Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: Jack Dan
Jack Dan Author
User level: Level 1
0 points

Can`t boot Windows partition (not installed with bootcamp)

Hello everyone! I would appreciate your time. I will be persistent on recovering the partition and will commit to the work to be done.

I Partitioned a 500GB hard drive (slim HGST drive) in my macbook pro 5.1.

Two visible partitions were created.

Windows 7 Professional 64bits was installed (NTFS) over second partition, of ±450GB.

After installing Windows 7, installed OS X Leopard (HFS+)to the first partition ± 50GB.

They were working ok.

After installing the infamous hfs+ paragon driver on windows, things have changed.


Well, I can't boot windows since then. I erased Leopard because didn't give options on tools and Installed Yosemite as a clean install from a USB (entire procedure done with apple disk utility). Now I have: the Windows partition that I can see the greyed disk0s4 (was disk0s3) and the working Yosemite partition.


So here is my data:


Jacks-MacBook-Pro:~ jackdaniel$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 411648 - 103590112] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 104001760 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 105271296 - 871501824] Win95 FAT32L


================================================================================ ===============


Jacks-MacBook-Pro:~ jackdaniel$ sudo gdisk -l /dev/disk0

GPT fdisk (gdisk) version 1.0.0

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!


Partition table scan:


MBR: hybrid

BSD: not present

APM: not present

GPT: present


F

Found valid GPT with hybrid MBR; using GPT.

Disk /dev/disk0: 976773168 sectors, 465.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 5646FAF4-E9C6-4E5D-AAF3-2F03B78B31F3

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 976773134

Partitions will be aligned on 8-sector boundaries

Total free space is 2029 sectors (1014.5 KiB)


Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 411648 104001759 49.4 GiB AF00 Apple_HFS_Untitled_2

3 104001760 105271295 619.9 MiB AB00 Recovery HD

4 105271296 976773119 415.6 GiB 0700


The "hold option" function brings me Recovery HD and Yosemite options.

The rEFInd brings me Recovery HD, Yosemite and Windows options, but Windows stops probably when trying to call the boot loader, so stays black screen.

Anyway, I will need that data that was into Windows. Never would assume paragon hfs+ would harm my boot sectors.


Anyone?

MacBook Pro, OS X Yosemite (10.10)

Posted on May 17, 2015 10:09 AM

Reply
17 replies
User profile for user: Loner T
Loner T
User level: Level 9
59,471 points

May 17, 2015 10:40 AM in response to Jack Dan

rEFIt will not help you much anyway. I suggest removing it.


Can you post the output of


sudo gpt -vv -r show /dev/disk0


sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C


This will show the GPT (with sizes rather than end addresses) and the first block of the NTFS partition. The output will determine the next course of action.

Reply
User profile for user: Jack Dan
Jack Dan Author
User level: Level 1
0 points

May 17, 2015 10:54 AM in response to Loner T

Hello there Loner T! Thank you for the answer!


Here we go:


Jacks-MacBook-Pro:~ jackdaniel$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 2008

411648 103590112 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

104001760 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

105271296 871501824 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

976773120 15

976773135 32 Sec GPT table

976773167 1 Sec GPT header



================================================================================ ===============================



Jacks-MacBook-Pro:~ jackdaniel$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000 c3 55 8b ec ba f0 7f 00 00 33 c0 8b ca 66 23 4d |.U.......3...f#M|

00000010 0e 66 3b ca 0f 95 c0 5d c3 8b 55 08 8b 75 0c 0f |.f;....]..U..u..|

00000020 b6 0a 0f b6 06 2b c8 0f 85 3c fc 03 00 0f b6 4a |.....+...<.....J|

00000030 01 0f b6 46 01 e9 ba 02 00 00 55 8b ec 8b 45 0e |...F......U...E.|

00000040 ba f8 7f 00 00 66 23 c2 8d 4a f8 66 3b c1 0f 84 |.....f#..J.f;...|

00000050 c5 08 00 00 66 3b c2 0f 84 c9 08 00 00 33 c0 5d |....f;.......3.]|

00000060 c3 0f b7 32 66 85 f6 74 25 66 3b 31 75 20 83 c2 |...2f..t%f;1u ..|

00000070 02 83 c1 02 eb 15 55 8b ec 8b 45 10 85 c0 0f 84 |......U...E.....|

00000080 75 f7 04 00 8b 4d 0c 8b 55 08 56 48 75 d3 0f b7 |u....M..U.VHu...|

00000090 02 0f b7 09 2b c1 5e 5d c3 55 8b ec 8b 45 08 85 |....+.^].U...E..|

000000a0 c0 0f 84 66 7e 04 00 8b 40 10 5d c3 8b 4f fc 33 |...f~...@.]..O.3|

000000b0 c0 8b f8 e9 38 14 00 00 b8 08 80 0c 10 c3 8b 06 |....8...........|

000000c0 3b 02 0f 85 0f 18 00 00 33 c9 85 c9 0f 85 37 fd |;.......3.....7.|

000000d0 ff ff 8b 46 04 3b 42 04 0f 85 47 34 00 00 33 c9 |...F.;B...G4..3.|

000000e0 85 c9 0f 85 21 fd ff ff 8b 46 08 3b 42 08 0f 85 |....!....F.;B...|

000000f0 73 f0 03 00 33 c9 85 c9 0f 85 0b fd ff ff 8b 46 |s...3..........F|

00000100 0c 3b 42 0c 0f 85 96 49 00 00 33 c9 85 c9 0f 85 |.;B....I..3.....|

00000110 f5 fc ff ff 8b 46 10 3b 42 10 0f 85 01 f1 03 00 |.....F.;B.......|

00000120 33 c9 85 c9 0f 85 df fc ff ff 8b 46 14 3b 42 14 |3..........F.;B.|

00000130 0f 85 72 f1 03 00 33 c9 85 c9 0f 85 c9 fc ff ff |..r...3.........|

00000140 8b 46 18 3b 42 18 0f 85 e2 f1 03 00 33 c9 85 c9 |.F.;B.......3...|

00000150 0f 85 b3 fc ff ff 8b 46 1c 3b 42 1c 0f 85 52 f2 |.......F.;B...R.|

00000160 03 00 33 c9 85 c9 0f 85 9d fc ff ff 6a 20 59 2b |..3.........j Y+|

00000170 d9 03 f1 03 d1 3b d9 0f 83 41 ff ff ff e9 22 fc |.....;...A....".|

00000180 ff ff 8b 46 fa 3b 42 fa 0f 85 35 0b 00 00 33 c9 |...F.;B...5...3.|

00000190 85 c9 0f 85 71 fc ff ff 66 8b 46 fe 66 3b 42 fe |....q...f.F.f;B.|

000001a0 0f 84 ee fc ff ff e9 9e fd ff ff 88 01 41 4b 75 |.............AKu|

000001b0 fa e9 82 03 fe ff 8b 46 f4 3b 42 f4 0f 85 09 0e |.......F.;B.....|

000001c0 00 00 33 c9 85 c9 0f 84 cf fc ff ff e9 38 fc ff |..3..........8..|

000001d0 ff 8b 46 f0 3b 42 f0 0f 85 be 29 00 00 33 c9 85 |..F.;B....)..3..|

000001e0 c9 74 d3 e9 21 fc ff ff 8b 46 ec 3b 42 ec 0f 85 |.t..!....F.;B...|

000001f0 20 72 00 00 33 c9 85 c9 74 d7 e9 0a fc ff ff 8b | r..3...t.......|

00000200

Reply
User profile for user: Loner T
Loner T
User level: Level 9
59,471 points

May 17, 2015 11:05 AM in response to Jack Dan

There is an invalid NTFS header where it is expected, hence your inability to boot Windows.


I would not blame the Paragon driver yet. SL and prior versions do not have a notion of a Recovery HD, but later versions do. The choice to remove Leopard/SL may be where the problem was created. Most likely you will lose Recovery HD (temporarily).


Usually, OSX is installed first, then Windows. Was Windows installed using Bootcamp Assistant? If no, then what was the method used.


Can you use Bootcamp Broken after Resizing and OSX Update as a reference, download Testdisk and GPT Fdisk and start a Testdisk can?

Reply
User profile for user: Jack Dan
Jack Dan Author
User level: Level 1
0 points

May 17, 2015 11:47 AM in response to Loner T

Hummmm


I had a second drive, external, using Yosemite. After awhile using hfs+ (paragon) on Windows, that drive was done too (had 1 partition). I just backed up its content and will use it to copy files from the 500GB we are testing now. But you are right, Leopard didn't have recovery partitions as far as I remember.

I installed Windows first without bootcamp. I just partitioned the drive and installed windows 7 leaving the first 50GB to Leopard. After, I installed Leopard. I probably used the Windows 7 DVD to recover its boot and after that I had dual boot with the " option" key. I installed the drivers from the bootcamp files.


Windows boot was always weak, sometimes didn't boot at all. I was about to take it off, but wasn't expecting its partition get unreadable. :-(

The thing is, after uninstalling paragon HFS+, I couldn't get into Windows anymore. After that I installed yosemite. I was never able to mount the windows NTFS from Leopard or using the NTFS drivers from the internet.


I don't mind losing the yosemite partition or the recovery partition, I can install it again after this.


I will do whatever you say... 🙂 I have testdisk and gpt fdisk.

I let testdisk do a quick scan as I noticed you said to someone else on "/dev/rdisk0" (its running right now but started at 48xxxxxxx sector. If the partition " "Recovery HD" ate the Windows partition and starts at 104001760, shouldn't we suppose to start searching at that point?). It is my first time using testdisk or GPT fdisk. I would really appreciate help with that.


My test disk inicial result:


TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org


Disk /dev/rdisk0 - 500 GB / 465 GiB - 976773168 sectors (RO)

Current partition structure:

Partition Start End Size in sectors


1 P EFI System 40 409639 409600 [EFI System Partitio

2 P Mac HFS 411648 104001759 103590112 [Apple_HFS_Untitled_

3 P Mac Boot 104001760 105271295 1269536 [Recovery HD]

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

4 P MS Data 105271296 976773119 871501824

4 P MS Data 105271296 976773119 871501824



================================================================================ ==


GPT FDISK:


Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present


Found valid GPT with hybrid MBR; using GPT.

Disk /dev/disk0: 976773168 sectors, 465.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 5646FAF4-E9C6-4E5D-AAF3-2F03B78B31F3

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 976773134

Partitions will be aligned on 8-sector boundaries

Total free space is 2029 sectors (1014.5 KiB)


Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 411648 104001759 49.4 GiB AF00 Apple_HFS_Untitled_2

3 104001760 105271295 619.9 MiB AB00 Recovery HD

4 105271296 976773119 415.6 GiB 0700


================================================================================ ==============

Reply
User profile for user: Jack Dan
Jack Dan Author
User level: Level 1
0 points

May 17, 2015 6:26 PM in response to Jack Dan

I went through them all.


The fourth "D MS Data 105011200 976771071 871759872" has more info than the others, but nothing inside the folders.

The ones with [Boot] (all of them) had:

>dr-xr-xr-x 0 0 0 15-Feb-2005 19:33 .

dr-xr-xr-x 0 0 0 15-Feb-2005 19:33 ..

dr-xr-xr-x 0 0 0 15-Feb-2005 19:33 System Volume Information

The rest of the "D MS DATA" it says "Can't open filesystem. Filesystem seems damaged."

The rest of the "D MAC HFS" is says "Support for this filesystem hasn't been implemented."

Reply
User profile for user: Jack Dan
Jack Dan Author
User level: Level 1
0 points

May 17, 2015 8:57 PM in response to Loner T

The HDD has a total sectors amount of 976773119 (9 digits).

Testdisk search started at 484001760 (9 digits) or around that and went til 976773119 (9 digits).

Thinking logically, with your permission, since you are the expert, if I didn't move the NTFS partition, the problem was on its beginning, therefore, there is only 2 options:

1- the start of the NTFS partition is inside the "Recovery HD" or "Apple_HFS_Untitled_2".

2- the start of the NTFS partition is somewhere at the beginning of the disk0s4. ---> testdisk already searched that area, because went from 48xxxxxxx (9 digits) to 97xxxxxxx (9 digits).


Conclusion: it must be from sector 41xxxx (6 digits) to sector 48xxxxxxx (9 digits). Which means almost half a day scanning the disk.

This is fun man! It had been a long time since I stopped doing such things... I just love science. What I hate is losing DATA. 😝

I will post here the results. Thank you for your time. You are a very kind man.


Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 411648 104001759 49.4 GiB AF00 Apple_HFS_Untitled_2

3 104001760 105271295 619.9 MiB AB00 Recovery HD

4 105271296 976773119 415.6 GiB 0700

Reply
User profile for user: Loner T
Loner T
User level: Level 9
59,471 points

May 17, 2015 9:36 PM in response to Jack Dan

Testdisk can also show a bit of history of partitioning.


1. The first MS Data (@2048) was made when OS X (SL/L) was on an external disk and it seems to have been a Hybrid MBR (@2048). This disk seems to have been shrunk to accommodate OS X (Yosemite @409640 - which is end of EFI).

2. The NTFS part was moved to 105011220 and then there is/was a 128MB movement (271303 - 11200 sectors = 260,103 sectors ~ 127MB). This may indicate a MBR rebuild or a Windows Recovery.

3. The two MS Data entries before [NONAME] are strange. My guess is that the partition was halved and then rebuilt/restored with some third-party tool or manipulated via a Linux LiveCD.

4. Acronis Disk Image created its own markers for volumes. Did you create a partition using Windows on this disk, prior to the Yosemite installation? It would have been allowed before Recovery HD started showing up in OS X versions. A Yosemite upgrade (or any OS X version after SL) would have caused data loss or at least was a data loss waiting to happen.


The Recovery HD may have overwritten part of NTFS. Yosemite upgrade has challenges with resized partitions and live NTFS headers that may lurk in a given NTFS partition due to resizing operations.

Reply

Can`t boot Windows partition (not installed with bootcamp)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up