Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Windows 7 lost after Yosemite upgrade

lanke@~$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *251.0 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_CoreStorage 89.6 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 80.1 GB disk0s4

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS Macintosh HD *89.2 GB disk1

Logical Volume on disk0s2

C8BA6651-3B4C-4F42-8E28-82036D09AF75

Unencrypted

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: FDisk_partition_scheme *500.1 GB disk2

1: Windows_NTFS MULTIBOOT 14.0 GB disk2s1

2: Windows_NTFS temp 111.0 GB disk2s2

3: Windows_NTFS TEMP 46.9 GB disk2s5

4: Windows_NTFS INSTALLER 161.7 GB disk2s6

5: Windows_NTFS BK 166.4 GB disk2s7



lanke@~$ diskutil cs list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group 5B9F8ED3-839A-4C57-8844-CC960B3201F0

=========================================================

Name: Macintosh HD

Status: Online

Size: 89591500800 B (89.6 GB)

Free Space: 18993152 B (19.0 MB)

|

+-< Physical Volume 6695D0C4-EA6E-406F-AFE2-ED9EF070001F

| ----------------------------------------------------

| Index: 0

| Disk: disk0s2

| Status: Online

| Size: 89591500800 B (89.6 GB)

|

+-> Logical Volume Family 90E7C270-DE32-4088-97DF-478CA563ABAB

----------------------------------------------------------

Encryption Status: Unlocked

Encryption Type: None

Conversion Status: NoConversion

Conversion Direction: -none-

Has Encrypted Extents: No

Fully Secure: No

Passphrase Required: No

|

+-> Logical Volume C8BA6651-3B4C-4F42-8E28-82036D09AF75

---------------------------------------------------

Disk: disk1

Status: Online

Size (Total): 89220186112 B (89.2 GB)

Conversion Progress: -none-

Revertible: Yes (no decryption required)

LV Name: Macintosh HD

Volume Name: Macintosh HD

Content Hint: Apple_HFS

lanke@~$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 490234751

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 174983400 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

175393040 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

176662576 157048784

333711360 156522496 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

490233856 863

490234719 32 Sec GPT table

490234751 1 Sec GPT header

lanke@~$

lanke@~$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AC 1023 254 63 - 1023 254 63 [ 409640 - 174983400] <Unknown ID>

3: AB 1023 254 63 - 1023 254 63 [ 175393040 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 333711360 - 156522496] Win95 FAT32L

MacBook Pro with Retina display

Posted on Apr 19, 2015 7:08 PM

Reply
30 replies

Apr 19, 2015 7:10 PM in response to 1234567Lanke

lanke@~$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000 d5 f3 b6 4f dd d0 f7 21 e3 a7 41 e8 fc 90 f5 d3 |...O...!..A.....|

00000010 24 f4 7e c8 fc 69 11 ba 3f 6d b1 b7 47 45 0c a0 |$.~..i..?m..GE..|

00000020 0e a0 36 aa 13 a8 1d b2 0d b2 33 f6 37 9d 20 b2 |..6.......3.7. .|

00000030 82 ba a3 7a aa de de 0e ea f5 86 1f 44 27 3d 41 |...z........D'=A|

00000040 74 45 4f f6 00 f5 47 f6 c5 ea 81 57 75 57 83 40 |tEO...G....WuW.@|

00000050 11 87 88 2c a2 c1 a1 47 44 26 d1 b0 d0 25 22 9b |...,...GD&...%".|

00000060 68 24 6a b4 1a eb ad a2 31 a8 b1 6a bc b7 8b c6 |h$j.....1..j....|

00000070 85 7e 11 19 46 13 43 c7 88 2c a3 29 a1 67 44 a6 |.~..F.C..,.).gD.|

00000080 d1 47 51 d7 e8 33 d0 34 35 13 34 0b 49 fc b9 b7 |.GQ..3.45.4.I...|

00000090 8f a6 45 fd 23 32 90 66 87 0e 12 59 48 f3 51 5f |..E.#2.f...YH.Q_|

000000a0 aa 45 de 46 5a 88 5a a4 96 78 2b 69 71 e8 25 91 |.E.FZ.Z..x+iq.%.|

000000b0 99 b4 34 74 93 c8 4e 5a 11 fa 49 64 28 ad 0e 1d |..4t..NZ..Id(...|

000000c0 a5 75 51 4f 69 9d da 84 7d 1d d6 0f a0 8d c8 75 |.uQOi...}......u|

000000d0 a1 b7 44 e6 d2 e6 d0 5d 22 7b 69 4b e8 2f 91 c1 |..D....]"{iK./..|

000000e0 b4 15 b5 5d ed f4 26 d3 0e d4 4e b5 db 1b 4d bb |...]..&...N...M.|

000000f0 42 a7 89 ac a6 bd a1 d7 44 66 d3 c1 d0 6d 22 bb |B.......Df...m".|

00000100 e9 8f a8 df 74 02 74 5c 9d 06 9d 41 12 9f f5 c6 |....t.t\...A....|

00000110 d3 f1 a8 f3 44 d6 d3 f9 d0 7b 22 f3 e9 72 e8 3e |....D....{"..r.>|

00000120 91 fd 74 1d 75 43 dd f2 16 d4 4d d4 2d 75 c7 db |..t.uC....M.-u..|

00000130 50 b7 43 1f 8a 8c a8 7b a1 13 45 56 d4 a3 d0 8b |P.C....{..EV....|

00000140 22 33 ea 69 d4 8d 7a 09 7a a1 5e 83 fe 45 12 33 |"3.i..z.z.^..E.3|

00000150 4d b6 d4 0b f5 3f 5f 4a 20 23 ce 94 d1 01 f6 88 |M....?_J #......|

00000160 37 45 e6 54 ac a8 3b 15 0f 19 f1 a7 12 e9 24 d8 |7E.T..;.......$.|

00000170 63 1c aa 64 a0 a4 3a 25 28 b9 4e 05 4a 0d a6 93 |c..d..:%(.N.J...|

00000180 54 3a 8d 37 ab 88 d3 e2 34 c6 b0 4a 0f 4a a7 33 |T:.7....4..J.J.3|

00000190 81 32 e8 cc a0 2c 60 3a c9 ac b3 7a ef 8a 38 1b |.2...,`:...z..8.|

000001a0 4e 23 fe 15 19 58 d9 43 07 8b 2c ac dc a1 87 45 |N#...X.C..,....E|

000001b0 26 56 7e 54 41 5d d8 1b 59 85 50 85 75 51 6f 66 |&V~TA]..Y.P.uQof|

000001c0 15 09 dd 2c b2 b3 8a 87 7e 16 19 5a a5 43 47 8b |...,....~..Z.CG.|

000001d0 2c ad f2 51 4f ab 0a a8 b2 ae 0e aa 81 24 7e db |,..QO........$~.|

000001e0 9b 5b 95 df 70 b7 6a 21 23 fe 56 3d dd 10 7b 8c |.[..p.j!#.V=..{.|

000001f0 c3 d5 18 d4 48 37 03 35 d1 cd 41 2d c0 74 d2 5c |....H7.5..A-.t.\|

00000200

Apr 19, 2015 7:51 PM in response to 1234567Lanke

Can you use Bootcamp partition missing after yosemite installation as a reference and get started with a Testdisk scan? The gap between GPT3 and GPT4 is most likely where you will find a lost NTFS header.


Initial Testdisk UI steps are shown here - https://imgur.com/a/PjmnK.


You are looking for a MS Data entry in Testdisk which looks similar to the following when you use 'P - List Files'.


User uploaded file

Apr 21, 2015 4:28 AM in response to Loner T

This is what I got after scanning:


TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org


Disk /dev/rdisk0 - 251 GB / 233 GiB - 490234752 sectors (RO)


The harddisk (251 GB / 233 GiB) seems too small! (< 760 GB / 708 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...


The following partitions can't be recovered:

Partition Start End Size in sectors

Linux Swap 230235432 1450025831 1219790400

Mac HFS 251856253 1485800830 1233944578

MS Data 452212736 492056575 39843840

MS Data 452212856 492056695 39843840

MS Data 452212976 492056815 39843840

MS Data 452213096 492056935 39843840

MS Data 452213216 492057055 39843840

MS Data 452213344 492057183 39843840

MS Data 452213488 492057327 39843840

> MS Data 452213616 492057455 39843840


[ Continue ]

ext4 blocksize=4096 Large_file Sparse_SB Recover, 20 GB / 18 GiB

Apr 21, 2015 4:34 AM in response to 1234567Lanke

Here is part of the log of Testdisk:

15758 FAT12 at 384398024/0/1

15759 MS Data 384398024 384400903 2880 [EFISECTOR]

15760 FAT12, blocksize=512, 1474 KB / 1440 KiB

15761 NTFS at 385092352/0/1

15762 heads/cylinder 16 (NTFS) != 1 (HD)

15763 sect/track 2 (NTFS) != 1 (HD)

15764 filesystem size 6174

15765 sectors_per_cluster 1

15766 mft_lcn 2058

15767 mftmirr_lcn 5162

15768 clusters_per_mft_record 2

15769 clusters_per_index_record 8

15770 MS Data 385086179 385092352 6174

15771 NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

15772 NTFS at 385092352/0/1

15773 heads/cylinder 16 (NTFS) != 1 (HD)

15774 sect/track 2 (NTFS) != 1 (HD)

15775 filesystem size 6174

15776 sectors_per_cluster 1

15777 mft_lcn 2058

15778 mftmirr_lcn 5162

15779 clusters_per_mft_record 2

15780 clusters_per_index_record 8

15781 MS Data 385092352 385098525 6174 [Boot]

15782 NTFS, blocksize=512, 3161 KB / 3087 KiB

15783

15784 recover_EXT2: s_block_group_nr=0/1, s_mnt_count=4/4294967295, s_blocks_per_group=32768, s_inodes_per_group=6400

15785 recover_EXT2: s_blocksize=4096

15786 recover_EXT2: s_blocks_count 51200

15787 recover_EXT2: part_size 409600

15788 MS Data 385534424 385944023 409600

15789 ext4 blocksize=4096 Large_file Sparse_SB Recover, 209 MB / 200 MiB

15790 Linux Swap 388714456 388714471 16

15791 SWAP2 version 0, pagesize=8192, 8192 B

15792 Linux Swap 388714464 390807503 2093040

15793 SWAP2 version 1, pagesize=4096, 1071 MB / 1021 MiB

15794

15795 recover_EXT2: s_block_group_nr=0/151, s_mnt_count=3/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192

15796 recover_EXT2: s_blocksize=4096

15797 recover_EXT2: s_blocks_count 4980480

15798 recover_EXT2: part_size 39843840

15799 MS Data 389049792 428893631 39843840

15800 ext4 blocksize=4096 Large_file Sparse_SB Recover, 20 GB / 18 GiB



29253 NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

29254 MS Data 384376584 384382757 6174 [Boot]

29255 NTFS, blocksize=512, 3161 KB / 3087 KiB

29256 MS Data 384376603 384382776 6174

29257 NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

29258 MS Data 384382776 384388949 6174 [Boot]

29259 NTFS, blocksize=512, 3161 KB / 3087 KiB

29260 MS Data 384382795 384388968 6174

29261 NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

29262 MS Data 384388968 384395141 6174 [Boot]

29263 NTFS, blocksize=512, 3161 KB / 3087 KiB

29264 MS Data 384398024 384400903 2880 [EFISECTOR]

29265 FAT12, blocksize=512, 1474 KB / 1440 KiB

29266 MS Data 385086179 385092352 6174

29267 NTFS found using backup sector, blocksize=512, 3161 KB / 3087 KiB

29268 MS Data 385092352 385098525 6174 [Boot]

29269 NTFS, blocksize=512, 3161 KB / 3087 KiB

29270 MS Data 385534424 385944023 409600

29271 ext4 blocksize=4096 Large_file Sparse_SB Recover, 209 MB / 200 MiB

29272 Linux Swap 388714456 388714471 16

29273 SWAP2 version 0, pagesize=8192, 8192 B

29274 Linux Swap 388714464 390807503 2093040

29275 SWAP2 version 1, pagesize=4096, 1071 MB / 1021 MiB

29276 MS Data 389049792 428893631 39843840

Apr 21, 2015 4:40 PM in response to 1234567Lanke

I got multiple "Boot" section:


D MS Data 383491552 383901151 409600

D MS Data 383491624 383901223 409600

D MS Data 383491712 383901311 409600

D MS Data 383492040 383901639 409600

D MS Data 383492168 383901767 409600

D MS Data 384370411 384376584 6174

D MS Data 384376584 384382757 6174 [Boot]

D MS Data 384376603 384382776 6174

D MS Data 384382776 384388949 6174 [Boot]

D MS Data 384382795 384388968 6174

D MS Data 384388968 384395141 6174 [Boot]

D MS Data 384398024 384400903 2880 [EFISECTOR]

D MS Data 385086179 385092352 6174

D MS Data 385092352 385098525 6174 [Boot]

D MS Data 385534424 385944023 409600

D Linux Swap 388714456 388714471 16

D Linux Swap 388714464 390807503 2093040

Windows 7 lost after Yosemite upgrade

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.