Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

0 points

Bootcamp corrupted by 10.7.5 update

Hello everyone,

I ran some updates on an old Lion installation on a 2011 iMac that had been running windows on bootcamp for a few years. Now the bootcamp partition seems to be corrupted, unable to boot windows or see the partition.

running fdisk /dev/disk0:

sphccs-imac:Users root# fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: 07 25 127 15 - 1023 254 63 [ 409640 - 29296872] HPFS/QNX/AUX

3: AB 1023 254 63 - 1023 254 63 [ 29706512 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 30978048 - 945795072] HPFS/QNX/AUX

running gpt -vv -r show /dev/disk0:

sphccs-imac:Users root# gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: error: bogus map

gpt show: unable to open device '/dev/disk0': Undefined error: 0

sphccs-imac:Users root#

output from test disk:

The MS Data entries all look too small, the lost partition is around 460 Gb.

Do you have any idea if the bootcamp partition could be one of these entries?

iMac, Mac OS X (10.7.5)

Posted on Jun 15, 2015 5:20 PM

48 replies

Cohuu Author

Level 1

0 points

Jun 16, 2015 3:19 PM in response to Loner T

Output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Loner T

Level 9

59,471 points

Jun 16, 2015 3:23 PM in response to Cohuu

According to the GPT, you do not have a NTFS volume. Can you power-cycle the Mac and hold Command+R and check if the Recovery console comes up? This will check if GPT3 is correct or not. If it comes up with a spinning globe, then your local Recovery HD is corrupt as well, which implies that the MBR is likely to be correct.

Cohuu Author

Level 1

0 points

Jun 16, 2015 3:31 PM in response to Loner T

The Recovery Console comes up with a spinning globe...

Loner T

Level 9

59,471 points

Jun 16, 2015 3:55 PM in response to Cohuu

In your Testdisk output you have two entries for Mac HFS after the EFI entry, which are very different sizes, which indicates a OSX partition resizing activity.

Assuming OSX works, but the MBR is smaller size for the OSX partition and the other two are corrupt, a GPT can be built using the MBR.

Be aware that you may lose your OSX and Windows with the following steps.

If you see any error messages during the following steps, please stop and post back here with the error message. The following steps have values from your MBR output (and you can verify the number beforeyou proceed). Please notice the '+' sign in step 8 and later steps. The text in parentheses is for informational purpose to describe the action being taken. Gdisk has one-character commands.

Rebuild GPT 2,3,4 using start/end offsets based on the MBR.

Sudo gdisk /dev/rdisk0
P (print the full list of parts)
D (delete)
2 (part 2)
D (deletes)
3 (part 3)
D (delete)
4 (part 4)
N (new part)
2 (part 2)
409640 - Start offset in bytes (start point for Bootcamp part)
+29296872 - Size offset (as opposed to End offset)
AF
N (new part)
3
29706512
+1269536
AB
N (new part)
4
30978048
+945795072
0700 (Windows part type)
P (print list of all parts just to see what changes will be made)
W (Write the new GPT)
Y (Yes! really write the new GPT)

Reboot and test that

a. OSX works

b. you can see Windows files in Bootcamp volume

c. Bootcamp shows up in System Preferences -> Startup Disk.

d. the output of the dd command shows 'R.NTFS'.

Cohuu Author

Level 1

0 points

Jun 16, 2015 4:27 PM in response to Loner T

Unfortunately Mac OS doesn't boot now. There is no important data on the HFS partition however. I could boot into Yosemite from an external drive to get access again. I guess Recovery console would want to repartition and format.

Cohuu Author

Level 1

0 points

Jun 16, 2015 5:00 PM in response to Cohuu

OK, I am back in with the external Yosemite drive, this is the output from gdisk, which doesn't find problems but the drive does not boot:

sphccs-imac:data lance$ sudo gdisk /dev/disk0

GPT fdisk (gdisk) version 1.0.0

Partition table scan:

MBR: hybrid

BSD: not present

APM: not present

GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): v

No problems found. 2021 free sectors (1010.5 KiB) available in 3

segments, the largest of which is 2000 (1000.0 KiB) in size.

Command (? for help): p

Disk /dev/disk0: 976773168 sectors, 465.8 GiB

Logical sector size: 512 bytes

Disk identifier (GUID): 8C78F779-B5DE-4680-8A08-85AE01E65AF6

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 976773134

Partitions will be aligned on 8-sector boundaries

Total free space is 2021 sectors (1010.5 KiB)

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System Partition

2 409640 29706511 14.0 GiB AF00 Apple HFS/HFS+

3 29706512 30976047 619.9 MiB AF00 Apple HFS/HFS+

4 30978048 976773119 451.0 GiB 0700 Microsoft basic data

Loner T

Level 9

59,471 points

Jun 16, 2015 5:42 PM in response to Cohuu

1. OSX not booting from the internal drive is a problem.

2. In System Preferences -> Startup Disk, does Bootcamp from the internal drive show up?

3. Can you re-run the dd command and post the output?

Cohuu Author

Level 1

0 points

Jun 16, 2015 6:00 PM in response to Loner T

Bootcamp doesn't show up System Preferences -> Startup Disk, only the external drive shows up.

Output of sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

lances-imac:data lance$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

00000000 63 8c 30 97 e4 96 f6 a4 9f b1 d0 d5 c1 d5 c3 d2 |c.0.............|

00000010 a7 20 5f 80 33 89 80 eb e0 29 a0 d2 5b 80 96 de |. _.3....)..[...|

00000020 9c d1 c2 6b 3f bf 33 8c 79 77 10 da ea ca a7 18 |...k?.3.yw......|

00000030 41 df 36 1c 31 ea a7 4d 64 cc 5b 76 3b fa 62 10 |A.6.1..Md.[v;.b.|

00000040 0d b3 1c 38 21 6d cc db 1b c7 98 67 c9 8b 30 53 |...8!m.....g..0S|

00000050 7b 13 c5 d1 8f 1d cf 45 44 a6 8f 48 3a 7e d3 5b |{......ED..H:~.[|

00000060 7b 9c 70 40 bf ab e1 4c b7 f3 55 74 d3 52 61 2c |{.p@...L..Ut.Ra,|

00000070 c8 8d 63 e8 eb f8 22 2e 26 20 17 86 63 3a 4f f8 |..c...".& ..c:O.|

00000080 7e 6b 80 2b 1b c0 ad 89 35 e8 cb ed a6 f6 71 33 |~k.+....5.....q3|

00000090 b5 a9 05 df a8 80 3b fd 27 0c 2e 0c f4 00 03 21 |......;.'......!|

000000a0 cc 7e d6 97 4e 2a dc c5 4b 00 74 8d ac 3b 99 05 |.~..N*..K.t..;..|

000000b0 10 ce be 63 70 d3 bb 2d 99 28 0c 34 6f 5f c9 88 |...cp..-.(.4o_..|

000000c0 85 66 ce a6 9b 5b f8 1f f1 da 75 64 98 8c d9 1f |.f...[....ud....|

000000d0 31 3a 07 3a a9 c5 bf a5 e7 1e e3 e7 5b e9 16 3e |1:.:........[..>|

000000e0 ee 2e 86 28 64 c5 86 90 37 74 fb d1 89 9f 6b f1 |...(d...7t....k.|

000000f0 4b 51 3b fb 08 13 5d e1 5f e9 e1 79 17 15 5d 2f |KQ;...]._..y..]/|

00000100 52 18 73 55 13 69 98 cb 66 6c 18 27 0a 28 11 e0 |R.sU.i..fl.'.(..|

00000110 82 08 20 b3 7c 29 a8 9f d6 64 44 d7 cb 2d 7b b9 |.. .|)...dD..-{.|

00000120 02 e9 f1 3e d8 12 f0 3d ef 82 a2 4c f8 1e 35 13 |...>...=...L..5.|

00000130 8e 6f c7 87 bc c9 7a e9 9a aa 28 51 bf 01 ba 1f |.o....z...(Q....|

00000140 e1 8f e7 f9 32 59 ff 5e 27 53 7e ed 95 bd 04 70 |....2Y.^'S~....p|

00000150 74 95 3b 65 65 c7 cd 53 30 d0 08 5b 05 47 1f 88 |t.;ee..S0..[.G..|

00000160 e1 dc b3 e7 a6 60 b8 fc 98 41 6a 59 b0 80 b7 44 |.....`...AjY...D|

00000170 ee ec 3f cc 89 94 d9 09 84 90 d5 6f 09 07 7f 79 |..?........o...y|

00000180 35 ab 27 49 09 b2 b7 b4 cc 12 f5 2d 7a b9 01 17 |5.'I.......-z...|

00000190 56 bf 1d a9 2f 21 f5 fb f6 b0 c7 9a 33 1a ad d2 |V.../!......3...|

000001a0 54 4a 2a a2 df df b6 87 74 f5 0d 03 ae 39 df 42 |TJ*.....t....9.B|

000001b0 e1 c3 4d b8 3e 88 a7 55 4d fb 6f 40 c0 62 02 af |..M.>..UM.o@.b..|

000001c0 70 c9 0e e6 9b b7 08 d8 2f e4 ae af 8a 84 ce 3a |p......./......:|

000001d0 47 52 f5 36 88 24 c7 d2 f6 b1 17 b5 8f ca 8b 4e |GR.6.$.........N|

000001e0 89 95 d9 cf 19 4a 61 cc db 3e 81 b3 6e 62 55 f3 |.....Ja..>..nbU.|

000001f0 7a 33 b8 ab f9 a4 37 b0 70 8b 6f 62 31 c4 cf bd |z3....7.p.ob1...|

00000200

Loner T

Level 9

59,471 points

Jun 16, 2015 6:19 PM in response to Cohuu

This means the MBR is incorrect. It would be very helpful to know the history, if possible from the previous owner of this machine. Did Windows work properly before the upgrade?

Cohuu Author

Level 1

0 points

Jun 16, 2015 6:29 PM in response to Loner T

The machine has been run only as a Windows machine on Bootcamp for several years, the previous user never booted OSX as far as I know. I don't know the history before that. Windows was working correctly up until I ran the updates on Lion a few days ago. I do notice the HFS partition is now 14 Gb, it was 18.5 Gb when it was still booting. I noticed the partition type was not correct for 3, have corrected it as follows, but still no luck:

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System

2 409640 29706511 14.0 GiB AF00 Apple HFS/HFS+

3 29706512 30976047 619.9 MiB AB00 Apple boot

4 30978048 976773119 451.0 GiB 0700 Microsoft basic data

Loner T

Level 9

59,471 points

Jun 16, 2015 7:01 PM in response to Cohuu

Since we know the original GPT, using the same set of steps, the old values can be substituted to get the GPT back to the original state. The old GPT does not need the offset and size, but the absolute values in the same places.

Can you test if Command+R works as local recovery now? This would be a good validation of the MBR values, before we revert to the old GPT.

Was Lion updated, or was there an OS X version upgrade from previous version?

Cohuu Author

Level 1

0 points

Jun 16, 2015 7:14 PM in response to Loner T

Recovery console does not work as local recovery but goes to the spinning globe.

Lion was updated, no OS X version upgrade was done. I think it came with Lion when purchased in early 2012.

Loner T

Level 9

59,471 points

Jun 16, 2015 8:09 PM in response to Cohuu

Do you want to run Testdisk and a Deeper Search or to the old GPT? The old GPT can be rebuilt using the values that you have already posted prior to our modifications.

Cohuu Author

Level 1

0 points

Jun 16, 2015 8:18 PM in response to Loner T

I have rebuilt the old GPT based on the old values, Lion is booting now on the internal drive.

This is what we have:

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI System

2 409640 37519015 17.7 GiB AF00 Apple HFS/HFS+

3 37519016 38788551 619.9 MiB AB00 Apple boot

4 38788552 976773134 447.3 GiB 0700 Microsoft basic data

I wonder if doing a Deeper Search with Testdisk would be helpful if I used the MBR values? With the current values Quick Search is running really slow as it did before.

Thanks for all your time on this problem!

Loner T

Level 9

59,471 points

Jun 17, 2015 7:21 AM in response to Cohuu

Testdisk is the only option that has been highly successful. You can also try Stellar Phoenix Data Recovery as a test.

Bootcamp corrupted by 10.7.5 update