Upgrading to El Capitan (and me) broke Windows

Question

Level 1

0 points

Upgrading to El Capitan (and me) broke Windows

Alright, so I tried to be smart and fix this myself and proooobably definitely made it worse. I have a 2012 rMBP. I had Yosemite installed along side of Windows 10. I use Windows 10 a lot more than OSX so I wanted to resize it to be a bit bigger.

I heard installing El Capitan can mess with Bootcamp so I decided to do that first. Lo and behold, I lost the ability to boot into Windows. I got the evil "No bootable device -- insert boot disk and press any key."

I tried fixing it on my own. I decided that if I was going to be messing with boot records anyway, I might as well as resize and move my Windows partition to give it more space. I used a GParted live USB to do that and then gdisk to try and recreate the hybrid MBR.

After that I had an option to boot into Windows. That's good. Trying to boot it would instantly BSOD with a 0x225 error about winload.exe. A BSOD was good, it was loading something from the partition. I created a Windows 10 install USB from my desktop with the intentions of startup recovery. Interestingly enough, it would freeze whenever it got to the Windows logo when it should be loading. I'm not sure if it was an issue with the flash drive, ISO, or what. I ended up creating a recovery USB which copied the system files from my desktop I believe. With that, I was able to get into Windows Recovery Environment.

From there, automatic startup repair was useless like always. I tried bootrec.exe /fixmbr. It said it was successful, but it didn't help anything. With the hybrid MBR though, I'm not actually sure whether it's booting through EFI or MBR. I also tried some bootrec.exe commands, but those gave me "The requested system device cannot be found." /ScanOs would find the install, but /FixBoot gave me that error.

The state my laptop's currently at: when I hold option to select a boot disk I have two "Macintosh HD" options that both bring me to the same install of OSX. OSX boots up fine. The recovery environment did mount my C: drive with all of my files so I know my data's still intact if I can just fix this booting stuff.

Here's some diagnostic output after I finished ******* everything up worse: https://gist.github.com/NullEntity/5461785af697d4902677

MacBook Pro (Retina, Mid 2012), OS X El Capitan (10.11.1)

Posted on Nov 21, 2015 12:58 PM

Reply

Answer 1

Loner T

Level 9

59,471 points

Nov 21, 2015 1:38 PM in response to NullEntity

Reboot, so your disk0s5 becomes disk0s4 and then post the output of

sudo dd if=/dev/rdisk0s4 count=1 2> /dev/null | hexdump -C

It seems you had an additional partition, which was erased, causing your BC partition to be disk0s5.

Reply

Answer 2

NullEntity Author

Level 1

0 points

Nov 21, 2015 1:52 PM in response to Loner T

Thanks for the quick response.

Bryces-MacBook-Pro:Desktop bryce$ diskutil list

/dev/disk0 (internal, physical):

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *500.3 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_CoreStorage Macintosh HD 250.4 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: Microsoft Basic Data BOOTCAMP 249.0 GB disk0s5

/dev/disk1 (internal, virtual):

#: TYPE NAME SIZE IDENTIFIER

0: Apple_HFS Macintosh HD +250.0 GB disk1

Logical Volume on disk0s2

8898FBA0-DF5E-41E5-9F16-BEDE603FBC6E

Unencrypted

Bryces-MacBook-Pro:Desktop bryce$ sudo dd if=/dev/rdisk0s4 count=1 2> /dev/null | hexdump -C

Password:

Bryces-MacBook-Pro:Desktop bryce$

I have a dd image from right after the El Capitan update if you think restoring back to that could help. One interesting note, when I rebooted it did try booting into Windows and gave "No operating system found". When I held option it still showed the two Macintosh HD disks which bring me to the same OSX install.

Reply

Answer 3

Loner T

Level 9

59,471 points

Nov 21, 2015 1:55 PM in response to NullEntity

Please post the output of

sudo gpt -vv -r show /dev/disk0

If after reboot, the disk is still disk0s5, it is very strange.

Reply

Answer 4

NullEntity Author

Level 1

0 points

Nov 21, 2015 1:57 PM in response to Loner T

Bryces-MacBook-Pro:Desktop bryce$ sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500277790720; sectorsize=512; blocks=977105060

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 977105059

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 489006296 2 GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

489415936 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

490685472 992

490686464 486418432 5 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

977104896 131

977105027 32 Sec GPT table

977105059 1 Sec GPT header

Reply

Answer 5

Loner T

Level 9

59,471 points

Nov 21, 2015 2:04 PM in response to NullEntity

GPT5 is making it disk0s5. Use rdisk0s5 to execute the dd.

Please post sudo fdisk /dev/disk0.

Reply

Answer 6

NullEntity Author

Level 1

0 points

Nov 21, 2015 2:17 PM in response to Loner T

Looks like trying to paste it all here truncated my output: https://gist.github.com/NullEntity/205b06461024ed32e155

Reply

Answer 7

NullEntity Author

Level 1

0 points

Nov 21, 2015 3:36 PM in response to NullEntity

whoops, and here's my fdisk

Bryces-MacBook-Pro:Desktop bryce$ sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 60821/255/63 [977105060 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

*1: EE 0 0 2 - 25 127 14 [ 1 - 409639] <Unknown ID>

2: AF 25 127 15 - 1023 254 63 [ 409640 - 489006296] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 489415936 - 1269536] Darwin Boot

4: 07 1023 254 63 - 1023 254 63 [ 490686464 - 486418432] HPFS/QNX/AUX

Reply

Answer 8

Loner T

Level 9

59,471 points

Nov 21, 2015 5:57 PM in response to NullEntity

Strange to see the EFI partition marked as bootable in the MBR. We should first correct the GPT and then re-create the MBR. We will delete GPT5 and recreated it as GPT4.

Install GPT Fdisk (aka gdisk). Leave your Testdisk display and start a new Terminal Window. You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message. The following steps have values from your Testdisk output (and you can verify) in Steps 7 and 8. Please notice the'+' sign in step 8 (this is called offset notation). The text in parentheses is for informational purpose to describe the action being taken. Gdisk has one-character commands except when entering numbers.

Rebuild GPT4 using start/end offsets

Sudo gdisk /dev/rdisk0
P (print the full list of parts)
D (delete)
5 (part 5 - your GPT is not normal)
N (new part)
4 (part 4 - recreate it as GPT4)
490686464 ( - Start offset in sectors or the start point for Bootcamp part)
+486418432 ( - Size offset, as opposed to End offset)
0700 (Windows part type)
P (print list of all parts just to see what changes will be made)
W (Write the new GPT)
Y (Yes! really write the new GPT)

This will delete and re-write the GPT partition info for /dev/disk0s4.

Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Use defaults for other questions (like partition codes). The only values that need modifications are the Boot flags and step 10. Accept all other defaults that Gdisk offers. Please see thesample Q&A as an example. These steps can be repeated if you make a mistake before you get to Step 12, otherwise start from Step 1 for these steps. Step 6 has numbers which are typed with a space between the numbers. Please see the sample Q&A before you execute these steps.

Sudo gdisk /dev/rdisk0
P (Print list of parts)
R (Recover)
O (print current Hybrid MBR)
H (chooses Hybrid)
Partitions numbers to be hybridized: 2 3 4
Y (Good for GRUB question)
N (part 2 boot flag)
N (part 3 boot flag)
Y (part 4 boot flag make NTFS bootable partition)
O (print current Hybrid MBR)
W (Write the new MBR)
Y (Yes! write the new MBR)
Reboot

Here is sample Q&A for this section. Please notice the Press Enter/Return.

Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): Y

Creating entry for GPT partition #2 (MBR partition #2)

Enter an MBR hex code (default AF): Press Enter/Return

Set the bootable flag? (Y/N): N

Creating entry for GPT partition #3 (MBR partition #3)

Enter an MBR hex code (default AB): Press Enter/Return

Set the bootable flag? (Y/N): N

Creating entry for GPT partition #4 (MBR partition #4)

Enter an MBR hex code (default 07): Press Enter/Return

Set the bootable flag? (Y/N): Y

Test 1 - Does Bootcamp Volume show up in Finder?

Test 2 - Can you see files in Bootcamp Volume?

Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

Reply

Answer 9

NullEntity Author

Level 1

0 points

Nov 21, 2015 6:00 PM in response to Loner T

Awesome! It shows up in Finder and I can see the files. The bootloader on the Windows side is still messed up. I get a BSOD saying

"The application or operating system couldn't be loaded because a required file is missing or contains errors.

File: \WINDOWS\system32\winload.exe

Error code: 0xc0000225"

Are you able to assist me with this? Thanks so much for getting me this far, this is a lot better state than it was in before!

Reply

Answer 10

Loner T

Level 9

59,471 points

Nov 21, 2015 6:21 PM in response to NullEntity

You will need Windows Startup Repair or command line work.

Please see https://support.microsoft.com/en-us/kb/929833 and https://technet.microsoft.com/en-us/library/bb491008.aspx .

Another approach is to use NTFS write-capable software (Tuxera, Paragon, or similar) from the OSX side and replace the winload.exe and test boot-ablity.

Remove such software before you try to boot Windows.

Reply

Answer 11

NullEntity Author

Level 1

0 points

Nov 21, 2015 11:55 PM in response to Loner T

Alright, this is the weirdest thing I've ever seen. I've booted into a recovery USB, tried automatic repair again, nada. It said that the log file was at "Log:" with no path. I tried running "sfc /scannow" and it sat at "Beginning system scan. This process will take some time." I did NOT get the "Beginning verification phase of system scan." message that should show up. I left it while I did other stuff thinking it might be doing something, but 5 hours later it didn't get anywhere. I tried creating a USB drive from a different source and I still had the same issue. I checked the CBS.log and there were no entries from today. I checked that the volume and disk are not read only. I was able to create directories in C:\.

Any ideas?

Reply

Answer 12

Loner T

Level 9

59,471 points

Nov 22, 2015 7:00 AM in response to NullEntity

Verify that C: is really the drive you are interested in using diskpart. You may want to run chkdsk /f on appropriate C: first. If chkdsk is clean, then try sfc.

Reply

Answer 13

NullEntity Author

Level 1

0 points

Nov 22, 2015 10:25 AM in response to Loner T

Yup, C: is the right drive. My symptoms sound exactly like what's said here: http://superuser.com/a/359669/168053

chkdsk is clean but I get an error that it can't save to the event log. Seems that the recovery environment isn't able to write to my disk, but I can by hand.

Reply

Answer 14

Loner T

Level 9

59,471 points

Nov 22, 2015 11:43 AM in response to NullEntity

Your 2012 MBP has two USB slots, try both of them.

Reply

Answer 15

NullEntity Author

Level 1

0 points

Nov 22, 2015 12:34 PM in response to Loner T

Same issues on the other port too. I tried doing a Refresh and keeping my data, but I got an error saying that the drive was locked. I ensured that that partition's marked active and the volume and partition are not readonly. Any ideas on what could be wrong?

Reply