Another lost bootcamp partition after EC upgrade

Question

Level 1

8 points

Another lost bootcamp partition after EC upgrade

Hi there.

I had OS X Yosemite with a working bootcamp partition with Windows 10 on my MBP early 2013 edition. I've tried to resize the BC partition previously, which resulted in that I couldn't boot it directly from the BC panel within OSX, but I managed to boot Windows by holding the alt key during bootup. After installing El Capitan, I can no longer see the BC partition.

I've looked thru several threads like this, which suggest using TestDisk and Gdisk. Before I do anything drastic, I'd like to post my results from testdisk here, and ask what I should do in gdisk, as I'm very confused when I look at the testdisk output

MacBook Pro with Retina display, OS X El Capitan (10.11)

Posted on Oct 7, 2015 4:26 AM

Reply

Answer 1

lars667 Author

Level 1

8 points

Oct 7, 2015 4:46 AM in response to lars667

Ooops, I pressed Enter instead of P, so now I have to do the quick search again, which will take another hour or two. The Boot volume contains the Volume System Information, but nothing else. Everything seems to be scattered thru all these MS Data "partitions".

Hoping for a response from the great Loner T :-)

Best regards,

Lars Erik

Reply

Answer 2

lars667 Author

Level 1

8 points

Oct 7, 2015 5:56 AM in response to lars667

This entry is the only ms data entry with any content, besides the [Boot] entry. Is there any hope for recovery? It's not total disaster if I loose my W10 partition, but I'd rather not :-)

Reply

Answer 3

Loner T

Level 9

59,471 points

Oct 7, 2015 6:07 AM in response to lars667

Can you check the output of 'p' command in MS Data entries at 675276800 and the next one (which is 7 sectors further)? The size information of 300898297 looks promising.

Can you post the current GPT (in text format, if possible)?

Reply

Answer 4

lars667 Author

Level 1

8 points

Oct 7, 2015 8:34 AM in response to Loner T

TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

MS Data 675276800 976175096 300898297

Can't open filesystem. Filesystem seems damaged.

TestDisk 7.0, Data Recovery Utility, April 2015

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

MS Data 675276807 976175103 300898297

Can't open filesystem. Filesystem seems damaged.

Reply

Answer 5

Loner T

Level 9

59,471 points

Oct 7, 2015 8:54 AM in response to lars667

Please post the GPT.

Reply

Answer 6

lars667 Author

Level 1

8 points

Oct 7, 2015 8:56 AM in response to lars667

And the GPT:

Number Start (sector) End (sector) Size Code Name

1 40 409639 200.0 MiB EF00 EFI system partition

2 409640 675276655 321.8 GiB AF05 Macintosh HD

3 675276656 676546191 619.9 MiB AB00 Recovery HD

4 782929920 977104895 92.6 GiB 0700 BOOTCAMP

Reply

Answer 7

Loner T

Level 9

59,471 points

Oct 7, 2015 9:10 AM in response to lars667

Can you post the output of sudo gpt -vv -r show /dev/disk0 ?

It provides a bit more detail.

Reply

Answer 8

lars667 Author

Level 1

8 points

Oct 7, 2015 9:41 AM in response to Loner T

Of course. Thank you very much for your swift replies and helpful attitude, btw!

Larss-MacBook-Pro:gptfdisk-1.0.0 larsekol$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500277790720; sectorsize=512; blocks=977105060

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 977105059

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 674867016 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

675276656 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

676546192 106383728

782929920 194174976 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

977104896 131

977105027 32 Sec GPT table

977105059 1 Sec GPT header

Larss-MacBook-Pro:gptfdisk-1.0.0 larsekol$

Reply

Answer 9

Loner T

Level 9

59,471 points

Oct 7, 2015 10:20 AM in response to lars667

The Gap between GPT3 and 4 + the size of GPT4 is 300558704, while sizes reported in Testdisk are 300898297 .

This is where we should be looking, but they are unfortunately damaged. Can you check the first MS Data?

Reply

Answer 10

lars667 Author

Level 1

8 points

Oct 7, 2015 10:38 AM in response to Loner T

Also damaged :-(

Reply

Answer 11

lars667 Author

Level 1

8 points

Oct 8, 2015 1:34 AM in response to lars667

The only other one with content, is this (highlighted line: 788020278, I left out the rest because of invalid characters):

>D MS Data 788020278 788037347 17070 [NO NAME]

MS Data 788020278 788037347 17070 [NO NAME]

Directory /

>-rwxr-xr-x 0 0 3976728 24-Oct-1947 16:31 ~F^A

-rwxr-xr-x 0 0 139184 22-Jan-1957 16:33 ^A

-rwxr-xr-x 0 0 144624 2-Oct-1943 17:31 8 <

-rwxr-xr-x 0 0 3983424 21-Sep-2010 00:00 ~X9^B

-rwxr-xr-x 0 0 147082 15-Jan-2011 23:01 @=^B

-rwxr-xr-x 0 0 147952 18-Mar-1944 16:31 `

-rwxr-xr-x 0 0 3983536 2-Sep-2013 00:00 !B^B

-rwxr-xr-x 0 0 148661 15-Mar-2014 23:01 @C^B

-rwxr-xr-x 0 0 148816 18-May-1944 17:31 <

-rwxr-xr-x 0 0 3983600 14-Jan-2015 23:00 ~GE^B

-rwxr-xr-x 0 0 149432 16-Oct-2015 00:01 @F^B

-rwxr-xr-x 0 0 149680 18-Jul-1944 17:31

-rwxr-xr-x 0 0 3983664 3-May-2018 00:00 ^VI^B

-rwxr-xr-x 0 0 151925 16-Sep-2020 00:01 `M^B

-rwxr-xr-x 0 0 152192 17-Sep-1944 17:31 H

-rwxr-xr-x 0 0 3983728 8-Dec-2021 23:00 R^B

-rwxr-xr-x 0 0 152605 30-Dec-2021 23:01 S^B

-rwxr-xr-x 0 0 153328 17-Nov-1944 16:31 ~H

-rwxr-xr-x 0 0 3983792 19-Jan-2023 23:00 "W^B

-rwxr-xr-x 0 0 155669 31-Mar-2026 00:01 ^B

-rwxr-xr-x 0 0 156048 25-Dec-1945 16:31 D

-rwxr-xr-x 0 0 3984624 20-Nov-2032 23:00 Ac^B

-rwxr-xr-x 0 0 167201 22-Jan-1910 16:33 ~@i^B

-rwxr-xr-x 0 0 169520 26-Jan-1949 16:31 <

-rwxr-xr-x 0 0 3986456 10-Feb-1932 16:31 y ^B

-rwxr-xr-x 0 0 184605 24-May-1933 16:33 ~@ ^B

-rwxr-xr-x 0 0 192528 17-Sep-1955 16:31 p

-rwxr-xr-x 0 0 3989436 28-Aug-1964 17:31 F^B

-rwxr-xr-x 0 0 193322 24-May-1965 17:33 ^B

-rwxr-xr-x 0 0 196464 29-Nov-1955 16:31 <

-rwxr-xr-x 0 0 3989992 1-Sep-1981 00:00 ^B

-rwxr-xr-x 0 0 201405 30-Jun-1985 00:01 p^C^C

-rwxr-xr-x 0 0 202704 22-Dec-1957 16:31 ~X

-rwxr-xr-x 0 0 3993068 16-Aug-2018 00:00 ^K^X^C

-rwxr-xr-x 0 0 221526 31-Aug-2028 00:01 .t

-rwxr-xr-x 0 0 221744 6-Dec-1965 16:31 ~T <

-rwxr-xr-x 0 0 3995076 4-Jan-2029 23:00 ~^b^C

-rwxr-xr-x 0 0 224824 30-Dec-2034 23:01 c^C

-rwxr-xr-x 0 0 228224 10-Dec-1968 16:31 x <

-rwxr-xr-x 0 0 3997104 23-Aug-1910 16:31 ^C

-rwxr-xr-x 0 0 244615 9-Sep-1937 16:33 ~@~M^C

-rwxr-xr-x 0 0 244800 4-Jul-1983 00:00 ^F=

-rwxr-xr-x 0 0 3999484 6-Aug-1938 16:31 w ^C

-rwxr-xr-x 0 0 245672 10-Oct-1939 16:33 @ ^C

-rwxr-xr-x 0 0 246528 15-Mar-1984 23:00 ^G=

-rwxr-xr-x 0 0 3999928 1-Dec-1941 17:31 L^C

-rwxr-xr-x 0 0 247087 22-Feb-1942 17:33 ^P^C

-rwxr-xr-x 0 0 247376 12-Sep-1984 00:00 ^H=

-rwxr-xr-x 0 0 4000252 10-Jan-1946 16:31 ^C

-rwxr-xr-x 0 0 249497 22-Feb-1947 16:33 ^C

-rwxr-xr-x 0 0 249728 3-Jan-1986 23:00 ^L^L=

-rwxr-xr-x 0 0 4000868 18-Aug-1948 16:31 9^C

-rwxr-xr-x 0 0 250503 10-Jan-1949 16:33 @^C

-rwxr-xr-x 0 0 251072 28-May-1986 00:00 ~\^L=

-rwxr-xr-x 0 0 4000980 8-Nov-1950 16:31 ^E^C

-rwxr-xr-x 0 0 251672 9-Apr-1951 16:33 ^C

-rwxr-xr-x 0 0 251856 28-Jul-1986 00:00 ^L=

-rwxr-xr-x 0 0 4001044 26-Nov-1953 16:31 ^C

=-rwxr-xr-x 0 0 253159 24-Apr-1954 16:33 .^\

=-rwxr-xr-x 0 0 253664 28-Sep-1986 00:00 ,

-rwxr-xr-x 0 0 4001156 21-Mar-1956 16:31 &^C

-rwxr-xr-x 0 0 254443 25-Nov-1955 16:33 ^C

=-rwxr-xr-x 0 0 254816 11-Jan-1986 23:00 ~\

-rwxr-xr-x 0 0 4001220 16-Jun-1958 16:31 ~I^C

Reply

Answer 12

Loner T

Level 9

59,471 points

Oct 8, 2015 6:16 AM in response to lars667

The dates in this section do not make any sense. The MFT is corrupt. The size of 17070 sectors is small. Testdisk does not rebuild the MFT (like chkdsk can). Some derivatives of Testdisk can. There are (numerous) commercial variants of such software. You can try Stellar Phoenix (or similar) to see if they can produce a reasonable MFT.

Reply