WEE ER

Q: lose windows partition after i upgrading to El Capitan

Hi loner ,

thx for reply just now.

i lose windows partition after i upgrading to El Capitan.This is the information i can give. i not sure that whether i can follow the step on top.

Last login: Mon Dec  7 13:33:44 on ttys000

DME-MB1455700:~ ertarwee$ diskutil list

/dev/disk0 (internal, physical):

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:      GUID_partition_scheme                        *500.1 GB   disk0

   1:                        EFI EFI                     209.7 MB   disk0s1

   2:          Apple_CoreStorage Macintosh HD            320.4 GB   disk0s2

   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3

   4:       Microsoft Basic Data                         80.0 GB    disk0s4

/dev/disk1 (internal, virtual):

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:                  Apple_HFS Macintosh HD           +320.0 GB   disk1

                                 Logical Volume on disk0s2

                                 8E69B371-667C-4F08-8A5A-792FD82F4C26

                                 Unlocked Encrypted

DME-MB1455700:~ ertarwee$ diskutil cs list

CoreStorage logical volume groups (1 found)

|

+-- Logical Volume Group 5E40D0AB-1F00-4327-8F5C-A499053E7F1A

    =========================================================

    Name:         Macintosh HD

    Status:       Online

    Size:         320377606144 B (320.4 GB)

    Free Space:   18894848 B (18.9 MB)

    |

    +-< Physical Volume B334FFE9-B4A9-42B1-A6B4-E190A79040B9

    |   ----------------------------------------------------

    |   Index:    0

    |   Disk:     disk0s2

    |   Status:   Online

    |   Size:     320377606144 B (320.4 GB)

    |

    +-> Logical Volume Family 3EB48281-B3C4-4E3C-B94A-34DC5293534D

        ----------------------------------------------------------

        Encryption Type:         AES-XTS

        Encryption Status:       Unlocked

        Conversion Status:       Converting (forward)

        High Level Queries:      Not Fully Secure

        |                        Passphrase Required

        |                        Accepts New Users

        |                        Has Visible Users

        |                        Has Volume Key

        |

        +-> Logical Volume 8E69B371-667C-4F08-8A5A-792FD82F4C26

            ---------------------------------------------------

            Disk:                  disk1

            Status:                Online

            Size (Total):          320006389760 B (320.0 GB)

            Conversion Progress:   65%

            Revertible:            Yes (unlock and decryption required)

            LV Name:               Macintosh HD

            Volume Name:           Macintosh HD

            Content Hint:          Apple_HFS

DME-MB1455700:~ ertarwee$  sudo gpt -vv -r show/dev/disk0

Password:

gpt: unknown command: show/dev/disk0

DME-MB1455700:~ ertarwee$  sudo gpt -vv -r show /dev/disk0

gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 976773167

      start       size  index  contents

          0          1         MBR

          1          1         Pri GPT header

          2         32         Pri GPT table

         34          6        

         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

     409640  625737512      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC

  626147152    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

  627416688  193108368        

  820525056  156248064      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

  976773120         15        

  976773135         32         Sec GPT table

  976773167          1         Sec GPT header

DME-MB1455700:~ ertarwee$  sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]

Signature: 0xAA55

         Starting       Ending

#: id  cyl  hd sec -  cyl  hd sec [     start -       size]

------------------------------------------------------------------------

1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>

2: AC 1023 254  63 - 1023 254  63 [    409640 -  625737512] <Unknown ID>

3: AB 1023 254  63 - 1023 254  63 [ 626147152 -    1269536] Darwin Boot

4: 0C 1023 254  63 - 1023 254  63 [ 820525056 -  156248064] Win95 FAT32L

DME-MB1455700:~ ertarwee$

Posted on Dec 7, 2015 5:35 AM

Close

Q: lose windows partition after i upgrading to El Capitan

  • All replies
  • Helpful answers

Page 1 Next
  • by Loner T,

    Loner T Loner T Dec 7, 2015 5:41 AM in response to WEE ER
    Level 7 (24,115 points)
    Safari
    Dec 7, 2015 5:41 AM in response to WEE ER

    The gap between GPT3 and GPT4 indicates a lost NTFS header. This usually happens if the Windows partition was resized using third-party tools which do not understand the partitioning scheme used for keep OS X and Windows in sync.

     

    Can you use El Capitan has deleted my bootcamp windows partition as a reference and download Testdisk and GPT Fdisk and start a Testdisk scan and run a Quick Search?

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 6:03 AM in response to Loner T
    Level 1 (0 points)
    Dec 7, 2015 6:03 AM in response to Loner T

    ok thx for replying , i got this ,which one should i choose?

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

     

    TestDisk is free data recovery software designed to help recover lost

    partitions and/or make non-booting disks bootable again when these symptoms

    are caused by faulty software, certain types of viruses or human error.

    It can also be used to repair some filesystem errors.

     

    Information gathered during TestDisk use can be recorded for later

    review. If you choose to create the text file, testdisk.log , it

    will contain TestDisk options, technical information and various

    outputs; including any folder/file names TestDisk was used to find and

    list onscreen.

     

    Use arrow keys to select, then press Enter key:

    >[ Create ] Create a new log file

    [ Append ] Append information to log file

    [ No Log ] Don't record anything

  • by Loner T,

    Loner T Loner T Dec 7, 2015 6:23 AM in response to WEE ER
    Level 7 (24,115 points)
    Safari
    Dec 7, 2015 6:23 AM in response to WEE ER

    The first time you run Testdisk, it should be Create. All subsequent runs should be Append.

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 6:33 AM in response to WEE ER
    Level 1 (0 points)
    Dec 7, 2015 6:33 AM in response to WEE ER

    i had follow the step you given from the link ,is it my partition table correct?

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

    Disk /dev/rdisk0 - 500 GB / 465 GiB - 976773168 sectors (RO)

         Partition               Start        End    Size in sectors

    P EFI System                    40     409639     409600 [EFI]

    D Mac HFS                   409640  625422119  625012480

    D MS Data                278061064  627417088  349356025

    D Mac HFS                626147152  627416687    1269536

    >D MS Data                627417088  976773112  349356025

    D MS Data                627417095  976773119  349356025

    D Mac HFS                975503592  976773127    1269536

     

     

     

     

     

    Structure: Ok.  Use Up/Down Arrow keys to select partition.

    Use Left/Right Arrow keys to CHANGE partition characteristics:

                    P=Primary  D=Deleted

    Keys A: add partition, L: load backup, T: change type, P: list files,

         Enter: to continue

    NTFS, blocksize=4096, 178 GB / 166 GiB

    Password:

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

     

     

     

     

     

    TestDisk 7.0, Data Recovery Utility, April 2015

    Christophe GRENIER <grenier@cgsecurity.org>

    http://www.cgsecurity.org

         MS Data                627417088  976773112  349356025

    Directory /

     

    >dr-xr-xr-x     0     0         0  2-Dec-2015 19:44 .

    dr-xr-xr-x     0     0         0  2-Dec-2015 19:44 ..

    dr-xr-xr-x     0     0         0 13-Jul-2014 11:20 $Recycle.Bin

    dr-xr-xr-x     0     0         0 19-Nov-2014 15:08 AdwCleaner

    dr-xr-xr-x     0     0         0 27-Oct-2015 18:25 Autodesk

    dr-xr-xr-x     0     0         0 18-Sep-2014 16:45 Boot

    dr-xr-xr-x     0     0         0 26-Nov-2015 10:36 Config.Msi

    dr-xr-xr-x     0     0         0 11-Apr-2014 05:48 Intel

    dr-xr-xr-x     0     0         0 27-Oct-2015 10:11 Inventor 2014 (x64)[Educatio

    dr-xr-xr-x     0     0         0 11-Apr-2014 14:34 MSOCache

    dr-xr-xr-x     0     0         0 22-Aug-2013 23:22 PerfLogs

    dr-xr-xr-x     0     0         0 28-Oct-2015 12:50 Program Files

    dr-xr-xr-x     0     0         0 21-Nov-2015 20:29 Program Files (x86)

    dr-xr-xr-x     0     0         0  4-Dec-2015 21:59 ProgramData

                                                       Next

    Use Right to change directory, h to hide Alternate Data Stream

        q to quit, : to select the current file, a to select all files

        C to copy the selected files, c to copy the current file

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 7:04 AM in response to WEE ER
    Level 1 (0 points)
    Dec 7, 2015 7:04 AM in response to WEE ER

    This is the final result i get , but it's cannot work.can you help me check where am i wrong .

     

     

     

     

    Last login: Mon Dec  7 22:59:04 on ttys000

    DME-MB1455700:~ ertarwee$  sudo gdisk /dev/rdisk0

    GPT fdisk (gdisk) version 1.0.1

     

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    NOTE: Write test failed with error number 1. It will be impossible to save

    changes to this disk's partition table!

    You may need to deactivate System Integrity Protection to use this program. See

    https://www.quora.com/How-do-I-turn-off-the-rootless-in-OS-X-El-Capitan-10-11

    for more information.

     

    Partition table scan:

      MBR: hybrid

      BSD: not present

      APM: not present

      GPT: present

     

    Found valid GPT with hybrid MBR; using GPT.

     

    Command (? for help): P

    Disk /dev/rdisk0: 976773168 sectors, 465.8 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): D7FC1E76-B3DE-41B1-8484-A2E76F4BE28E

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 976773134

    Partitions will be aligned on 8-sector boundaries

    Total free space is 193108389 sectors (92.1 GiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EFI System Partition

       2          409640       626147151   298.4 GiB   AF05  Macintosh HD

       3       626147152       627416687   619.9 MiB   AB00  Recovery HD

       4       820525056       976773119   74.5 GiB    0700  BOOTCAMP

     

    Command (? for help): R

     

    Recovery/transformation command (? for help): O

     

    Disk size is 976773168 sectors (465.8 GiB)

    MBR disk identifier: 0xDC2EC823

    MBR partitions:

     

    Number  Boot  Start Sector   End Sector   Status      Code

       1                     1       409639   primary     0xEE

       2                409640    626147151   primary     0xAC

       3             626147152    627416687   primary     0xAB

       4             820525056    976773119   primary     0x0C

     

    Recovery/transformation command (? for help): H

     

    WARNING! Hybrid MBRs are flaky and dangerous! If you decide not to use one,

    just hit the Enter key at the below prompt and your MBR partition table will

    be untouched.

     

    Type from one to three GPT partition numbers, separated by spaces, to be

    added to the hybrid MBR, in sequence: 2 3 4

    Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): Y

     

    Creating entry for GPT partition #2 (MBR partition #2)

    Enter an MBR hex code (default AF):

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #3 (MBR partition #3)

    Enter an MBR hex code (default AB):

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #4 (MBR partition #4)

    Enter an MBR hex code (default 07):

    Set the bootable flag? (Y/N): Y

     

    Recovery/transformation command (? for help): O

     

    Disk size is 976773168 sectors (465.8 GiB)

    MBR disk identifier: 0xDC2EC823

    MBR partitions:

     

    Number  Boot  Start Sector   End Sector   Status      Code

       1                     1       409639   primary     0xEE

       2                409640    626147151   primary     0xAF

       3             626147152    627416687   primary     0xAB

       4      *      820525056    976773119   primary     0x07

     

    Recovery/transformation command (? for help): W

     

    Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING

    PARTITIONS!!

     

    Do you want to proceed? (Y/N): Y

    OK; writing new GUID partition table (GPT) to /dev/rdisk0.

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Unable to open device '/dev/rdisk0' for writing! Errno is 1! Aborting write!

     

    Recovery/transformation command (? for help):

  • by Loner T,

    Loner T Loner T Dec 7, 2015 7:26 AM in response to WEE ER
    Level 7 (24,115 points)
    Safari
    Dec 7, 2015 7:26 AM in response to WEE ER

    There are two issues in your steps.

     

    A. We need to disable SIP.

     

    1. Boot into Local Recovery (Command+R).

    2. Start Utilities -> Terminal.

    3. Type csrutil disable in Terminal and press Enter/Return.

    4. Type csrutil status.

    5. Boot normally, and type csrutil status to confirm that all individual entries are still disabled.

     

    B. You need to rebuild the GPT first, before you recreate the MBR.

     

    This is the old GPT and the MBR using this will not work.

    4             820525056    976773119   primary     0x0C


    Leave your Testdisk display and start a new Terminal Window. You need to use the following steps. If you see any error messages during the following steps, please stop and post back here with the error message. The following steps have values from your Testdisk output (and you can verify) in Steps 7 and 8. Please notice the'+' sign in step 8 (this is called offset notation). The text in parentheses is for informational purpose to describe the action being taken. Gdisk has one-character commands except when entering numbers.

     

    Rebuild GPT4 using start/end offsets

     

    1. Sudo gdisk /dev/rdisk0
    2. P  (print the full list of parts)
    3. D  (delete)
    4. 4  (part 4)
    5. N  (new part)
    6. 4  (part 4)
    7. 627417088 ( - Start offset in sectors or the start point for Bootcamp part)
    8. +349356025 ( - Size offset, as opposed to End offset)
    9. 0700 (Windows part type)
    10. P  (print list of all parts just to see what changes will be made)
    11. W (Write the new GPT)
    12. Y  (Yes! really write the new GPT)

    This will delete and re-write the GPT partition info for /dev/disk0s4.


    Rebuild MBR to match the new GPT information thus resetting the Hybrid MBR. Use defaults for other questions (like partition codes). The only values that need modifications are the Boot flags and step 10. Accept all other defaults that Gdisk offers. Please see the sample Q&A as an example. These steps can be repeated if you make a mistake before you get to Step 12, otherwise start from Step 1 for these steps. Step 6 has numbers which are typed with a space between the numbers. Please see the sample Q&A before you execute these steps.

    1. Sudo gdisk /dev/rdisk0
    2. P  (Print list of parts)
    3. R  (Recover)
    4. O (print current Hybrid MBR)
    5. H (chooses Hybrid)
    6. Partitions numbers to be hybridized: 2 3 4
    7. Y  (Good for GRUB question)
    8. N  (part 2 boot flag)
    9. N  (part 3 boot flag)
    10. Y  (part 4 boot flag make NTFS bootable partition)
    11. O  (print current Hybrid MBR)
    12. W (Write the new MBR)
    13. Y (Yes! write the new MBR)
    14. Reboot

     

    Here is sample Q&A for this section. Please notice the Press Enter/Return.

     

    Place EFI GPT (0xEE) partition first in MBR (good for GRUB)? (Y/N): Y

     

    Creating entry for GPT partition #2 (MBR partition #2)

    Enter an MBR hex code (default AF): Press Enter/Return

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #3 (MBR partition #3)

    Enter an MBR hex code (default AB): Press Enter/Return

    Set the bootable flag? (Y/N): N

     

    Creating entry for GPT partition #4 (MBR partition #4)

    Enter an MBR hex code (default 07): Press Enter/Return

    Set the bootable flag? (Y/N): Y

     

    Test 1 - Does Bootcamp Volume show up in Finder?

    Test 2 - Can you see files in Bootcamp Volume?

    Test 3 - Can you select Bootcamp in System Preferences -> Startup Disk?

    Test 4 - If Test 3 is successful, select Bootcamp and Click Restart.

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 8:33 AM in response to Loner T
    Level 1 (0 points)
    Dec 7, 2015 8:33 AM in response to Loner T

    (A. We need to disable SIP.

     

    1. Boot into Local Recovery (Command+R).

    2. Start Utilities -> Terminal.

    3. Type csrutil disable in Terminal and press Enter/Return.

    4. Type csrutil status.

    5. Boot normally, and type csrutil status to confirm that all individual entries are still disable)

    sorry loner ,

    I am a newbie to the macbook,I may ask some stupid question, i don't know how to boot into the local recovery. i try press command+R, but nothing is showing out.Is it the utilities is the disk utility?

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 8:43 AM in response to WEE ER
    Level 1 (0 points)
    Dec 7, 2015 8:43 AM in response to WEE ER

    Last login: Tue Dec  8 00:38:46 on ttys001

    DME-MB1455700:~ ertarwee$ csrutil disable

    csrutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.

    DME-MB1455700:~ ertarwee$  csrutil disable

    csrutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.

    DME-MB1455700:~ ertarwee$ crustil status

    -bash: crustil: command not found

    DME-MB1455700:~ ertarwee$

  • by Loner T,

    Loner T Loner T Dec 7, 2015 8:46 AM in response to WEE ER
    Level 7 (24,115 points)
    Safari
    Dec 7, 2015 8:46 AM in response to WEE ER

    Shut down your Mac, powet it back up and hold Command+R before the apple logo shows up. Click on Utilities -> Terminal.

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 9:10 AM in response to Loner T
    Level 1 (0 points)
    Dec 7, 2015 9:10 AM in response to Loner T

    After I finished part A , should I continue part B by using terminal -bash -80*24?or restart my Mac book again before I continue doing part b

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 9:12 AM in response to WEE ER
    Level 1 (0 points)
    Dec 7, 2015 9:12 AM in response to WEE ER

    HI loner

    i can access my windows partition , thx for guiding me, you are my life saver .

  • by Loner T,

    Loner T Loner T Dec 7, 2015 9:39 AM in response to WEE ER
    Level 7 (24,115 points)
    Safari
    Dec 7, 2015 9:39 AM in response to WEE ER

    If Windows is now booting correctly, please back up OSX, Windows and create a Windows System Restore point.

  • by WEE ER,

    WEE ER WEE ER Dec 7, 2015 4:47 PM in response to WEE ER
    Level 1 (0 points)
    Dec 7, 2015 4:47 PM in response to WEE ER

    can I know the steps to back up osx, windows and create a windows system restore point ? I am no ideas how to do it ?

Page 1 Next