Expanded Bootcamp partition using EaseUS now can't boot into Windows

Question

Level 1

4 points

Expanded Bootcamp partition using EaseUS now can't boot into Windows

Hi,

I'm new to Apple software so please bare with me.

I use a Mac Pro and mainly use bootcamp (Windows 10).

I thought it would be a good idea to expand the bootcamp partition because I barley use OS X so went into El Capitan made that partition smaller and then went back into Windows made the space NTFS and used EaseUS to merge it with the boocamp partition.

I did this in the past and it went perfectly well.
I have been reading around and new see it's not recommended at all.

I restarted and when windows started I got "recovery - your pc needs to be repaired the boot configuration data file is missing"

I tried holding 'alt' down when booting and there was only one 'Windows' drive.

I did 'alt & r' and reinstalled El Capitan in the partition where it was.

Now looking in Disk Utility the partition that was bootcamp says it's Mac OS Extended when it should be NTFS.

Really hoping I can recover this because it has important work documents on it.

Can anybody help please?

Mac Pro, OS X El Capitan (10.11.6)

Posted on Aug 11, 2016 6:39 PM

Reply

Answer 1

Beanyman62 Author

Level 1

4 points

Aug 11, 2016 8:58 PM in response to Beanyman62

$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *251.0 GB disk0

1: EFI EFI 209.7 MB disk0s1

2: Apple_HFS El Capitan 45.7 GB disk0s2

3: Apple_Boot Recovery HD 650.0 MB disk0s3

4: DE94BBA4-06D1-4D40-A16A-BFD50179D6AC 650.0 MB disk0s4

5: Apple_HFS 169.9 GB disk0s5

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: Apple_partition_scheme *207.9 MB disk1

1: Apple_partition_map 32.3 KB disk1s1

2: Apple_HFS Google Chrome 207.9 MB disk1s2

diskutil cs list

No CoreStorage logical volume groups found

sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=251000193024; sectorsize=512; blocks=490234752

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 490234751

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 89228256 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

89637896 1269544 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

90907440 1269536 4 GPT part - DE94BBA4-06D1-4D40-A16A-BFD50179D6AC

92176976 66170288

158347264 331886592 5 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

490233856 863

490234719 32 Sec GPT table

490234751 1 Sec GPT header

sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 30515/255/63 [490234752 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 0 0 2 - 1023 254 63 [ 1 - 158347263] <Unknown ID>

*2: AF 1023 254 63 - 1023 254 63 [ 158347264 - 331886592] HFS+

3: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

Reply

Answer 2

Loner T

Level 9

59,536 points

Aug 12, 2016 3:06 AM in response to Beanyman62

Please post the output of

sudo dd if=/dev/rdisk0s5 count=1 2>/dev/null | hexdump -C

What year is your MP?

Reply

Answer 3

Beanyman62 Author

Level 1

4 points

Aug 12, 2016 9:48 AM in response to Loner T

I'm getting

sudo dd if=/dev/rdisk0s5 count=1 2>/dev/null | hexdump -C

Password:

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

*

00000200

My Mac Pro is a late 2013 model

Model Name: Mac Pro

Model Identifier: MacPro6,1

Processor Name: 6-Core Intel Xeon E5

Processor Speed: 3.5 GHz

Number of Processors: 1

Total Number of Cores: 6

L2 Cache (per Core): 256 KB

L3 Cache: 12 MB

Memory: 12 GB

Boot ROM Version: MP61.0116.B16

SMC Version (system): 2.20f18

Illumination Version: 1.4a6

Thanks so much for the help

Reply

Answer 4

Loner T

Level 9

59,536 points

Aug 12, 2016 10:10 AM in response to Beanyman62

If you look at the GPT output,

1. GPT 3 - looks like a standard OSX Recovery HD.

2. GPT 4 - it says it is Windows RE, but the size is 650MB, and a Windows RE is typically 491MB.

3. There is large gap between GPT4 and GPT5, which can hide a lost NTFS header.

4. GPT 5 - had the Microsoft data type, but your dd output does not show a NTFS header.

Can you download Testdisk - http://www.cgsecurity.org/wiki/TestDisk_Download - and use El Capitan has deleted my bootcamp windows partition as a reference and run a Testdisk scan and start the process looking for the lost NTFS header?

Reply

Answer 5

Beanyman62 Author

Level 1

4 points

Aug 12, 2016 11:31 AM in response to Loner T

Thank you, I'm following the steps, I think i'm doing it right I have reached this part,
I'm unsure what to do next.

Disk /dev/disk0 - 251 GB / 233 GiB - 490234752 sectors (RO)

The harddisk (251 GB / 233 GiB) seems too small! (< 420 GB / 392 GiB)

Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:

Partition Start End Size in sectors

> MS Data 490233848 822120432 331886585

MS Data 490233855 822120439 331886585

Mac HFS 490234708 491504243 1269536

[ Continue ]

NTFS, blocksize=4096, 169 GB / 158 GiB

Reply

Answer 6

Loner T

Level 9

59,536 points

Aug 12, 2016 11:57 AM in response to Beanyman62

Press Enter to Continue, and we can check the list of viable partitions.

Reply

Answer 7

Beanyman62 Author

Level 1

4 points

Aug 12, 2016 12:13 PM in response to Loner T

I'm getting this, sorry kind of lost my way now

Reply

Answer 8

Loner T

Level 9

59,536 points

Aug 12, 2016 12:21 PM in response to Beanyman62

Scroll down to the first MS Data at 92176976 and use the 'p' command to list files. Press Escape only once to get back to this list, otherwise you will need to start Testdisk scan again. Look through each MS Data entry till you familiar Windows files.

Reply

Answer 9

Beanyman62 Author

Level 1

4 points

Aug 12, 2016 12:32 PM in response to Loner T

I can't really find any Windows files, only the first one (92176976) has hiberfil.sys
The others say 'Can't open filesystem. Filesystem seems damaged.'

Reply

Answer 10

Loner T

Level 9

59,536 points

Aug 12, 2016 12:37 PM in response to Beanyman62

This is not a good sign. EaseUS failed during the move, and it also left two Recovery HDs. Do you have a way to contact EaseUS and ask them for support. If there are no valid files and headers, there are no other tools that can help. Also check if they have any data recovery tools.

Reply

Answer 11

Beanyman62 Author

Level 1

4 points

Aug 12, 2016 1:52 PM in response to Loner T

Oh ok that *****, I have tried recovery software and it looks like I can get all the files back, will have to pay for something though.

Thanks so much for the help.

Reply

Answer 12

Loner T

Level 9

59,536 points

Aug 12, 2016 1:58 PM in response to Beanyman62

Beanyman62 wrote:

Oh ok that *****, I have tried recovery software and it looks like I can get all the files back, will have to pay for something though.

You should not have to. You have a valid license, and they failed in the primary functionality of the software.

Reply