Bootcamp corrupted by 10.7.5 update

Question

Level 1

0 points

Bootcamp corrupted by 10.7.5 update

Hello everyone,

I ran some updates on an old Lion installation on a 2011 iMac that had been running windows on bootcamp for a few years. Now the bootcamp partition seems to be corrupted, unable to boot windows or see the partition.

running fdisk /dev/disk0:

sphccs-imac:Users root# fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: 07 25 127 15 - 1023 254 63 [ 409640 - 29296872] HPFS/QNX/AUX

3: AB 1023 254 63 - 1023 254 63 [ 29706512 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 30978048 - 945795072] HPFS/QNX/AUX

running gpt -vv -r show /dev/disk0:

sphccs-imac:Users root# gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: error: bogus map

gpt show: unable to open device '/dev/disk0': Undefined error: 0

sphccs-imac:Users root#

output from test disk:

The MS Data entries all look too small, the lost partition is around 460 Gb.

Do you have any idea if the bootcamp partition could be one of these entries?

iMac, Mac OS X (10.7.5)

Posted on Jun 15, 2015 5:20 PM

Reply

Answer 1

Loner T

Level 9

59,471 points

Jun 15, 2015 5:29 PM in response to Cohuu

1. Was the bootcamp resized after its original installation before you upgraded?

2. Is the Testdisk output from Deeper Search?

3. What OS X version was Windows installed on?

4. What is the version of Windows?

Reply

Answer 2

Cohuu Author

Level 1

0 points

Jun 15, 2015 5:37 PM in response to Loner T

Thanks for your reply Loner.

1. I'm not sure if the bootcamp partition was resized or not, this is a machine that I haven't worked on myself until now and several people have used it previously.

2. The testdisk output was from quick search, which ended up taking many hours, the deeper search option looks like it will take forever to complete.

3. Windows was installed on Lion as far as I know, which is now on a small 19 Gb partition.

4. Windows 7.

Reply

Answer 3

Loner T

Level 9

59,471 points

Jun 15, 2015 5:57 PM in response to Cohuu

Your GPT seems to have a CRC corruption issue. If you download GPT Fdisk from http://sourceforge.net/projects/gptfdisk/ then the CRC issue can be corrected.

Quick Search does not take long. If the Search took several hours, most likely it is a deeper search.

Reply

Answer 4

Cohuu Author

Level 1

0 points

Jun 15, 2015 6:04 PM in response to Loner T

I have downloaded GPT Fdisk, how can the CRC corruption issue be corrected?

Quick search took about 15 hours to complete, on attempting deeper search it looks like it is going a lot slower than quick search...

Reply

Answer 5

Loner T

Level 9

59,471 points

Jun 15, 2015 6:21 PM in response to Cohuu

In the Recovery menu there are two options

c load backup partition table from disk (rebuilding main)

e load main partition table from disk (rebuilding backup)

Please see http://www.rodsbooks.com/gdisk/repairing.html for more details.

Reply

Answer 6

Cohuu Author

Level 1

0 points

Jun 15, 2015 6:43 PM in response to Loner T

Thanks Loner. I ran verify in the recovery menu and got this:

Recovery/transformation command (? for help): v

Warning! Mismatched GPT and MBR partition! MBR partition 2, of type 0x07,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Warning! Mismatched GPT and MBR partition! MBR partition 3, of type 0xAB,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Warning! Mismatched GPT and MBR partition! MBR partition 4, of type 0x07,

has no corresponding GPT partition! You may continue, but this condition

might cause data loss in the future!

Identified 3 problems!

Recovery/transformation command (? for help):

Would it make a difference whether I run

c load backup partition table from disk (rebuilding main)

or

e load main partition table from disk (rebuilding backup)?

Reply

Answer 7

Loner T

Level 9

59,471 points

Jun 15, 2015 6:55 PM in response to Cohuu

The 'v' option is just telling what we already know, because GPT is unreadable, and the MBR entries are visible and readable. I suggest you use option 'c'. The main is corrupted.

When you ran gdisk, it should have mentioned whether it used the main or backup to read the data. Can you run the 'p' command before you recover the GPT using either method?

Reply

Answer 8

Cohuu Author

Level 1

0 points

Jun 15, 2015 7:00 PM in response to Loner T

This is what gdisk reported on loading:

Warning: Devices opened with shared lock will not have their

partition table automatically reloaded!

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Running p:

Command (? for help): p

Disk /dev/disk0: 976773168 sectors, 465.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 8C78F779-B5DE-4680-8A08-85AE01E65AF6

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 976773134

Partitions will be aligned on 8-sector boundaries

Total free space is 589 sectors (294.5 KiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 37519015 17.7 GiB AF00 Customer

3 37519016 38788551 619.9 MiB AB00 Recovery HD

4 38789120 976773119 447.3 GiB 0700 BOOTCAMP

Reply

Answer 9

Loner T

Level 9

59,471 points

Jun 15, 2015 7:21 PM in response to Cohuu

Does this now work properly - sudo gpt -vv -r show /dev/disk0 ?

Reply

Answer 10

Cohuu Author

Level 1

0 points

Jun 15, 2015 7:33 PM in response to Loner T

It gives the same result as before, after running option 'c', writing the partition table and rebooting.

Reply

Answer 11

Loner T

Level 9

59,471 points

Jun 16, 2015 7:30 AM in response to Cohuu

Gdisk is not showing the CRC warnings, but gpt is not working, which is rather strange. Temporarily, let us ignore the GPT. If you want to see details similar to gpt command, there is a Curses-based version of gdisk called cgdisk which can be run as sudo cgdisk /dev/rdisk0 . Here is an example.

Reply

Answer 12

Cohuu Author

Level 1

0 points

Jun 16, 2015 11:29 AM in response to Loner T

Running cgdisk give this on startup:

Warning! Problems found on disk! Use the Verify function to learn more.

Using gdisk or some other program may be necessary to repair the problems.

Running verify gives the Mismatched GPT and MBR partition warnings.

Reply

Answer 13

Loner T

Level 9

59,471 points

Jun 16, 2015 2:39 PM in response to Cohuu

Here is a table comparing GPT size vs MBR size. Partition 1 also has the GPT headers, so it is ignored.

Can you post the output of

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null

This will show what the GPT thinks the Bootcamp partition header is.

Reply

Answer 14

Cohuu Author

Level 1

0 points

Jun 16, 2015 3:05 PM in response to Loner T

Thanks for the table.

Here is the output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null

sphccs-imac:testdisk-7.0 root# sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null

ypeValidator@xercesc_3_1@@UAE@XZ??1GeneralAttributeCheck@xercesc_3_1@@QAE@XZ??1G rammar@xercesc_3_1@@UAE@XZ??1GrammarResolver@xercesc_3_1@@QAE@XZ??1HandlerBase@x ercesc_3_1@@UAE@XZ??1HexBinaryDatatypeValidator@xercesc_3_1@@UAE@XZ??1ICULCPTran scoder@xercesc_3_1@@UAE@XZ??1ICUTransService@xercesc_3_1@@UAE@XZ??1ICUTranscoder @xercesc_3_1@@UAE@XZ??1IC_Field@xercesc_3_1@@UAE@XZ??1IC_Key@xercesc_3_1@@UAE@XZ ??1IC_KeyRef@xercesc_3_1@@UAE@XZ??1IC_Selector@xercesc_3_1@@UAE@XZ??1IC_Unique@x ercesc_3_1@@UAE@XZsphccs-imac:testdisphccssphccssphccs-imac:testdisk-7.0 root#

Reply

Answer 15

Loner T

Level 9

59,471 points

Jun 16, 2015 3:11 PM in response to Cohuu

Sorry, please post the output of

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Reply