Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Need help with corrupted MBR on Yosemite - Windows 7 computer

Hello!

I have been trying to fix this issue for some time now and have stumbled upon many issues similar to the one I have encountered. After installing Yosemite, the windows partition of the computer could no longer be accessed. Instead, a partition called disk0s4 has replaced it. I would greatly appreciate any help because my next step is to just reinstall windows and lose everything.


Here is the output for some of the commands I have seen other people with similar issues be asked to use


diskutil list

diskutil cs list

sudo gpt -vv -r show /dev/disk0

sudo fdisk /dev/disk0

greg-reichards-macbook-pro:~ Greg$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 499.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 500.0 GB disk0s4

greg-reichards-macbook-pro:~ Greg$ diskutil cs list

No CoreStorage logical volume groups found

greg-reichards-macbook-pro:~ Greg$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 975284408 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

975694048 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

976963584 976560128 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

greg-reichards-macbook-pro:~ Greg$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 975284408] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 975694048 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 976963584 - 976560128] Win95 FAT32L

greg-reichards-macbook-pro:~ Greg$

[Restored]

Last login: Wed Aug 12 14:08:55 on ttys000

greg-reichards-macbook-pro:~ Greg$

[Restored]

Last login: Fri Aug 21 12:16:44 on console

gregreihardsMBP:~ Greg$ clear


gregreihardsMBP:~ Greg$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 499.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 500.0 GB disk0s4

gregreihardsMBP:~ Greg$ diskutil cs list

No CoreStorage logical volume groups found

gregreihardsMBP:~ Greg$ sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 975284408 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

975694048 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

976963584 976560128 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

gregreihardsMBP:~ Greg$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 975284408] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 975694048 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 976963584 - 976560128] Win95 FAT32L


sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

gregreihardsMBP:~ Greg$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 72 6f 6f 74 63 65 72 74 2e 63 72 6c 30 54 06 08 |rootcert.crl0T..|

00000010 2b 06 01 05 05 07 01 01 04 48 30 46 30 44 06 08 |+........H0F0D..|

00000020 2b 06 01 05 05 07 30 02 86 38 68 74 74 70 3a 2f |+.....0..8http:/|

00000030 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 |/www.microsoft.c|

00000040 6f 6d 2f 70 6b 69 2f 63 65 72 74 73 2f 4d 69 63 |om/pki/certs/Mic|

00000050 72 6f 73 6f 66 74 52 6f 6f 74 43 65 72 74 2e 63 |rosoftRootCert.c|

00000060 72 74 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b |rt0...U.%..0...+|

00000070 06 01 05 05 07 03 08 30 0d 06 09 2a 86 48 86 f7 |.......0...*.H..|

00000080 0d 01 01 05 05 00 03 82 02 01 00 10 97 8a c3 5c |...............\|

00000090 03 44 36 dd e9 b4 ad 77 db ce 79 51 4d 01 b1 2e |.D6....w..yQM...|

000000a0 74 71 5b 6d 0c 13 ab ce be 7b 8f b8 2e d4 12 a2 |tq[m.....{......|

000000b0 8c 6d 62 b8 57 02 cb 4e 20 13 50 99 dd 7a 40 e2 |.mb.W..N .P..z@.|

000000c0 57 bb af 58 9a 1c e1 1d 01 86 ac bb 78 f2 8b d0 |W..X........x...|

000000d0 ec 3b 01 ee e2 be 8f 0a 05 c8 8d 48 e2 f0 53 15 |.;.........H..S.|

000000e0 dd 4f ab 92 e4 e7 8d 6a d5 80 c1 e6 94 f2 06 2f |.O.....j......./|

000000f0 85 03 e9 91 2a 24 22 70 fb f6 fc e4 78 99 2e 0d |....*$"p....x...|

00000100 f7 07 e2 70 bc 18 4e 9d 8e 6b 0a 72 95 b8 a1 39 |...p..N..k.r...9|

00000110 9c 67 2d c5 51 0e ea 62 5c 3f 16 98 8b 20 3f e2 |.g-.Q..b\?... ?.|

00000120 07 1a 32 f9 cc 31 4a 76 31 3d 2b 72 0b c8 ea 70 |..2..1Jv1=+r...p|

00000130 3d ff 85 0a 13 df c2 0a 61 8e f0 d7 b8 17 eb 4e |=.......a......N|

00000140 8b 7f c5 35 2b 5e a3 bf eb bc 7d 0b 42 7b d4 53 |...5+^....}.B{.S|

00000150 72 21 ee 30 ca bb 78 65 5c 5b 01 17 0a 14 0e d2 |r!.0..xe\[......|

00000160 da 14 98 f5 3c b9 66 58 b3 2d 2f e7 f9 85 86 cc |....<.fX.-/.....|

00000170 51 56 e8 9d 70 94 6c ac 39 4c d4 f6 79 bf aa 18 |QV..p.l.9L..y...|

00000180 7a 62 29 ef a2 9b 29 34 06 77 1a 62 c9 3d 1e 6d |zb)...)4.w.b.=.m|

00000190 1f 82 f0 0b c7 2c bb cf 43 b3 e5 f9 ec 7d b5 e3 |.....,..C....}..|

000001a0 a4 a8 74 35 b8 4e c5 71 23 12 26 76 0b 3c 52 8c |..t5.N.q#.&v.<R.|

000001b0 71 5a 46 43 14 bc b3 b3 b0 4d 67 c8 9f 42 ff 80 |qZFC.....Mg..B..|

000001c0 79 21 80 9e 15 30 66 e8 42 12 5e 1a c8 9e 22 21 |y!...0f.B.^..."!|

000001d0 d0 43 e9 2b e9 bb f4 48 cc 2c d4 d8 32 80 4c 26 |.C.+...H.,..2.L&|

000001e0 2a 48 24 5f 5a ea 56 ef a6 de 99 9d ca 3a 6f bd |*H$_Z.V......:o.|

000001f0 81 27 74 06 11 ee 76 21 bf 9b 82 c1 27 54 b6 b1 |.'t...v!....'T..|

00000200


If there is anything else needed I can provide it. Once again this is my last attempt before just wiping this so I a fine with trying anything risky. Thank you all very much in advance and I look forward getting any feedback.

Posted on Aug 21, 2015 10:26 AM

Reply
26 replies

Aug 21, 2015 2:11 PM in response to Picklegunner

Your rdisk0s4 dd does not show a standard NTFS header. Here is an example.


sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

Password:

00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|

00000010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 e8 71 56 |........?.....qV|

00000020 00 00 00 00 80 00 80 00 f8 f7 08 1e 00 00 00 00 |................|

00000030 00 00 0c 00 00 00 00 00 02 00 00 00 00 00 00 00 |................|

00000040 f6 00 00 00 01 00 00 00 13 32 6d 13 b7 bb b5 32 |.........2m....2|

00000050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|

00000060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|

00000070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|

00000080 55 aa 75 06 f7 c1 01 00 75 03 e9 dd 00 1e 83 ec |U.u.....u.......|

00000090 18 68 1a 00 b4 48 8a 16 0e 00 8b f4 16 1f cd 13 |.h...H..........|

000000a0 9f 83 c4 18 9e 58 1f 72 e1 3b 06 0b 00 75 db a3 |.....X.r.;...u..|

000000b0 0f 00 c1 2e 0f 00 04 1e 5a 33 db b9 00 20 2b c8 |........Z3... +.|

000000c0 66 ff 06 11 00 03 16 0f 00 8e c2 ff 06 16 00 e8 |f...............|

000000d0 4b 00 2b c8 77 ef b8 00 bb cd 1a 66 23 c0 75 2d |K.+.w......f#.u-|

000000e0 66 81 fb 54 43 50 41 75 24 81 f9 02 01 72 1e 16 |f..TCPAu$....r..|

000000f0 68 07 bb 16 68 70 0e 16 68 09 00 66 53 66 53 66 |h...hp..h..fSfSf|

00000100 55 16 16 16 68 b8 01 66 61 0e 07 cd 1a 33 c0 bf |U...h..fa....3..|

00000110 28 10 b9 d8 0f fc f3 aa e9 5f 01 90 90 66 60 1e |(........_...f`.|

00000120 06 66 a1 11 00 66 03 06 1c 00 1e 66 68 00 00 00 |.f...f.....fh...|

00000130 00 66 50 06 53 68 01 00 68 10 00 b4 42 8a 16 0e |.fP.Sh..h...B...|

00000140 00 16 1f 8b f4 cd 13 66 59 5b 5a 66 59 66 59 1f |.......fY[ZfYfY.|

00000150 0f 82 16 00 66 ff 06 11 00 03 16 0f 00 8e c2 ff |....f...........|

00000160 0e 16 00 75 bc 07 1f 66 61 c3 a0 f8 01 e8 09 00 |...u...fa.......|

00000170 a0 fb 01 e8 03 00 f4 eb fd b4 01 8b f0 ac 3c 00 |..............<.|

00000180 74 09 b4 0e bb 07 00 cd 10 eb f2 c3 0d 0a 41 20 |t.............A |

00000190 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 |disk read error |

000001a0 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d |occurred...BOOTM|

000001b0 47 52 20 69 73 20 6d 69 73 73 69 6e 67 00 0d 0a |GR is missing...|

000001c0 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 |BOOTMGR is compr|

000001d0 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 |essed...Press Ct|

000001e0 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 |rl+Alt+Del to re|

000001f0 73 74 61 72 74 0d 0a 00 8c a9 be d6 00 00 55 aa |start.........U.|

00000200


Was Yosemite upgrade the only change? Has the Windows partition been resized using any tools?

Aug 24, 2015 1:27 PM in response to Picklegunner

"I did not repartition after the Yosemite upgrade or try to resize. 6 months prior to my attempted Yosemite upgrade I put new hard drive in via time machine because I was low on space. The time machine backup had 3 partitions (Mac, windows(NTFS and FAT) but I kept the new hard drive with just two (Mac and windows (NTFS). It worked fine. The trouble started when I did the Yosemite upgrade: I could not choose to boot into windows using by holding the alt key when booting. "

This was the reply I received from the owner.

Aug 25, 2015 9:39 AM in response to Loner T

NTFS was restored using Norton ghost after re-installing windows 7. The owner didnt know what UEFI or Bios mode is / which one was used, is there anyway I can check this from the mac side?

I noticed this:

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 499.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 500.0 GB disk0s4

From the info I pasted originally. Would this indicate it was installed using UEFI?

Here are the system specs:

Mac Book pro (Late 2008)

Yosemite 10.10.3

Windows 7

Thanks for the help and persistence!

Aug 25, 2015 11:27 AM in response to Loner T

My Test Disk window differs immediately from the one shown in the imgur link.

I only have two options. The total size of the drive is 1000 GB, the window and mac were split into 500GB sections


TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org



TestDisk is free software, and

comes with ABSOLUTELY NO WARRANTY.


Select a media (use Arrow keys, then press Enter):

>Disk /dev/disk0 - 1000 GB / 931 GiB (RO)

Disk /dev/rdisk0 - 1000 GB / 931 GiB (RO)

Aug 25, 2015 12:22 PM in response to Loner T

This is the screen before searching (if it provides anything), TestDisk is currently scanning


TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org


Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)

Current partition structure:

Partition Start End Size in sectors


1 P EFI System 40 409639 409600 [EFI System Partition]

2 P Mac HFS 409640 975694047 975284408 [Macintosh HD]

3 P Mac Boot 975694048 976963583 1269536 [Recovery HD]

No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker

4 P MS Data 976963584 1953523711 976560128 [BOOTCAMP]

4 P MS Data 976963584 1953523711 976560128 [BOOTCAMP]




>[Quick Search] [ Backup ]

Try to locate partition

Aug 25, 2015 1:04 PM in response to Picklegunner

Hello,

I'm having the the same issue, I've tried to proceed like described in similar cases in the forum here but I think mt MBR still corrupted :-(

Can you help me please ?


$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 350.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 649.0 GB disk0s4


$ diskutil cs list

No CoreStorage logical volume groups found


$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 684252080 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

684661720 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

685931256 1267593879 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953525135 32 Sec GPT table


$ sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 684252080] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 684661720 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 685931256 - 1267593879] HPFS/QNX/AUX


In advance, THANKS a lot for your help on this!! I'm going crazy :-o

Need help with corrupted MBR on Yosemite - Windows 7 computer

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.