Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Need help with corrupted MBR on Yosemite - Windows 7 computer

Hello!

I have been trying to fix this issue for some time now and have stumbled upon many issues similar to the one I have encountered. After installing Yosemite, the windows partition of the computer could no longer be accessed. Instead, a partition called disk0s4 has replaced it. I would greatly appreciate any help because my next step is to just reinstall windows and lose everything.


Here is the output for some of the commands I have seen other people with similar issues be asked to use


diskutil list

diskutil cs list

sudo gpt -vv -r show /dev/disk0

sudo fdisk /dev/disk0

greg-reichards-macbook-pro:~ Greg$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 499.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 500.0 GB disk0s4

greg-reichards-macbook-pro:~ Greg$ diskutil cs list

No CoreStorage logical volume groups found

greg-reichards-macbook-pro:~ Greg$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 975284408 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

975694048 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

976963584 976560128 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

greg-reichards-macbook-pro:~ Greg$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 975284408] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 975694048 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 976963584 - 976560128] Win95 FAT32L

greg-reichards-macbook-pro:~ Greg$

[Restored]

Last login: Wed Aug 12 14:08:55 on ttys000

greg-reichards-macbook-pro:~ Greg$

[Restored]

Last login: Fri Aug 21 12:16:44 on console

gregreihardsMBP:~ Greg$ clear


gregreihardsMBP:~ Greg$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *1.0 TB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS Macintosh HD 499.3 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data 500.0 GB disk0s4

gregreihardsMBP:~ Greg$ diskutil cs list

No CoreStorage logical volume groups found

gregreihardsMBP:~ Greg$ sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1953525167

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 975284408 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

975694048 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

976963584 976560128 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1953523712 1423

1953525135 32 Sec GPT table

1953525167 1 Sec GPT header

gregreihardsMBP:~ Greg$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 975284408] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 975694048 - 1269536] Darwin Boot

4: 0C 1023 254 63 - 1023 254 63 [ 976963584 - 976560128] Win95 FAT32L


sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

gregreihardsMBP:~ Greg$ sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Password:

00000000 72 6f 6f 74 63 65 72 74 2e 63 72 6c 30 54 06 08 |rootcert.crl0T..|

00000010 2b 06 01 05 05 07 01 01 04 48 30 46 30 44 06 08 |+........H0F0D..|

00000020 2b 06 01 05 05 07 30 02 86 38 68 74 74 70 3a 2f |+.....0..8http:/|

00000030 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 |/www.microsoft.c|

00000040 6f 6d 2f 70 6b 69 2f 63 65 72 74 73 2f 4d 69 63 |om/pki/certs/Mic|

00000050 72 6f 73 6f 66 74 52 6f 6f 74 43 65 72 74 2e 63 |rosoftRootCert.c|

00000060 72 74 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b |rt0...U.%..0...+|

00000070 06 01 05 05 07 03 08 30 0d 06 09 2a 86 48 86 f7 |.......0...*.H..|

00000080 0d 01 01 05 05 00 03 82 02 01 00 10 97 8a c3 5c |...............\|

00000090 03 44 36 dd e9 b4 ad 77 db ce 79 51 4d 01 b1 2e |.D6....w..yQM...|

000000a0 74 71 5b 6d 0c 13 ab ce be 7b 8f b8 2e d4 12 a2 |tq[m.....{......|

000000b0 8c 6d 62 b8 57 02 cb 4e 20 13 50 99 dd 7a 40 e2 |.mb.W..N .P..z@.|

000000c0 57 bb af 58 9a 1c e1 1d 01 86 ac bb 78 f2 8b d0 |W..X........x...|

000000d0 ec 3b 01 ee e2 be 8f 0a 05 c8 8d 48 e2 f0 53 15 |.;.........H..S.|

000000e0 dd 4f ab 92 e4 e7 8d 6a d5 80 c1 e6 94 f2 06 2f |.O.....j......./|

000000f0 85 03 e9 91 2a 24 22 70 fb f6 fc e4 78 99 2e 0d |....*$"p....x...|

00000100 f7 07 e2 70 bc 18 4e 9d 8e 6b 0a 72 95 b8 a1 39 |...p..N..k.r...9|

00000110 9c 67 2d c5 51 0e ea 62 5c 3f 16 98 8b 20 3f e2 |.g-.Q..b\?... ?.|

00000120 07 1a 32 f9 cc 31 4a 76 31 3d 2b 72 0b c8 ea 70 |..2..1Jv1=+r...p|

00000130 3d ff 85 0a 13 df c2 0a 61 8e f0 d7 b8 17 eb 4e |=.......a......N|

00000140 8b 7f c5 35 2b 5e a3 bf eb bc 7d 0b 42 7b d4 53 |...5+^....}.B{.S|

00000150 72 21 ee 30 ca bb 78 65 5c 5b 01 17 0a 14 0e d2 |r!.0..xe\[......|

00000160 da 14 98 f5 3c b9 66 58 b3 2d 2f e7 f9 85 86 cc |....<.fX.-/.....|

00000170 51 56 e8 9d 70 94 6c ac 39 4c d4 f6 79 bf aa 18 |QV..p.l.9L..y...|

00000180 7a 62 29 ef a2 9b 29 34 06 77 1a 62 c9 3d 1e 6d |zb)...)4.w.b.=.m|

00000190 1f 82 f0 0b c7 2c bb cf 43 b3 e5 f9 ec 7d b5 e3 |.....,..C....}..|

000001a0 a4 a8 74 35 b8 4e c5 71 23 12 26 76 0b 3c 52 8c |..t5.N.q#.&v.<R.|

000001b0 71 5a 46 43 14 bc b3 b3 b0 4d 67 c8 9f 42 ff 80 |qZFC.....Mg..B..|

000001c0 79 21 80 9e 15 30 66 e8 42 12 5e 1a c8 9e 22 21 |y!...0f.B.^..."!|

000001d0 d0 43 e9 2b e9 bb f4 48 cc 2c d4 d8 32 80 4c 26 |.C.+...H.,..2.L&|

000001e0 2a 48 24 5f 5a ea 56 ef a6 de 99 9d ca 3a 6f bd |*H$_Z.V......:o.|

000001f0 81 27 74 06 11 ee 76 21 bf 9b 82 c1 27 54 b6 b1 |.'t...v!....'T..|

00000200


If there is anything else needed I can provide it. Once again this is my last attempt before just wiping this so I a fine with trying anything risky. Thank you all very much in advance and I look forward getting any feedback.

Posted on Aug 21, 2015 10:26 AM

Reply
26 replies

Aug 26, 2015 12:43 PM in response to Picklegunner

Wow this took forever. Here is the results of the test disk scan:


TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org


Disk /dev/rdisk0 - 1000 GB / 931 GiB - 1953525168 sectors (RO)


The harddisk (1000 GB / 931 GiB) seems too small! (< 1500 GB / 1397 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...


The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 1368697632 2538672927 1169975296

MS Data 1369608384 2539583679 1169975296

MS Data 1953521663 2930135487 976613825









[ Continue ]

NTFS, blocksize=4096, 599 GB / 557 GiB

Aug 30, 2015 11:03 AM in response to Picklegunner

The first two MS Data entries look very suspect. I picked the following which looks the most reasonable.


GPT 3 StartGPT 3 SizeGPT 3 EndNTFS StartSector OffsetNTFS SizeNTFS EndSector Offset (MB)NTFS(Gb)
68466172012695366859312569769078392909765839766138251953521663142,078465.69


The large gap indicates that Windows may have been resized. Does the NTFS size look reasonable?


Scroll to each MS Data and use 'P' to list files. Use Escape (only once) to get back to the list. We are looking for something similar to this. As a short cut scroll to the one indicated by the NTFS Start value and check.


User uploaded file

Aug 30, 2015 11:24 AM in response to Loner T

Nearly every one of the MS Data entries, upon pressing 'p', give "Can't open filesystem. Filesystem seems damaged"


The only entry that worked correctly was this:

>D MS Data 1024035083 1024055821 20739 [NO NAME]

FAT12, blocksize=4096, 10 MB / 10 MiB

After listing the files it returned something much different than the picture you provided.

TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

MS Data 1024035083 1024055821 20739 [NO NAME]

Directory /


>-rwxr-xr-x 0 0 5242972 2-Feb-1980 23:02 H .

-rwxr-xr-x 0 0 6881384 27-Feb-1980 23:03 r

-rwxr-xr-x 0 0 7536735 18-Mar-1980 23:03 m

-rwxr-xr-x 0 0 96 4-Feb-1928 17:04 s

-rwxr-xr-x 0 0 7471207 17-Mar-1980 23:02 g

-rwxr-xr-x 0 0 4259932 1-Mar-1980 23:03 a

-rwxr-xr-x 0 0 2097253 20-Mar-1980 23:03 d

-rwxr-xr-x 0 0 7274601 29-Feb-1980 23:03 C

-rwxr-xr-x 0 0 6029428 4-Mar-1980 23:03 n

-rwxr-xr-x 0 0 6619234 3-Mar-1980 23:02 C

-rwxr-xr-x 0 0 67633439 27-Jan-1980 23:03 .

-rwxr-xr-x 0 0 5242972 2-Feb-1980 23:02 l _

-rwxr-xr-x 0 0 7274596 27-Feb-1980 23:03 r

-rwxr-xr-x 0 0 6422633 19-Mar-1980 23:03 b

-rwxr-xr-x 0 0 7471221 8-Mar-1980 23:03 u

-rwxr-xr-x 0 0 7602286 2-Feb-1980 23:03 a

-rwxr-xr-x 0 0 4259932 17-Mar-1980 23:03 e

-rwxr-xr-x 0 0 55 4-Feb-1928 17:04 d

-rwxr-xr-x 0 0 7471207 17-Mar-1980 23:02 7

Next

Use Right to change directory, h to hide deleted files

q to quit, : to select the current file, a to select all files

C to copy the selected files, c to copy the current file

Need help with corrupted MBR on Yosemite - Windows 7 computer

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.