Windows partition disappeared after installing Yosemite

Question

Level 1

0 points

Windows partition disappeared after installing Yosemite

I can no longer access the Windows installation in Bootcamp and it is imperative that I recover it.

I know I'm not the only one who has this problem. The NTFS header for the Windows partition has been overwritten or perhaps changed.

Is it an actual NTFS header? Or could it be something different that Bootcamp makes.

Below is the output from the various programs available to gather information:

$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *500.3 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_CoreStorage 450.0 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 20.0 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS Macintosh HD *449.7 GB disk1

Logical Volume on disk0s2

B15E4682-2AEB-49E9-9D39-D908D554CACE

Unencrypted

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *209.7 MB disk2

1: Apple_HFS BlueStacks App Player 209.7 MB disk2s1

———————————————————————

Last login: Mon Feb 23 22:19:24 on ttys001

$ diskutil cs list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group 7AA9866D-5984-4A3C-9888-EDD350B39CA4

=========================================================

Name: Macintosh HD

Status: Online

Size: 450041667584 B (450.0 GB)

Free Space: 18931712 B (18.9 MB)

|

+-< Physical Volume 622B0FAB-B803-46DD-A0DE-EC6B66DDCBBF

| ----------------------------------------------------

| Index: 0

| Disk: disk0s2

| Status: Online

| Size: 450041667584 B (450.0 GB)

|

+-> Logical Volume Family 32A502EA-103F-4095-A501-C16E8E64A30D

----------------------------------------------------------

Encryption Status: Unlocked

Encryption Type: None

Conversion Status: NoConversion

Conversion Direction: -none-

Has Encrypted Extents: No

Fully Secure: No

Passphrase Required: No

|

+-> Logical Volume B15E4682-2AEB-49E9-9D39-D908D554CACE

---------------------------------------------------

Disk: disk1

Status: Online

Size (Total): 449670414336 B (449.7 GB)

Conversion Progress: -none-

Revertible: Yes (no decryption required)

LV Name: Macintosh HD

Volume Name: Macintosh HD

Content Hint: Apple_HFS

————————————————————————

$ sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 60821/255/63 [977105060 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AC 1023 254 63 - 1023 254 63 [ 409640 - 878987632] <Unknown ID>

3: AB 1023 254 63 - 1023 254 63 [ 879397272 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 938043392 - 39061504] Win95 FAT32L

———————————————————————————

$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500277790720; sectorsize=512; blocks=977105060

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 977105059

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 878987632 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

879397272 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

880666808 57376584

938043392 39061504 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

977104896 131

977105027 32 Sec GPT table

977105059 1 Sec GPT header

————————————————————————————————

Posted on Mar 10, 2015 4:32 AM

Reply

Answer 1

Loner T

Level 9

59,471 points

Mar 10, 2015 4:36 AM in response to Henk de G

Please post the output of

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

to dump the NTFS header.

The Gap between GPT3 and GPT4 (in gpt output) is where your 'lost' NTFS partition should be. Can you use Bootcamp partition missing after yosemite installation as a reference and download Testdisk and GPT Fdisk and get started with Testdisk scan?

Reply

Answer 2

Henk de G Author

Level 1

0 points

Mar 10, 2015 6:48 AM in response to Loner T

Loner,

The output is

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e |...<?xml version|

00000010 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d |="1.0" encoding=|

00000020 22 55 54 46 2d 38 22 3f 3e 0d 0a 3c 61 73 73 65 |"UTF-8"?>..<asse|

00000030 6d 62 6c 79 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a |mbly xmlns="urn:|

00000040 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 |schemas-microsof|

00000050 74 2d 63 6f 6d 3a 61 73 6d 2e 76 33 22 20 6d 61 |t-com:asm.v3" ma|

00000060 6e 69 66 65 73 74 56 65 72 73 69 6f 6e 3d 22 31 |nifestVersion="1|

00000070 2e 30 22 20 63 6f 70 79 72 69 67 68 74 3d 22 43 |.0" copyright="C|

00000080 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 |opyright (c) Mic|

00000090 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 |rosoft Corporati|

000000a0 6f 6e 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 |on. All Rights R|

000000b0 65 73 65 72 76 65 64 2e 22 3e 0d 0a 20 20 3c 61 |eserved.">.. <a|

000000c0 73 73 65 6d 62 6c 79 49 64 65 6e 74 69 74 79 20 |ssemblyIdentity |

000000d0 6e 61 6d 65 3d 22 4d 69 63 72 6f 73 6f 66 74 2d |name="Microsoft-|

000000e0 57 69 6e 64 6f 77 73 2d 49 45 2d 41 64 6d 69 6e |Windows-IE-Admin|

000000f0 4b 69 74 4d 6f 73 74 46 69 6c 65 73 22 20 76 65 |KitMostFiles" ve|

00000100 72 73 69 6f 6e 3d 22 38 2e 30 2e 37 36 30 31 2e |rsion="8.0.7601.|

00000110 31 37 35 31 34 22 20 70 72 6f 63 65 73 73 6f 72 |17514" processor|

00000120 41 72 63 68 69 74 65 63 74 75 72 65 3d 22 61 6d |Architecture="am|

00000130 64 36 34 22 20 6c 61 6e 67 75 61 67 65 3d 22 6e |d64" language="n|

00000140 65 75 74 72 61 6c 22 20 62 75 69 6c 64 54 79 70 |eutral" buildTyp|

00000150 65 3d 22 72 65 6c 65 61 73 65 22 20 70 75 62 6c |e="release" publ|

00000160 69 63 4b 65 79 54 6f 6b 65 6e 3d 22 33 31 62 66 |icKeyToken="31bf|

00000170 33 38 35 36 61 64 33 36 34 65 33 35 22 20 76 65 |3856ad364e35" ve|

00000180 72 73 69 6f 6e 53 63 6f 70 65 3d 22 6e 6f 6e 53 |rsionScope="nonS|

00000190 78 53 22 20 2f 3e 0d 0a 20 20 3c 64 65 70 65 6e |xS" />.. <depen|

000001a0 64 65 6e 63 79 20 64 69 73 63 6f 76 65 72 61 62 |dency discoverab|

000001b0 6c 65 3d 22 6e 6f 22 20 72 65 73 6f 75 72 63 65 |le="no" resource|

000001c0 54 79 70 65 3d 22 52 65 73 6f 75 72 63 65 73 22 |Type="Resources"|

000001d0 3e 0d 0a 20 20 20 20 3c 64 65 70 65 6e 64 65 6e |>.. <dependen|

000001e0 74 41 73 73 65 6d 62 6c 79 3e 0d 0a 20 20 20 20 |tAssembly>.. |

000001f0 20 20 3c 61 73 73 65 6d 62 6c 79 49 64 65 6e 74 | <assemblyIdent|

00000200

gr Henk

Reply

Answer 3

Loner T

Level 9

59,471 points

Mar 10, 2015 6:54 AM in response to Henk de G

The NTFS header is in the gap between GPT3 and GPT4. Please use the reference article and start with Testdisk to search for the NTFS partition.

Please see http://imgur.com/a/PjmnK for the Testdisk UI screens. Once Deeper search is complete look for a valid partition as shown in the reference thread.

Reply

Answer 4

Henk de G Author

Level 1

0 points

Mar 11, 2015 3:50 AM in response to Loner T

Loner,

This is the testdisk output,

Thanks for the help

Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)

The harddisk (500 GB / 465 GiB) seems too small! (< 520 GB / 484 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 977104895 1016166398 39061504

Mac HFS 977105020 978374555 1269536

[ Continue ]

NTFS, blocksize=4096, 19 GB / 18 GiB

Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)

Partition Start End Size in sectors

>P EFI System 40 409639 409600 [EFI]

D Mac HFS 409640 878672167 878262528

D MS Data 812965896 895035392 82069497

D Mac HFS 879397272 880666807 1269536

D MS Data 895035392 977104888 82069497

D MS Data 938043392 977104895 39061504

D Mac HFS 975835488 977105023 1269536

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

FAT32, blocksize=512, 209 MB / 200 MiB

TestDisk 7.0-WIP, Data Recovery Utility, January 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)

The harddisk (500 GB / 465 GiB) seems too small! (< 20 TB / 18 TiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> Mac HFS 122042890 1000305417 878262528

Mac HFS 122275501 1000538028 878262528

Mac HFS 135863084 1014125611 878262528

Mac HFS 136179124 1014441651 878262528

Mac HFS 201770536 1080033063 878262528

Linux Swap 278595612 29840050187 29561454576

Linux Swap 278595620 2121928843 1843333224

Mac HFS 282428808 1161416439 878987632

Linux Swap 399514848 39566563663 39167048816

Mac HFS 656249768 1534512295 878262528

Mac HFS 713707464 1592695095 878987632

Mac HFS 878672164 1756934691 878262528

MS Data 954014888 993076391 39061504

MS Data 977104888 1059174384 82069497

MS Data 977104895 1016166398 39061504

> Mac HFS 977105020 978374555 1269536

Reply

Answer 5

Loner T

Level 9

59,471 points

Mar 11, 2015 6:43 AM in response to Henk de G

The last screen shot should let you press Enter to Continue and allow you run a Deeper Search.

The following table needs the correct NTFS Size/Start to work and allow the next steps for recovery.

GPT 3 Start	GPT 3 Size	GPT 3 End	NTFS Start	Sector Offset	NTFS Size	NTFS End
879397272	1269536	880666808	880666808	0	39061504	919728312

Reply

Answer 6

Imfao

Level 1

12 points

Mar 11, 2015 10:22 AM in response to Loner T

Hey Loner T please help me out i am having problems opening my bootcamp.

check out my thread please.

Missing Operating system after Yosemite update

Reply

Answer 7

Henk de G Author

Level 1

0 points

Mar 12, 2015 3:25 PM in response to Loner T

Loner,

It seems that this one contains the right information?

TestDisk 7.0-WIP, Data Recovery Utility, January 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

Disk /dev/rdisk0 - 500 GB / 465 GiB - 977105060 sectors (RO)

Partition Start End Size in sectors

P EFI System 40 409639 409600 [EFI]

D Mac HFS 409640 878672167 878262528

D MS Data 812965896 895035392 82069497

D Mac HFS 879397272 880666807 1269536

>D MS Data 895035392 977104888 82069497

D MS Data 938043392 977104895 39061504

D Mac HFS 975835488 977105023 1269536

Structure: Ok. Use Up/Down Arrow keys to select partition.

Use Left/Right Arrow keys to CHANGE partition characteristics:

P=Primary D=Deleted

Keys A: add partition, L: load backup, T: change type, P: list files,

Enter: to continue

NTFS, blocksize=4096, 42 GB / 39 GiB

TestDisk 7.0-WIP, Data Recovery Utility, January 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

MS Data 895035392 977104888 82069497

Directory /

>dr-xr-xr-x 0 0 0 2-Feb-2015 12:05 .

dr-xr-xr-x 0 0 0 2-Feb-2015 12:05 ..

dr-xr-xr-x 0 0 0 16-Dec-2013 15:24 $Recycle.Bin

dr-xr-xr-x 0 0 0 2-Feb-2015 12:05 20256d85164f70cdde

dr-xr-xr-x 0 0 0 10-Nov-2014 14:02 8bbf47d929f2dce6cd6a5242

dr-xr-xr-x 0 0 0 13-Jan-2015 14:12 Boot

dr-xr-xr-x 0 0 0 16-Dec-2013 14:14 Intel

dr-xr-xr-x 0 0 0 14-Jul-2009 05:20 PerfLogs

dr-xr-xr-x 0 0 0 10-Nov-2014 14:31 Program Files

dr-xr-xr-x 0 0 0 2-Feb-2015 11:50 Program Files (x86)

dr-xr-xr-x 0 0 0 2-Feb-2015 11:22 ProgramData

dr-xr-xr-x 0 0 0 16-Dec-2013 14:08 Recovery

dr-xr-xr-x 0 0 0 2-Feb-2015 09:11 System Volume Information

dr-xr-xr-x 0 0 0 16-Dec-2013 14:12 Users

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

Reply

Answer 8

Loner T

Level 9

59,471 points

Mar 12, 2015 3:54 PM in response to Henk de G

There is a significant gap if you look at the Sector Offset value (~7GB).

GPT 3 Start	GPT 3 Size	GPT 3 End	NTFS Start	Sector Offset	NTFS Size	NTFS End
879397272	1269536	880666808	895035392	14368584	82069497	977104889

Leave your Testdisk display and start a new Terminal Window. Please use the following steps. The 104 sector positive offset is a good sign.

You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message. The following steps have values from your Testdisk output (and you can verify) in Steps 7 and 8.

Rebuild GPT4 using start/end offsets

Sudo gdisk /dev/rdisk0
P (print the full list of parts)
D (delete)
4 (part 4)
N (new part)
4 (part 4)
895035392 - Start offset in bytes (start point for Bootcamp part)
+ 82069497 - (Size offset as opposed to End offset)
0700 (Windows part type)
P (print list of all parts just to see what changes will be made)
W (Write the new GPT)
Y (Yes! really write the new GPT)

This will delete and re-write the GPT partition info for /dev/disk0s4.

Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Use defaults for other questions (like partition codes). The only values that need modifications are the Boot flags and step 6. Accept all other defaults that Gdisk offers.

Sudo gdisk /dev/disk0
P (Print list of parts)
R (Recover)
H (chooses Hybrid)
Partitions numbers to be hybridized: 2 3 4
Y (Good for GRUB question)
N (part 2 boot flag)
N (part 3 boot flag)
Y (part 4 boot flag make NTFS bootable partition)
W (Write the new MBR)
Y (Yes! write the new MBR)
Reboot

Here is an example of the Q&A in the second set of commands.

Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): Y

Creating entry for GPT partition #2 (MBR partition #2)

Enter an MBR hex code (default AF): Press Enter/Return

Set the bootable flag? (Y/N): N

Creating entry for GPT partition #3 (MBR partition #3)

Enter an MBR hex code (default AB): Press Enter/Return

Set the bootable flag? (Y/N): N

Creating entry for GPT partition #4 (MBR partition #4)

Enter an MBR hex code (default 07): 07

Set the bootable flag? (Y/N): Y

Test 1 - Does Bootcamp Volume show up in Finder?

Test 2 - Can you see files in Bootcamp Volume?

Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

Reply

Answer 9

Henk de G Author

Level 1

0 points

Mar 13, 2015 4:42 AM in response to Loner T

Loner,

This is the question?

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 879397271 419.1 GiB AF05 Macintosh HD

3 879397272 880666807 619.9 MiB AB00 Recovery HD

4 895035392 977104888 39.1 GiB 0700 Microsoft basic data

Command (? for help): r

Recovery/transformation command (? for help): h

WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

just hit the Enter key at the below prompt and your MBR partition table will

be untouched.

Type from one to three GPT partition numbers, separated by spaces, to be

added to the hybrid MBR, in sequence: 2 3 4

Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): y

Creating entry for GPT partition #2 (MBR partition #2)

Enter an MBR hex code (default AF):

Set the bootable flag? (Y/N): n

Unused partition space(s) found. Use one to protect more partitions? (Y/N):

Reply

Answer 10

Loner T

Level 9

59,471 points

Mar 13, 2015 4:44 AM in response to Henk de G

Enter 'Y' and continue.

Reply

Answer 11

Henk de G Author

Level 1

0 points

Mar 13, 2015 5:47 AM in response to Loner T

after the steps

there was a bootcamp,

it was possible to select the bootcamp boot partition

after reboot no bootcamp partition

Reply

Answer 12

Loner T

Level 9

59,471 points

Mar 13, 2015 5:55 AM in response to Henk de G

Can you post the output of sudo fdisk /dev/disk0?

Reply

Answer 13

Henk de G Author

Level 1

0 points

Mar 13, 2015 6:33 AM in response to Loner T

Loner

Disk: /dev/disk0 geometry: 60821/255/63 [977105060 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 878987632] HFS+

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: EE 1023 254 63 - 1023 254 63 [ 879397272 - 97707788] <Unknown ID>

gr Henk

Reply

Answer 14

Loner T

Level 9

59,471 points

Mar 13, 2015 8:19 AM in response to Henk de G

Your MBR is incorrect. It should similar to the following.

sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 121643/255/63 [1954210120 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 54 16 [ 409640 - 1448624648] HFS+

3: AB 1023 54 17 - 1023 60 39 [1449034288 - 1269536] Darwin Boot

*4: 07 1023 87 51 - 1023 238 3 [1450305536 - 503904256] HPFS/QNX/AUX

Reply

Answer 15

Henk de G Author

Level 1

0 points

Mar 26, 2015 6:39 AM in response to Loner T

After having tried your tip from Mar 12, 2015 3:54 PM again I was able to see the partition and have successfully backed up. The OSX partition had been backed up previously. Everything is running smoothly again after a reformat and restoring the two partitions. Thank you so much for your help and patience.

Henk

Reply