but such a search can take a while.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Corrupted Win7 Partition