El Captain deleted my Windows partition and I cannot reclaim the space back.

Question

Hey guys. After upgrading to El Captain I have recently discovered that my Windows partition was erased for a reason that I don&#x27;t know. I thought this was ok as I would re-install it again, yet I have come across some difficulty. In the &#x27;About This Mac&#x27; Storage tab, there is no acknowledgement of the 60gb drive that I used for windows, yet for Mac I only have 430gb/500gb max, meaning the 60 gb is still an unknown drive. I opened up Disk Utility (image below) and as I thought there is a 60gb drive named Untitled that I cannot reclaim when I try to partition the hard drive. Furthermore, as you can see, the drive is not on the left hand side.I am new to technology really and not great with following complicated steps, so if someone could assist me with this is a simple yet effective way I would be more than grateful!

Loner T · Accepted Answer

El Capitan Upgrade can cause problems with installed Windows. It may still be recoverable.From/run Applications -&gt; Utilities -&gt; Terminal, triple-click each of the following highlighted lines, Copy each line using (Command+C) and Paste (Command+V) in Terminal window. Post the output and after editing it to remove any personal information.The "sudo" commands will prompt for your password, and it will not be echoed back. You may also see a warning about improper use of "sudo" and potential data loss due to "abuse" of the command.diskutil listdiskutil cs listsudo gpt -vv -r show /dev/disk0sudo fdisk /dev/disk0

ADRumbler · Answer

No personal info except for my name but that&#x27;s all good, this is what I got after I used each lines of textdiskutil list/dev/disk0 (internal, physical):   #:                       TYPE NAME                    SIZE       IDENTIFIER   0:      GUID_partition_scheme                        *500.1 GB   disk0   1:                        EFI EFI                     209.7 MB   disk0s1   2:          Apple_CoreStorage Macintosh HD            439.2 GB   disk0s2   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3   4:       Microsoft Basic Data                         60.0 GB    disk0s4/dev/disk1 (internal, virtual):   #:                       TYPE NAME                    SIZE       IDENTIFIER   0:                  Apple_HFS Mac Disk               +438.9 GB   disk1                                 Logical Volume on disk0s2                                 F0AB3D49-1FD2-4F82-8E3A-56C22728E2B1                                 Unlocked EncryptedAdams-MacBook-Pro:~ Adam$ diskutil cs listCoreStorage logical volume groups (1 found)|+-- Logical Volume Group C5CEAAAD-E6E9-4247-AF17-F6B811F9BA78    &#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;    Name:         Macintosh HD    Status:       Online    Size:         439248580608 B (439.2 GB)    Free Space:   18878464 B (18.9 MB)    |    +-&lt; Physical Volume 9AFA7155-54CE-4CC9-A0B0-70D66CD7808A    |   ----------------------------------------------------    |   Index:    0    |   Disk:     disk0s2    |   Status:   Online    |   Size:     439248580608 B (439.2 GB)    |    +-&gt; Logical Volume Family 5816227E-EA55-4FE8-9987-4A8DD59C66E6        ----------------------------------------------------------        Encryption Type:         AES-XTS        Encryption Status:       Unlocked        Conversion Status:       Complete        High Level Queries:      Fully Secure        |                        Passphrase Required        |                        Accepts New Users        |                        Has Visible Users        |                        Has Volume Key        |        +-&gt; Logical Volume F0AB3D49-1FD2-4F82-8E3A-56C22728E2B1            ---------------------------------------------------            Disk:                  disk1            Status:                Online            Size (Total):          438877380608 B (438.9 GB)            Revertible:            Yes (unlock and decryption required)            Revert Status:         Reboot required            LV Name:               Mac Disk            Volume Name:           Mac Disk            Content Hint:          Apple_HFSAdams-MacBook-Pro:~ Adam$ sudo gpt -vv -r show /dev/disk0WARNING: Improper use of the sudo command could lead to data lossor the deletion of important system files. Please double-check yourtyping when using sudo. Type "man sudo" for more information.To proceed, enter your password, or type Ctrl-C to abort.Password:gpt show: /dev/disk0: mediasize&#x3D;500107862016; sectorsize&#x3D;512; blocks&#x3D;976773168gpt show: /dev/disk0: Suspicious MBR at sector 0gpt show: /dev/disk0: Pri GPT at sector 1gpt show: /dev/disk0: Sec GPT at sector 976773167      start       size  index  contents          0          1         MBR          1          1         Pri GPT header          2         32         Pri GPT table         34          6                  40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B     409640  857907384      2  GPT part - 53746F72-6167-11AA-AA11-00306543ECAC  858317024    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC  859586560  117186560      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7  976773120         15           976773135         32         Sec GPT table  976773167          1         Sec GPT headerAdams-MacBook-Pro:~ Adam$ sudo fdisk /dev/disk0Disk: /dev/disk0 geometry: 60801/255/63 [976773168 sectors]Signature: 0xAA55         Starting       Ending #: id  cyl  hd sec -  cyl  hd sec [     start -       size]------------------------------------------------------------------------ 1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] &lt;Unknown ID&gt; 2: AC 1023 254  63 - 1023 254  63 [    409640 -  857907384] &lt;Unknown ID&gt; 3: AB 1023 254  63 - 1023 254  63 [ 858317024 -    1269536] Darwin Boot  4: 0C 1023 254  63 - 1023 254  63 [ 859586560 -  117186560] Win95 FAT32L

Loner T · Answer

Please post the output ofsudo dd if&#x3D;/dev/rdisk0s4 count&#x3D;1 2&gt;/dev/null | hexdump -CUse the triple-click Copy/Paste method to post the output.

ADRumbler · Answer

Adams-MacBook-Pro:~ Adam$ sudo dd if&#x3D;/dev/rdisk0s4 count&#x3D;1 2&gt;/dev/null | hexdump -C00000000  0f 12 14 0f 14 14 0e 16  14 15 17 0f 17 18 15 1e  |................|00000010  24 25 25 1c 14 14 12 10  11 14 12 15 14 10 11 0e  |$%%.............|00000020  11 11 0e 0a 0c 0f 0c 09  0a 0c 0c 0a 0b 07 07 07  |................|00000030  08 08 06 02 01 07 03 07  06 00 07 00 08 01 03 03  |................|00000040  00 01 06 04 00 04 00 00  00 08 02 00 06 07 00 00  |................|00000050  02 00 00 07 00 07 01 05  07 01 04 07 04 04 00 04  |................|00000060  00 00 02 02 05 05 00 04  00 03 02 06 00 04 05 06  |................|00000070  00 04 00 02 06 00 00 00  00 01 05 07 04 04 01 00  |................|00000080  03 02 04 07 06 04 01 07  06 07 03 01 02 04 01 03  |................|00000090  00 00 01 07 00 05 06 00  00 07 00 02 00 03 03 00  |................|000000a0  07 00 00 01 03 00 02 04  01 01 01 07 04 01 06 02  |................|000000b0  02 07 07 04 03 08 05 00  06 05 00 00 07 00 04 08  |................|000000c0  07 03 08 08 0a 09 0c 06  0b 0d 0e 0e 0c 0f 0e 0b  |................|000000d0  11 0d 10 0e 13 14 10 16  11 11 12 11 16 14 13 1c  |................|000000e0  1a 24 25 25 24 1f 1b 16  18 13 15 1a 13 14 16 10  |.$%%$...........|000000f0  0f 11 0d 0f 0d 11 0c 0c  0a 0d 0a 0e 0a 0d 06 0c  |................|00000100  05 06 07 06 07 08 02 03  03 00 03 02 05 00 00 04  |................|00000110  03 01 00 05 00 02 00 00  02 07 06 00 07 03 00 00  |................|00000120  00 07 00 05 03 01 01 01  00 03 04 00 04 08 04 00  |................|00000130  00 07 02 00 00 03 06 05  00 03 00 01 02 03 04 04  |................|00000140  07 00 02 08 07 00 00 03  00 01 00 00 01 00 03 03  |................|00000150  05 03 00 03 00 00 00 03  08 05 04 03 00 00 07 00  |................|00000160  07 04 00 08 04 04 00 05  06 04 00 00 07 00 00 01  |................|00000170  02 06 07 07 04 07 00 06  07 00 06 07 00 07 02 01  |................|00000180  01 04 03 00 07 08 05 07  04 02 01 01 02 02 03 08  |................|00000190  0a 09 08 06 0b 0d 09 0b  0e 0a 10 0b 11 0c 0f 0f  |................|000001a0  11 0d 14 11 16 15 13 12  19 15 18 13 1c 1f 24 24  |..............$$|000001b0  25 24 1d 19 15 1b 14 14  15 13 16 0f 0e 14 13 13  |%$..............|000001c0  0b 0e 0b 0e 0d 0f 0f 0b  0b 08 0a 0b 07 05 09 06  |................|000001d0  06 02 08 04 03 08 06 02  05 06 03 00 08 02 01 00  |................|000001e0  00 00 06 00 02 00 06 07  05 05 04 08 03 00 04 00  |................|000001f0  03 07 02 00 00 04 00 00  01 00 02 02 01 00 06 04  |................|00000200

Loner T · Answer

Since this does not show a valid NTFS header, we are not in Testdisk territory. Please do not be daunted by what you see in El Capitan has deleted my bootcamp windows partition , but it is fairly straightforward. Please download Testdisk ( http://www.cgsecurity.org/wiki/TestDisk_Download ) and install it and try to follow the link.

ADRumbler · Answer

Thank you very much for your help so far! I will go away and give this a go in about an hour as I have some work to do and I&#x27;ll let you know what happens!

Loner T · Answer

Please ask as many questions as you like. 😉

ADRumbler · Answer

Is it ok if I go through with it with you as I have no idea what it is talking about aha! So I&#x27;ve created a log and it&#x27;s come up with this on my 500gb Mac, which do I select?TestDisk 7.0, Data Recovery Utility, April 2015Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgTestDisk is free software, andcomes with ABSOLUTELY NO WARRANTY.Select a media (use Arrow keys, then press Enter):&gt;Disk /dev/disk0 - 500 GB / 465 GiB (RO)Disk /dev/rdisk0 - 500 GB / 465 GiB (RO) Disk /dev/rdisk1 - 438 GB / 408 GiB

Loner T · Answer

Please select /dev/rdisk0.

ADRumbler · Answer

I have started to understand the steps more and am currently doing the quick search. I&#x27;ll try to get through as much as I can but if I get stuck I shall get back to you tomorrow with any questions. Thank you so much for your help you&#x27;ve been really kind!

Loner T · Answer

No worries. Let us get this recovered and get you up and running. Post back when you are ready.

ADRumbler · Answer

Is there another program that I need to download in order to complete the process?

Loner T · Answer

The first step is to locate the appropriate partition header which contains your Windows installation. Once located, GPT Fdisk - http://sourceforge.net/projects/gptfdisk/ - is used to correct the partition information and the MBR as needed, before Windows booting can be restored.

ADRumbler · Answer

Ok this is starting to make sense a little now to me! I have just began the Quick Scan as I needed my laptop of University today and keeping the terminal open was using considerable battery power, I will get back to later! 🙂

ADRumbler · Answer

Hey again! So after the quick scan and pressing continue I got this! What do I do now?TestDisk 7.0, Data Recovery Utility, April 2015Christophe GRENIER &lt;grenier@cgsecurity.org&gt;http://www.cgsecurity.orgDisk /dev/rdisk0 - 500 GB / 465 GiB - 976773168 sectors (RO)     Partition               Start        End    Size in sectors&gt;P EFI System                    40     409639     409600 [EFI]D MS Data                540155912  758464512  218308601 D Mac HFS                757194032  758463567    1269536 D MS Data                758464512  976773112  218308601 D MS Data                758464519  976773119  218308601 D Mac HFS                975503592  976773127    1269536Structure: Ok.  Use Up/Down Arrow keys to select partition.Use Left/Right Arrow keys to CHANGE partition characteristics:                P&#x3D;Primary  D&#x3D;DeletedKeys A: add partition, L: load backup, T: change type, P: list files,     Enter: to continueFAT32, blocksize&#x3D;512, 209 MB / 200 MiB