Garycooke

Q: Windows 7 Vanished after Yosemite update... help?

Hi, to anyone that might be able to help.

 

I have a macbook air and have recently done a Yosemite update, 10.10.4 and since doing so i can no longer boot from my Windows 7 partition. Even when booting with the option key.

 

Loner T has put a few posts asking for information from 'Terminal'. I did this and it just kept going and going and going, so i stopped it and her is the first 20 lines which seem to be the information needed:

 

00000000  a3 ce 21 b0 ba dc d1 70  8c 8d 7b 26 48 b6 f6 44  |..!....p..{&H..D|

00000010  27 26 e8 0a 58 ae ac df  03 ec 00 b1 1d a2 91 c5  |'&..X...........|

00000020  1c 75 29 8b 96 41 f6 35  c7 d5 9e 78 21 89 bf 88  |.u)..A.5...x!...|

00000030  15 ae 48 43 f3 7c 8e f4  7c 57 b3 e8 2b 22 31 6f  |..HC.|..|W..+"1o|

00000040  f2 78 73 33 ba b0 a6 7c  8d 09 17 4d 8e ec da a9  |.xs3...|...M....|

00000050  a1 b9 1b 62 5c 04 70 38  af c4 c5 25 5f c0 ca a8  |...b\.p8...%_...|

00000060  b8 f4 41 8d b9 35 87 2d  bc cd 1d 04 b8 8e 0c 20  |..A..5.-....... |

00000070  8b 89 df 31 ad a1 ab 10  76 c9 c3 3d 20 b4 8f 2b  |...1....v..= ..+|

00000080  72 76 3d ed 2a 8d 88 23  eb 5a de c2 e6 e5 fd eb  |rv=.*..#.Z......|

00000090  f6 80 e4 62 d6 9b a4 16  d0 20 b0 20 2c 54 11 e1  |...b..... . ,T..|

000000a0  b8 0a 20 e1 8e 29 99 d8  f6 08 ed 3c 08 47 59 63  |.. ..).....<.GYc|

000000b0  a0 cf fc dc 4f 2d 4f d3  bc 52 f5 24 98 35 58 c1  |....O-O..R.$.5X.|

000000c0  29 88 43 ce bc 4d fa 0d  91 0d 8f 9f 7c 0d 12 08  |).C..M......|...|

000000d0  b4 d7 43 04 cc f8 9f f0  9f f5 dd a9 d0 c1 99 c5  |..C.............|

000000e0  a1 55 fc 02 2b 2b 04 af  d0 df ca 5c b7 bf 10 04  |.U..++.....\....|

000000f0  24 17 df e8 1a df c8 cb  49 d8 a0 19 c5 93 59 f0  |$.......I.....Y.|

00000100  98 3f 03 13 f9 9b 3f 16  61 0b 38 a4 78 a3 7b 64  |.?....?.a.8.x.{d|

00000110  db f4 a8 58 54 c3 65 be  d9 39 d8 d3 2a 6e cd 7c  |...XT.e..9..*n.||

00000120  30 f7 27 b3 70 1b 21 f8  fd 9a 72 72 70 84 af 1e  |0.'.p.!...rrp...|

00000130  c7 bb 16 df d0 cb 92 95  bf 18 a0 cf 0c c2 01 91  |................|

00000140  1b 1a a2 c6 94 f6 48 8c  e0 93 9c 92 e6 e4 f1 5e  |......H........^|

00000150  c3 e3 3a c1 c3 f7 2d 53  d4 91 e2 d0 1d 7a 93 b0  |..:...-S.....z..|

00000160  9b a4 9d 42 e5 09 c0 97  21 9f ac 88 ca 7e 60 bd  |...B....!....~`.|

00000170  8e 65 bf 86 2b 64 e7 bc  ad 12 9a c6 d3 c1 07 e7  |.e..+d..........|

00000180  24 3f 32 2e 51 fa bf 40  1a 90 44 72 36 d1 b9 ed  |$?2.Q..@..Dr6...|

00000190  40 a9 80 0d 62 90 be a3  78 42 f8 b8 03 bf d0 f2  |@...b...xB......|

000001a0  7b d6 e2 25 d8 d0 35 2b  5e ff df 49 69 2e 14 ad  |{..%..5+^..Ii...|

000001b0  80 9b c1 c5 d8 98 63 d7  d8 a6 a1 9b 98 94 87 2d  |......c........-|

000001c0  e5 b7 9b 2a 54 6d 6f e7  02 de 65 4a 1f 77 ab 98  |...*Tmo...eJ.w..|

000001d0  d6 a5 aa 5c 3c 1a 6e 34  89 ca 19 3c c8 19 6e de  |...\<.n4...<..n.|

000001e0  40 84 ff 21 e9 ea dd ca  9e a5 a5 b9 3d 43 0b 0f  |@..!........=C..|

000001f0  80 0f 1e d4 d1 9a 8b a9  a4 f5 35 d3 ee 99 c1 8a  |..........5.....|

00000200  45 f8 04 ee 89 08 7c dc  99 4a 4c 36 ad e4 af 24  |E.....|..JL6...$|

 

any help would be really appreciated as all my work is currently on the windows partition

MacBook Air, OS X Yosemite (10.10.4)

Posted on Jul 2, 2015 9:22 AM

Close

Q: Windows 7 Vanished after Yosemite update... help?

  • All replies
  • Helpful answers

Page 1 Next
  • by Loner T,

    Loner T Loner T Jul 2, 2015 9:23 AM in response to Garycooke
    Level 7 (23,970 points)
    Safari
    Jul 2, 2015 9:23 AM in response to Garycooke

    Can you post the output of the following Terminal commands?

     

    diskutil list

    diskutil cs list

    sudo gpt -vv -r show /dev/disk0

    sudo fdisk /dev/disk0

     

    The "sudo" commands will prompt for your password, and it will not be echoed back. You may also see a warning about improper use of "sudo" and potential data loss due to "abuse" of the command.

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 9:35 AM in response to Loner T
    Level 1 (0 points)
    Jul 2, 2015 9:35 AM in response to Loner T

    is this right?

     

    gpt show: /dev/disk0: mediasize=121332826112; sectorsize=512; blocks=236978176

    gpt show: /dev/disk0: Suspicious MBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 236978175

          start       size  index  contents

              0          1         MBR

              1          1         Pri GPT header

              2         32         Pri GPT table

             34          6        

             40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

         409640   75136712      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

       75546352    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

       76815888   42975728        

      119791616  117184512      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      236976128       2015        

      236978143         32         Sec GPT table

      236978175          1         Sec GPT header

  • by Loner T,

    Loner T Loner T Jul 2, 2015 9:42 AM in response to Garycooke
    Level 7 (23,970 points)
    Safari
    Jul 2, 2015 9:42 AM in response to Garycooke

    Can you post the output of the other commands too?

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 9:47 AM in response to Loner T
    Level 1 (0 points)
    Jul 2, 2015 9:47 AM in response to Loner T

    sorry

    /dev/disk0

       #:                       TYPE NAME                    SIZE       IDENTIFIER

       0:      GUID_partition_scheme                        *121.3 GB   disk0

       1:                        EFI EFI                     209.7 MB   disk0s1

       2:                  Apple_HFS Macintosh HD            38.5 GB    disk0s2

       3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

       4:       Microsoft Basic Data                         60.0 GB    disk0s4

     

     

     

    No CoreStorage logical volume groups found

     

     

     

    gpt show: /dev/disk0: mediasize=121332826112; sectorsize=512; blocks=236978176

    gpt show: /dev/disk0: Suspicious MBR at sector 0

    gpt show: /dev/disk0: Pri GPT at sector 1

    gpt show: /dev/disk0: Sec GPT at sector 236978175

          start       size  index  contents

              0          1         MBR

              1          1         Pri GPT header

              2         32         Pri GPT table

             34          6        

             40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

         409640   75136712      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC

       75546352    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

       76815888   42975728        

      119791616  117184512      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

      236976128       2015        

      236978143         32         Sec GPT table

      236978175          1         Sec GPT header

     

    Disk: /dev/disk0 geometry: 14751/255/63 [236978176 sectors]

    Signature: 0xAA55

             Starting       Ending

    #: id  cyl  hd sec -  cyl  hd sec [     start -       size]

    ------------------------------------------------------------------------

    1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>

    2: AF 1023 254  63 - 1023 254  63 [    409640 -   75136712] HFS+       

    3: AB 1023 254  63 - 1023 254  63 [  75546352 -    1269536] Darwin Boot

    4: 0C 1023 254  63 - 1023 254  63 [ 119791616 -  117184512] Win95 FAT32L

  • by Loner T,

    Loner T Loner T Jul 2, 2015 10:11 AM in response to Garycooke
    Level 7 (23,970 points)
    Safari
    Jul 2, 2015 10:11 AM in response to Garycooke

    Can you use BOOTCAMP Partition lost after some updates in Yosemite as a reference and download Testdisk and GPT Fdisk and start a Testdisk scan?

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 10:33 AM in response to Loner T
    Level 1 (0 points)
    Jul 2, 2015 10:33 AM in response to Loner T

    The following partitions can't be recovered:

         Partition               Start        End    Size in sectors

    >  MS Data                236976127  354160638  117184512

       Mac HFS                236978132  238247667    1269536

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 10:35 AM in response to Garycooke
    Level 1 (0 points)
    Jul 2, 2015 10:35 AM in response to Garycooke

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO)

         Partition               Start        End    Size in sectors

    >P EFI System                    40     409639     409600 [EFI]

    P Mac HFS                   409640   75546351   75136712

    P Mac HFS                 75546352   76815887    1269536

    D MS Data                 76816384  236976120  160159737

    D MS Data                119791616  236976127  117184512

    D Mac HFS                235708600  236978135    1269536

     

     

     

     

     

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

    FAT32, blocksize=512, 209 MB / 200 MiB

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 10:37 AM in response to Garycooke
    Level 1 (0 points)
    Jul 2, 2015 10:37 AM in response to Garycooke

    which ms data do i use here?

  • by Loner T,

    Loner T Loner T Jul 2, 2015 10:48 AM in response to Garycooke
    Level 7 (23,970 points)
    Safari
    Jul 2, 2015 10:48 AM in response to Garycooke

    My table for verification

     

    GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartSector OffsetNTFS SizeNTFS EndSector Offset (MB)NTFS(Gb)
    7554635212695367681588876816384496160159737236976120076.37011385

     

    indicates that the first MS Data shown here is the best candidate.

    D MS Data                 76816384  236976120  160159737

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 10:52 AM in response to Garycooke
    Level 1 (0 points)
    Jul 2, 2015 10:52 AM in response to Garycooke

    ok, so i ran wit with all options thrown up and it comes back with the same information. here are the screens:

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO)

     

    The harddisk (121 GB / 113 GiB) seems too small! (< 181 GB / 168 GiB)

    Check the harddisk size: HD jumpers settings, BIOS detection...

     

    The following partitions can't be recovered:

         Partition               Start        End    Size in sectors

    >  MS Data                236976127  354160638  117184512

       Mac HFS                236978132  238247667    1269536

     

     

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO)

         Partition               Start        End    Size in sectors

    >P EFI System                    40     409639     409600 [EFI]

    P Mac HFS                   409640   75546351   75136712

    P Mac HFS                 75546352   76815887    1269536

    D MS Data                 76816384  236976120  160159737

    D MS Data                119791616  236976127  117184512

    D Mac HFS                235708600  236978135    1269536

     

     

     

     

     

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

    FAT32, blocksize=512, 209 MB / 200 MiB

     

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO)

     

         Partition                  Start        End    Size in sectors

     

    1 P EFI System                    40     409639     409600 [EFI]

    2 P Mac HFS                   409640   75546351   75136712

    3 P Mac HFS                 75546352   76815887    1269536

     

     

     

     

     

     

     

     

     

     

     

    [  Quit  ] >[Deeper Search]  [ Write  ]

     

     

     

     

     

     

     

    i'm guessing i need to run a deeper search?

  • by Loner T,

    Loner T Loner T Jul 2, 2015 10:55 AM in response to Garycooke
    Level 7 (23,970 points)
    Safari
    Jul 2, 2015 10:55 AM in response to Garycooke

    No. You do not need a Deeper Search. Hit Escape only once and go back to the list.

     

    Use 'P' to list files from the following entry and post a screen shot.

    D MS Data                 76816384  236976120  160159737

     

    It should look similar to this one.

     

    Testdisk-GoodWindowsPartition.png

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 10:57 AM in response to Loner T
    Level 1 (0 points)
    Jul 2, 2015 10:57 AM in response to Loner T

    this the one?

     

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

         MS Data                 76816384  236976120  160159737

    Directory /

     

    >dr-xr-xr-x     0     0         0 28-Jun-2015 19:12 .

    dr-xr-xr-x     0     0         0 28-Jun-2015 19:12 ..

    dr-xr-xr-x     0     0         0 13-Apr-2015 18:07 $Recycle.Bin

    dr-xr-xr-x     0     0         0 13-Apr-2015 21:24 Boot

    dr-xr-xr-x     0     0         0 29-Jun-2015 22:49 Dropbox

    dr-xr-xr-x     0     0         0 13-Apr-2015 18:04 Intel

    dr-xr-xr-x     0     0         0 14-Apr-2015 20:49 MSOCache

    dr-xr-xr-x     0     0         0 14-Jul-2009 04:20 PerfLogs

    dr-xr-xr-x     0     0         0 16-Apr-2015 18:50 Program Files

    dr-xr-xr-x     0     0         0 26-Jun-2015 19:53 Program Files (x86)

    dr-xr-xr-x     0     0         0 28-Jun-2015 19:21 ProgramData

    dr-xr-xr-x     0     0         0 13-Apr-2015 17:59 Recovery

    dr-xr-xr-x     0     0         0  4-May-2015 10:37 SYSOE

    dr-xr-xr-x     0     0         0 28-Jun-2015 19:00 System Volume Information

                                                       Next

    Use Right to change directory, h to hide Alternate Data Stream

        q to quit, : to select the current file, a to select all files

        C to copy the selected files, c to copy the current file

  • by Loner T,Solvedanswer

    Loner T Loner T Jul 2, 2015 11:08 AM in response to Garycooke
    Level 7 (23,970 points)
    Safari
    Jul 2, 2015 11:08 AM in response to Garycooke

    Yes, that is what we are looking for.


    Install GPT Fdisk (aka gdisk).  Leave your Testdisk display and start a new Terminal Window. You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message. The following steps have values from your Testdisk output (and you can verify) in Steps 7 and 8. Please notice the '+' sign in step 8 (this is called offset notation). The text in parentheses is for informational purpose to describe the action being taken. Gdisk has one-character commands except when entering numbers.

     

    Rebuild GPT4 using start/end offsets

     

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4  (part 4)
    7. 76816384 ( - Start offset in sectors or the start point for Bootcamp part)
    8. +160159737 ( - Size offset, as opposed to End offset)
    9. 0700 (Windows part type)
    10. P  (print list of all parts just to see what changes will be made)
    11. W (Write the new GPT)
    12. Y  (Yes! really write the new GPT)

    This will delete and re-write the GPT partition info for /dev/disk0s4.



    Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Use defaults for other questions (like partition codes). The only values that need modifications are the Boot flags and step 10. Accept all other defaults that Gdisk offers. Please see the sample Q&A as an example. These steps can be repeated if you make a mistake before you get to Step 12, otherwise start from Step 1 for these steps. Step 6 has numbers which are typed with a space between the numbers.

    1. Sudo gdisk /dev/rdisk0
    2. P  (Print list of parts)
    3. R  (Recover)
    4. O (print current Hybrid MBR)
    5. H (chooses Hybrid)
    6. Partitions numbers to be hybridized: 2 3 4
    7. Y  (Good for GRUB question)
    8. N  (part 2 boot flag)
    9. N  (part 3 boot flag)
    10. Y  (part 4 boot flag make NTFS bootable partition)
    11. O  (print current Hybrid MBR)
    12. W (Write the new MBR)
    13. Y (Yes! write the new MBR)
    14. Reboot

     

    Here is sample Q&A for this section. Please notice the Press Enter/Return.

     

    Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): Y

     

    Creating entry for GPT partition #2 (MBR partition #2)

    Enter an MBR hex code (default AF): Press Enter/Return

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #3 (MBR partition #3)

    Enter an MBR hex code (default AB): Press Enter/Return

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #4 (MBR partition #4)

    Enter an MBR hex code (default 07): Press Enter/Return

    Set the bootable flag? (Y/N): Y

     

    Test 1 - Does Bootcamp Volume show up in Finder?

    Test 2 - Can you see files in Bootcamp Volume?

    Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

    Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

  • by Garycooke,

    Garycooke Garycooke Jul 2, 2015 12:07 PM in response to Loner T
    Level 1 (0 points)
    Jul 2, 2015 12:07 PM in response to Loner T

    sorry, just a quick question;

     

    Rebuild GPT4 using start/end offsets

     

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4  (part 4)

     

    do i lose any of my files by doing this? or is there a risk of losing anything?

Page 1 Next