Level 1

9 points

Recovery Request!!!

In windows 7 which was on my BOOTCAMP, I used disk management to shrink Drive "C:\" and then creating one more partition. It caused the startup failure of both MAC OS and WINDOWS!

unfortunately even when I used Internet recovery and then Disk utility, I couldn't access to my partitiona and backup.

Disk Utility indicates partitions Unmounted and "windows_DLM" format type!!!

I'm Certain that when I used to shrink my BootCamp partition, I did nothing with MAC Partition.

Is there any scenario to recover data on my partitions?

and if the answer is yes, what are the scenarios?

please tell me How can I do to not loosing my data?

I read some articles about TestDisk program which is a recovery software but now I have no OS to Start from!!!

and an article describing using "dd" command in Terminal to create image, But actually I don't realize what can I do and what's the solution for such a problem occured!

iMac, iOS 10

Posted on Sep 25, 2016 8:43 PM

87 replies

PEZHI Author

Level 1

9 points

Oct 6, 2016 6:24 PM in response to Loner T

I'm agree with you, Let's Try it

Loner T

Level 9

59,536 points

Oct 6, 2016 6:34 PM in response to PEZHI

Your disk should be a GPT disk. It shows up as a Windows_LDM because of Windows Disk Management. It should have a GPT. When you run GPT Fdisk (aka gdisk) it will prompt you with three options, choose 2, which is GPT.

The command is

sudo gdisk /dev/disk0

Once you can see the GPT, please type 'p'(rint) and post the output. WE can use it to re-build your GPT correctly.

PEZHI Author

Level 1

9 points

Oct 8, 2016 7:02 PM in response to Loner T

I run the command in Terminal:

sudo gdisk /dev/disk0

and then:

PEZHMANs-iMac:~ pezhman$ sudo gdisk /dev/disk0

WARNING: Improper use of the sudo command could lead to data loss
or the deletion of important system files. Please double-check your
typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:

it prompts for password, what must I do? is it because of System Integrity Protection (rootless) ?

please Help me, Thanks a lot

PEZHI Author

Level 1

9 points

Oct 8, 2016 7:23 PM in response to PEZHI

My system doesn't have Password. when Mac OS X installation, I entered Password but then I removed the Password. after removing password, sometimes Mac OS X request password confirmation (when Login, or doing some works) but I continue without any password and there is no problem.

when gdisk prompted for password, even I used that old password (which I entered when Mac OS X installation) but again it prompted for password!

I noticed when it prompted for password, when I typed, nothing appeared on prompt line!!!

Loner T

Level 9

59,536 points

Oct 9, 2016 1:51 AM in response to PEZHI

SIP is unrelated to this. When you installed OS X on the SD card, you would have created an Administrative account for the installation on the SD Card. This is not the same as your internal disk password, because the two can be different.

PEZHI Author

Level 1

9 points

Oct 9, 2016 3:47 PM in response to Loner T

well, I try it again dear.

PEZHI Author

Level 1

9 points

Oct 9, 2016 3:52 PM in response to PEZHI

I don't know why the helpful button on this page doesn't work, I want to specify that your comments are Helpful to me but it doesn't work!

Loner T

Level 9

59,536 points

Oct 9, 2016 7:05 PM in response to PEZHI

When you installed OS X on the SD card, how did you remove the password on the OS X installation on the SD Card?

PEZHI Author

Level 1

9 points

Oct 10, 2016 3:44 PM in response to Loner T

I solved the password issue and run The command.

Here is the output:

Last login: Mon Oct 10 07:23:30 on ttys000
PEZHMANs-iMac:~ pezhman$ sudo gdisk /dev/disk0
GPT fdisk (gdisk) version 1.0.1

Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present

***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory. THIS OPERATION IS POTENTIALLY DESTRUCTIVE! Exit by
typing 'q' if you don't want to convert your MBR partitions
to GPT format!
***************************************************************

Warning! Main partition table overlaps the first partition by 33 blocks!
You will need to delete this partition or resize it in another utility.

Command (? for help): p
Disk /dev/disk0: 1953525168 sectors, 931.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 86878439-766D-4E3E-86BE-2052171C601B
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1953525134
Partitions will be aligned on 8-sector boundaries
Total free space is 2015 sectors (1007.5 KiB)

Number Start (sector) End (sector) Size Code Name
1 1 1562900479 745.2 GiB 4200 Windows LDM data
2 1562900480 1933043711 176.5 GiB 4200 Windows LDM data
3 1933043712 1953523119 9.8 GiB 4200 Windows LDM data

Command (? for help):

PEZHI Author

Level 1

9 points

Oct 10, 2016 3:50 PM in response to Loner T

Last login: Mon Oct 10 07:23:30 on ttys000
PEZHMANs-iMac:~ pezhman$ sudo gdisk /dev/disk0
GPT fdisk (gdisk) version 1.0.1

Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present

Warning! Main partition table overlaps the first partition by 33 blocks!
You will need to delete this partition or resize it in another utility.

Command (? for help):

Loner T

Level 9

59,536 points

Oct 10, 2016 4:41 PM in response to PEZHI

Can you run

sudo fdisk /dev/disk0

and post the output?

PEZHI Author

Level 1

9 points

Oct 10, 2016 4:54 PM in response to Loner T

Last login: Mon Oct 10 20:20:52 on console

PEZHMANs-iMac:~ pezhman$ sudo fdisk /dev/disk0

Password:

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: 42 0 0 2 - 1023 254 63 [ 1 - 1562900479] LinuxSwap DR

*2: 42 1023 254 63 - 1023 254 63 [1562900480 - 370143232] LinuxSwap DR

3: 42 1023 254 63 - 1023 254 63 [1933043712 - 20479408] LinuxSwap DR

4: 00 0 0 0 - 0 0 0 [ 0 - 0] unused

PEZHMANs-iMac:~ pezhman$

Loner T

Level 9

59,536 points

Oct 10, 2016 5:39 PM in response to PEZHI

This is a typical Mac disk layout with Bootcamp, depending on the size of the Windows partition.

sudo gpt -vv -r show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=512110190592; sectorsize=512; blocks=1000215216

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: Sec GPT at sector 1000215215

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 742676624 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

743086264 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

744355800 40

744355840 255858688 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

1000214528 655

1000215183 32 Sec GPT table

1000215215 1 Sec GPT header

On a 512-byte sector disk, the 'overlap' is the first 32 sectors, which is the error you see.

1. the Mac EFI always starts at sector 40, and is 200MB = 409600 sector.

2. your OS X should start at 409640 and end at 1562900479.

3. your Bootcamp starts at sector 1562900480 and is sized 370143232. Your Windows partition is about 175Gb and matches the LDM entry.

We need to try to recover the GPT from the backup table first. In Gdisk

r (Recovery Menu)

b (use backup GPT header (rebuilding main) )

p (print)

Do not modify or write the GPT.

PEZHI Author

Level 1

9 points

Oct 10, 2016 6:02 PM in response to Loner T

Thanks a lot Loner T

Great, your comments are very exact and professional.

Let me concentrate on your solutions because I'm not in your degree of perfection.

I try to do what you said. I'm not familiar with these terms (backup table, Recovery Menu) right now, I must get familiar with them.

In the two last operations (sudo gdisk /dev/disk0 and sudo fdisk /dev/disk0 ) I just did your commands.

Loner T

Level 9

59,536 points

Oct 10, 2016 6:27 PM in response to PEZHI

Please post the output of the 'p' command. The exact sequence is (do not type the text which is enclosed like this sentence is)

sudo gdisk /dev/disk0

r (Recovery Menu)

b (use backup GPT header (rebuilding main) )

p (print)

Stay at this command, if we need to enter more commands. Copy the output and post it as a reply.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Recovery Request!!!