How to recover Bootcamp NTFS Partition?

[pkeukens]

Yep.

Oke when I restart my Mac and press the option button I can select the windows partition to boot and it boots fine so that is super!

The only thing now is that when I boot into Mac and go to "startup disk" in system preferences it only shows the mac drive (in windows it shows both). So this gives me the feeling that something is still a bit off.

Thanks for the help so far, hope you have an idea for the above!

Almost there!!!

 

[murphychris]

The only thing now is that when I boot into Mac and go to "startup disk" in system preferences it only shows the mac drive (in windows it shows both).

This is usually a side effect of using NTFS-3G for read-write NTFS support. Are you using it?

 

[pkeukens]

This is usually a side effect of using NTFS-3G for read-write NTFS support. Are you using it?

Ahh I was using Paragon NTFS, after uninstalling the drive showed up again! Now I'm fully up and running again!

Many many thanks for your help, it was appreciated!

Cheers Patrick

 

[Schwarzn8or]

Partition Lost Using Camptune X

This is saying your disk does not have a GPT at all. I don't know how you arrived at this situation because there are two GPTs, a primary and secondary.

Please report the results of this command:

sudo fdisk /dev/disk0

Next go download GPT fdisk (a.k.a. gdisk) and install the binary for Mac OS X.
http://sourceforge.net/projects/gptfdisk/

After installation, report the result of:

sudo gdisk -l /dev/disk0

Hi murphy I am having same problem I have downloaded and installed gdisk and and used the code and this is what I got could you help please

GPT fdisk (gdisk) version 0.8.7

Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.
Disk /dev/disk0: 1465149168 sectors, 698.6 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 3B23ACC9-6113-40E5-A161-AE60EFB01AC9
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1465149134
Partitions will be aligned on 8-sector boundaries
Total free space is 682665613 sectors (325.5 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI System Partition
   2          409640       781213991   372.3 GiB   AF00  Customer
   3       781217792       782487327   619.9 MiB   AB00  Recovery HD

btw its MBP 2011 Windows 7 and I lost my partition after using Camp tune X (it crashed during resizing Windows) help will be greatly appreciated thanks

 

[murphychris]

Number Start (sector) End (sector) Size Code Name
1 40 409639 200.0 MiB EF00 EFI System Partition
2 409640 781213991 372.3 GiB AF00 Customer
3 781217792 782487327 619.9 MiB AB00 Recovery HD[/CODE]

There's no Windows entry in the GPT. What's the result from

sudo fdisk /dev/disk0

btw its MBP 2011 Windows 7 and I lost my partition after using Camp tune X (it crashed during resizing Windows) help will be greatly appreciated thanks

You should call Paragon support and see if there's any advice they can give you. I can't think of a good reason why the GPT entry would be removed during the resize; I'd expect an NTFS shrink would modify the filesystem first, then after it's successful, alter the GPT entry; and for an NTFS grow to first modify the GPT, and then grow the file system. In any case a crash shouldn't cause the Windows entry to vanish entirely.

 

[Schwarzn8or]

There's no Windows entry in the GPT. What's the result from

sudo fdisk /dev/disk0

You should call Paragon support and see if there's any advice they can give you. I can't think of a good reason why the GPT entry would be removed during the resize; I'd expect an NTFS shrink would modify the filesystem first, then after it's successful, alter the GPT entry; and for an NTFS grow to first modify the GPT, and then grow the file system. In any case a crash shouldn't cause the Windows entry to vanish entirely.

This is the result:

Disk: /dev/disk0	geometry: 91201/255/63 [1465149168 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE    0   0   2 -   25   6  46 [         1 -     409639] <Unknown ID>
 2: AF   25   6  47 - 1023  32   8 [    409640 -  780804352] HFS+        
 3: AB 1023  47  48 - 1023  33   1 [ 781217792 -    1269536] Darwin Boot 
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused

Also I don't know if this helps but heres my disk utility (in attachment)
I was resizing windows from 150 - 350 (on 750Gb Hard Drive) and on disk utility it recognises that Mac OS has 400 Gb capacity welcome your thoughts on this.
Cheers

 

[murphychris]

 1: EE    0   0   2 -   25   6  46 [         1 -     409639] <Unknown ID>
 2: AF   25   6  47 - 1023  32   8 [    409640 -  780804352] HFS+        
 3: AB 1023  47  48 - 1023  33   1 [ 781217792 -    1269536] Darwin Boot 
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused

It's not in the MBR either. So there's no information in either partition table to go on. Again I suggest talking to Paragon since you bought the software from them.

Otherwise, blow away the entire drive, start over and restore everything from backups. Or checkout test disk - which will be tedious because it finds what it thinks are file systems; but on a disk that has file systems that have been resized, multiple invalid file systems will be found. You just have to test each one of them sequentially until you find the one that works.

 

[Schwarzn8or]

Ok what the test disk? And I haven't backed up my windows side so thats probably lost although I still think the data is there somewhere (but its not a big thing I just used it for games and other odd things Mac can't do). So should I back up entire hard drive or just Mac HD or what?
Thanks

 

[murphychris]

Test Disk

 

[Schwarzn8or]

Recommend Test Disk for lost Partitions

Test worked a treat managed to find Bootcamp wasn't able to remount it or add the partition in but i was able to copy all my files across to my Mac then re partitioned my hard drive Thanks a lot Chris.

 

[SuperKRad]

Chris, I throw myself at your mercy.
After installing a firmware update for my Air SSD (discussed here: http://www.zdnet.com/how-to-test-if-your-macbook-air-ssd-is-recalled-7000022137 ) my Boot Camp partition has gone missing during startup. I was using Win8 and have OSX 10.9

sudo fdisk /dev/disk0
Disk: /dev/disk0 geometry: 14751/255/63 [236978176 sectors]
Signature: 0xAA55
Starting Ending
#: id cyl hd sec - cyl hd sec [ start - size]
------------------------------------------------------------------------
1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>
2: AF 1023 254 63 - 1023 254 63 [ 409640 - 84761016] HFS+
3: AB 1023 254 63 - 1023 254 63 [ 85170656 - 1269536] Darwin Boot
4: 0C 1023 254 63 - 1023 254 63 [ 118867968 - 118108160] Win95 FAT32L

sudo gpt -r -vv show disk0
gpt show: disk0: mediasize=121332826112; sectorsize=512; blocks=236978176
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 236978175
start size index contents
0 1 MBR
1 1 Pri GPT header
2 32 Pri GPT table
34 6
40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
409640 84761016 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC
85170656 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
86440192 32427776
118867968 118108160 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
236976128 2015
236978143 32 Sec GPT table
236978175 1 Sec GPT header

Recovery/transformation command (? for help): o

Disk size is 236978176 sectors (113.0 GiB)
MBR disk identifier: 0x00005F0F
MBR partitions:

Number Boot Start Sector End Sector Status Code
1 1 409639 primary 0xEE
2 409640 85170655 primary 0xAF
3 85170656 86440191 primary 0xAB
4 118867968 236976127 primary 0x0C

Recovery/transformation command (? for help): p
Disk /dev/disk0: 236978176 sectors, 113.0 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 000079BA-11F4-0000-8B27-000025470000
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 236978142
Partitions will be aligned on 8-sector boundaries
Total free space is 32429797 sectors (15.5 GiB)

Number Start (sector) End (sector) Size Code Name
1 40 409639 200.0 MiB EF00 EFI system partition
2 409640 85170655 40.4 GiB AF00 Customer
3 85170656 86440191 619.9 MiB AB00 Recovery HD
4 118867968 236976127 56.3 GiB 0700 BOOTCAMP

Any help would be greatly appreciated!!!

 

[murphychris]

@SuperKRad

Because of the fdisk (MBR) result with 4th partition ID set to 0C, and the large gap of free space reported by gpt between the 3rd and 4th partitions, this problem you're having is due to resizing in an unsupported manner. Apple documentation says if you need to change the size of the BOOTCAMP volume, you have to use Bootcamp Assistant to delete it, and create a new partition layout, and reinstall Windows. Yes seriously. The alternative is to use a 3rd party tool explicitly designed for Bootcamp volumes. Everything else will cause data loss, without warning, and that even includes Apple Disk Utility.

There isn't a magic fix for this.

At some point, you used Disk Utility to resize the OS X volume, then went to Windows to resize the BOOTCAMP volume. Because Windows boots in BIOS mode on Apple hardware, it only uses MBR partitions, so its resize utilities normally only update the MBR during resize. This left the GPT partition, which is what OS X uses, unchanged and thus incorrect.

The firmware update didn't change anything. It was the upgrade to 10.9 that did this (and there was this same problem when people were upgrading to 10.8 and 10.7). Before the upgrade, the installer checks the validity of the partition maps and file system; it found that the MBR and GPT weren't sync'd and it overwrote the correct MBR with stale information in the GPT.

So the bottom line is that the necessary partition information to locate the start and end sectors for the Windows volume is simply lost. It's not in the MBR and it's not in the GPT. The data is on the disk, and it's fine. You need to figure out what the start and end sectors are for the real BOOTCAMP partition.

testdisk can help you do that. It's semi-automatic. I can't tell you how to use it, you'll have to read the documentation. You can also look over the last 1/2 dozen or so posts (on page 48) in this Apple forum thread from a couple people successfully using testdisk for this same problem.

Once you find the right start and end sectors for the NTFS volume, you'll be able to navigate the folder structure. Make a note of the start and end sector values, and then download and install gdisk (GPT fdisk) from sourceforge. Use that to delete the wrong 4th partition, then create a new partition and use the start and end sector values from testdisk. They must be exact, if you're off by 1 value it won't work. When asked for a type code, use 0700. Write out the new partition map and reboot.

If this works, you should now see the BOOTCAMP volume automounted read-only in OS X. But you still won't be able to boot Windows. If all you care about is access to files, you can back things up from within OS X. If you want to boot Windows, you'll need to head back to gdisk, and create a new hybrid MBR.

Add partitions 2 3 4 to the hybrid MBR (enter it just like that with spaces). Say yes to adding the EFI GPT to the 1st MBR entry. Accept the default hex/type code for each partition by just pressing return. Answer no to making partitions 2 and 3 bootable. Answer yes to making partition 4 bootable. Write out the new partition maps and reboot.

Now Windows should be bootable.

 

[SuperKRad]

Chris, thank you so very much for the reply. You are indeed correct, I resized my partition using something other than Bootcamp. The technical info is a bit over my head, but I am going to spend the weekend reading up on things and hope to be able to figure it out. Your advice and insight is greatly appreciated!

 

[SuperKRad]

Using testdisk I am able to find this:

Partition Start End Size in sectors

1 P EFI System 40 409639 409600 [EFI system partitio
2 P Mac HFS 409640 85170655 84761016 [Customer]
3 P Mac Boot 85170656 86440191 1269536 [Recovery HD]
No FAT, NTFS, ext2, JFS, Reiser, cramfs or XFS marker
4 P MS Data 118867968 236976127 118108160 [BOOTCAMP]
4 P MS Data 118867968 236976127 118108160 [BOOTCAMP]

So I take it my values will start at 118867968 and end at 236976127?

Thanks again!

 

[SuperKRad]

Well...I think I'm screwed. I studied all night and then went through with everything. When I finally rebooted, I held down Option and saw the option to boot into Windows, but when I clicked it I got NO OS FOUND. Heres exactly what I typed:


Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Partition table scan:
MBR: hybrid
BSD: not present
APM: not present
GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): ?
b
back up GPT data to a file
c
change a partition's name
d
delete a partition
i
show detailed information on a partition
l
list known partition types
n
add a new partition
o
create a new empty GUID partition table (GPT)
p
print the partition table
q
quit without saving changes
r
recovery and transformation options (experts only)
s
sort partitions
t
change a partition's type code
v
verify disk
w
write table to disk and exit
x
extra functionality (experts only)
?
print this menu

Command (? for help): d
Partition number (1-4): 4

Command (? for help): n
Partition number (4-128, default 4): 4
First sector (34-236978142, default = 86440192) or {+-}size{KMGTP}: 118867968
Last sector (118867968-236978142, default = 236978142) or {+-}size{KMGTP}: 236976127
Current type is 'Apple HFS/HFS+'
Hex code or GUID (L to show codes, Enter = AF00): 0700
Changed type of partition to 'Microsoft basic data'

Command (? for help): ?
b
back up GPT data to a file
c
change a partition's name
d
delete a partition
i
show detailed information on a partition
l
list known partition types
n
add a new partition
o
create a new empty GUID partition table (GPT)
p
print the partition table
q
quit without saving changes
r
recovery and transformation options (experts only)
s
sort partitions
t
change a partition's type code
v
verify disk
w
write table to disk and exit
x
extra functionality (experts only)
?
print this menu

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/rdisk0.
Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Warning: The kernel may continue to use old or deleted partitions.
You should reboot or remove the drive.
The operation has completed successfully.

 

[stanstan]

Lost second Windows partition after Maverick update

Lost second Windows partition after Maverick update

I am in front of a pretty serious situation. I have lost a partition on which I had all my work related files after I have updated Mac OS to Maverick (From Lion)

Situation before the update:
1st partition: MAC (60GB)
2nd partition: Windows bootcamp (64GB)
3rd partition: Windows (116GB)
I installed on the original drive that came with Mac Windows and then I moved/cloned the partitions on a new SSD drive. The SSD was partitioned initially with a partitioning tool (I don't remember the app) and then the Mac and Windows partitions cloned/moved to the drive in question.

After I have done the update to Maverick the 3rd partition is missing. Situation shows up as:
In windows and Mac:
1st partition: Mac (60GB)
2nd partiotion: Bootcamp (64GB)
and that is it.
However, in Mac OS, in the disk utility tool it says for Bootcamp: Capacity 180GB, Available 19GB, Used 45GB.

Any idea why this happened and how can I get the old partitioning configuration back? (restore the structure to/from the MBR from/to GPT)
I get these results running these commands from the terminal window:

sudo fdisk /dev/disk0
Disk: /dev/disk0	geometry: 29185/255/63 [468862128 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>
 2: AF 1023 254  63 - 1023 254  63 [    409640 -  114227376] HFS+        
 3: AB 1023 254  63 - 1023 254  63 [ 114637016 -    1269544] Darwin Boot 
*4: 07 1023 254  63 - 1023 254  63 [ 115906560 -  352954368] HPFS/QNX/AUX

sudo gpt -r -vv show disk0
gpt show: disk0: mediasize=240057409536; sectorsize=512; blocks=468862128
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 468862127
      start       size  index  contents
          0          1         MBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  114227376      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  114637016    1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  115906560  352954368      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  468860928       1167         
  468862095         32         Sec GPT table
  468862127          1         Sec GPT header

Thank you for any help!

 

[murphychris]

Situation before the update:
1st partition: MAC (60GB)
2nd partition: Windows bootcamp (64GB)
3rd partition: Windows (116GB)

This isn't a supported configuration. You get to have one Windows partition and one OS X partition, that's it, for Lion and newer. That's because the required hybrid MBR only supports four entries and all of them get used: EFI System partition, OS X, Recovery HD, and Windows. By having two Windows, you have five partitions, and Apple doesn't handle this well at all therefore they don't support it.

Any idea why this happened and how can I get the old partitioning configuration back?

I'm confused by the sequence. So there's original drive A, cloned 1 to drive B which was an SSD, and clone 2 to drive C which I'll assume is SSD also if the partition maps you included are for that drive because of the size. And it was working find on drive C, and then you upgrade drive C to 10.9 and now Windows won't boot? I'm uncertain what the relevance of drive A and B are.

But presumably this means you have backups, doing such complicated things, or at least you have prior clones.

sudo fdisk /dev/disk0
Disk: /dev/disk0	geometry: 29185/255/63 [468862128 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>
 2: AF 1023 254  63 - 1023 254  63 [    409640 -  114227376] HFS+        
 3: AB 1023 254  63 - 1023 254  63 [ 114637016 -    1269544] Darwin Boot 
*4: 07 1023 254  63 - 1023 254  63 [ 115906560 -  352954368] HPFS/QNX/AUX

sudo gpt -r -vv show disk0
gpt show: disk0: mediasize=240057409536; sectorsize=512; blocks=468862128
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 468862127
      start       size  index  contents
          0          1         MBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  114227376      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  114637016    1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  115906560  352954368      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  468860928       1167         
  468862095         32         Sec GPT table
  468862127          1         Sec GPT header

Well I see no problem with this layout. It's four partitions and the MBR and GPT are in sync and fully consume the drive, there is no free space. So I don't see what you're missing.

I'm seeing 54GB, and 168GB for OS X and Windows respectively, which is 222GB. And with Recovery HD and the EFI System partition adding up to 1GB, that's 223GB. The total sectors for this drive add up to 223GB. So there's nothing missing.

If you're wondering how two Windows partitions became one bigger 168GB Windows partition, then you've got me. OS X doesn't have a way to combine or resize OS partitions.

You can use testdisk to see if there's more than one valid NTFS superblock on this disk, and find a different start/end value - gets pretty tedious doing this so I think you're way better off time wise just blowing everything away, start from scratch, and restoring data from backups.

 

[murphychris]

First sector (34-236978142, default = 86440192) or {+-}size{KMGTP}: 118867968
Last sector (118867968-236978142, default = 236978142) or {+-}size{KMGTP}: 236976127

And from your previously mentioned gpt results:

118867968 118108160 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

Notice something? You basically input the same values you already had, so you obviously weren't paying attention. So beat yourself up for that, but then you can feel like there might still be hope for your data.

You didn't actually ask testdisk to scan the disk for alternatives. By default it just looks at the GPT and gives you what the partition map says. You need it to scan the disk to find NTFS signatures to find the start and end value of the filesystem itself.

Go back to your original gpt output, and look between partitions 3 and 4 and you see this pile of blank space:

86440192 32427776

That's the start sector of free space, which isn't really free, somewhere shortly after that is the real start of your NTFS volume after it was resized in Windows. The GPT remember, contains stale information so it still thinks it's free space.

The value you're probably looking for is 86441984 because that sector value is the first 1MB aligned (it's divisible by 2048) sector after 86440192. So chances are that's the correct first sector. Let me guess, you increased the size of the Windows volume by roughly 16GB? If so, then you have a fair shot getting this data back. You just need to work through testdisk's scan to for sure get the right start value, and then once that's found it will automatically find the end value because it'll get that from the NTFS superblock that it finds. And I can't guess what that is, so again, work through this with testdisk.

Everything else you did in gdisk was right. However, you only went as far as getting it right for OS X Finder to mount it on the next boot. Which is a good first step because if it doesn't mount read-only in OS X, it will not boot. But to get it to boot, you have another step in gdisk, which is creating a new hybrid MBR. Once the GPT has the right values from testdisk, you then need to create a new hybrid MBR with partitions 2 3 4 added, with 4 marked bootable. That new hybrid MBR will have start/end values for all partitions based on the now corrected GPT.

So get to it.

 

[SuperKRad]

Chris, I cant tell you how much I appreciate your responses. Thank you! Im gonna go back through everything in extreme detail today. Thanks for your patience, Ive never done something like this before, and the learning curve has been quite high. It has been great having your insight!!

 

[SuperKRad]

Chris, I am getting this information from TESTDISK now, a bit confused if this changed since I made my errors before, or if one of these are the proper values:
Disk /dev/rdisk0 - 121 GB / 113 GiB - 236978176 sectors (RO)
Partition Start End Size in sectors
P EFI System 40 409639 409600 [EFI]
P Mac HFS 409640 85170655 84761016
P Mac HFS 85170656 86440191 1269536
> MS Data 86441984 236976120 150534137
MS Data 86441991 236976127 150534137
Mac HFS 235708600 236978135 1269536

EDIT: Chris, I was feeling adventurous this morning and went for it. IT WORKED!!! Was able to use the next steps to boot into Windows proper as well. Your hint about the start value was right on the money. THANK YOU!!!!!!!!

 

[grudi]

Lost 2nd Windows partition after Maverick update

Hi

I have the same problem as stanstan. After upgrading to Maverick I lost my 2nd Win7 partition. I can boot to Win7 but just can’t see the additional partition. I didn’t resize the Win7 partition but created a 2nd partition within the Win7 parition. Can’t remember how I did it. This is more than 2 years since I’ve done this. Probably with the Win7 standard disk utilities.

Find below more information regarding the disk layout:

Mount-Point:	/Volumes/Windows 7		Capacity:	537.08 GB (537'076'432'896 Byte)
 	Format:	Windows NT-Dateisystem (NTFS)	Avail:		131.05 GB (131'048'222'720 Byte)
 	Eigentümer aktiviert:	Nein		Used:		159.47 GB (159'474'434'048 Byte)
Anzahl der Ordner: 0 Anzahl der Dateien: 352'571

$diskutil list

/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                  Apple_HFS Macintosh HD            462.3 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
   4:       Microsoft Basic Data Windows 7               537.1 GB   disk0s4

$ sudo gpt -r -vv show disk0

gpt show: disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 1953525167
       start        size  index  contents
           0           1         MBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640   902867120      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
   903276760     1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
   904546304  1048977408      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  1953523712        1423         
  1953525135          32         Sec GPT table
  1953525167           1         Sec GPT header

GPT fdisk (gdisk) version 0.8.8

Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.

Recovery/transformation command (? for help): v
No problems found. 1429 free sectors (714.5 KiB) available in 2
segments, the largest of which is 1423 (711.5 KiB) in size.

Recovery/transformation command (? for help): p
Disk /dev/disk0: 1953525168 sectors, 931.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 000077B2-36AB-0000-344B-0000A71D0000
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1953525134
Partitions will be aligned on 8-sector boundaries
Total free space is 1429 sectors (714.5 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI system partition
   2          409640       903276759   430.5 GiB   AF00  Customer
   3       903276760       904546303   619.9 MiB   AB00  Recovery HD
   4       904546304      1953523711   500.2 GiB   0700  BOOTCAMP

Recovery/transformation command (? for help): o

Disk size is 1953525168 sectors (931.5 GiB)
MBR disk identifier: 0x00000A0D
MBR partitions:

Number  Boot  Start Sector   End Sector   Status      Code
   1                     1       409639   primary     0xEE
   2                409640    903276759   primary     0xAF
   3             903276760    904546303   primary     0xAB
   4      *      904546304   1953523711   primary     0x07

$sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 121601/255/63 [1953525168 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>
 2: AF 1023 254  63 - 1023 254  63 [    409640 -  902867120] HFS+        
 3: AB 1023 254  63 - 1023 254  63 [ 903276760 -    1269544] Darwin Boot 
*4: 07 1023 254  63 - 1023 254  63 [ 904546304 - 1048977408] HPFS/QNX/AUX

Based on this thread I assume that the disk layout looks fine. The results ouf of test disk do however look strange. The missing partition ist the one labeld [Daten]:

Results
   P EFI System                    40     409639     409600 [EFI]		FAT32, blocksize=512, 209 MB / 200 MiB
     Mac HFS                   409640  903276759  902867120     			HFS+ blocksize=4096, 462 GB / 430 GiB
     MS Data                337119233  904546304  567427072     			NTFS found using backup sector, blocksize=4096, 290 GB / 270 GiB
     Mac HFS                903276760  904546303    1269544     			HFS+ blocksize=4096, 650 MB / 619 MiB
     MS Data                904546304 1471973375  567427072 [Windows 7] 	NTFS, blocksize=4096, 290 GB / 270 GiB
     MS Data                904546304 1953523711 1048977408 [Windows 7] 	NTFS found using backup sector, blocksize=4096, 537 GB / 500 GiB
     MS Data                990429185 1471975424  481546240     			NTFS found using backup sector, blocksize=4096, 246 GB / 229 GiB
     MS Data               1471975424 1953521663  481546240 [Daten]     	NTFS, blocksize=4096, 246 GB / 229 GiB

Any help to restore the original Win7 Disk layout is much appreciated.

 

[murphychris]

Hi

I have the same problem as stanstan. After upgrading to Maverick I lost my 2nd Win7 partition.

This is an anomaly I've not previously encountered, so I have no idea how this is happening. Normally with 5 partitions, the "repair" leaves the GPT alone, but blows away the hybrid MBR replacing it with a protective MBR. You and stanstan appear to be indicating a new behavior, where two Windows partitions are joined into one partition, and then the hybrid MBR is replaced with a new hybrid MBR based on a very wrong GPT. This is a whole new class of data loss, if true.

OOOH. I wonder if when you created this extra Windows partition, if it created one of them as an extended MBR partition. Since Apple doesn't support those at all, the extended partition entry in MBR 4 is actually the full size of all "sub" extended partitions made from it. So maybe they're taking that partition 4, and populating the GPT with that entry. That fits the facts so far, but that's incredibly wrong for them to do this.

Anyway, your MBR and GPT are the same so there's no obvious discrepancy, based on the partition maps.

You will need to go back to testdisk, and use arrow keys to select each of these two options, then press P to "list files". Only one of these is correct, and only with "list files" can you determine which one is correct:

MS Data 904546304 1471973375 567427072 [Windows 7] NTFS, blocksize=4096, 290 GB / 270 GiB
MS Data 904546304 1953523711 1048977408 [Windows 7] NTFS found using backup sector, blocksize=4096, 537 GB / 500 GiB

Once you have found which one is correct make sure you not the start and end sector values. That'll be your partition 4 entry.

Even though there is only one option, you should try to "list files" for this entry as well to confirm/deny files can still be found:

MS Data 1471975424 1953521663 481546240 [Daten] NTFS, blocksize=4096, 246 GB / 229 GiB

Again, note the start and end sector values. This will be partition 5.

The problem you have, since you decided to ignore documentation, and have two Windows partitions on one disk, is that there is no correct way to create a hybrid MBR for this setup. An MBR only supports 4 entries, and yet you have 5 entries. So you have to give something up. Either you'll have to give up seeing OS X files while booted in Windows, or choose to not protect the Recovery HD. When you create the hybrid MBR, you'll have to map GPT partition 5 to MBR partition 4. You'll have to map GPT partition 4 to MBR partition 3. And then you either map GPT partition 2 or 3 (OS X or Recovery HD) to MBR partition 2. So you'll have to decided which way to go on that. When you're creating the hybrid MBR from gdisk, you do this by telling it what partitions to add to the hybrid MBR: so if you want OS X read in Windows, and put Recovery HD at risk, then you'll enter 2 4 5. And in your case I'm guessing that partition 4 is the bootable Windows, if so you'll need to mark only that partition as bootable when asked by gdisk. If the 2nd Windows volume is what was bootable then when asked tell it to set the boot flag on partition 5.

What I personally would do? I would do the testdisk part, remove the current bogus partition 4 with gdisk, add a new partition 4 and 5 using the information you learn from testdisk as I described above, and then go to the experts menu in gdisk (option x) and use n to create a new protective MBR. Make sure you're in the proper menu because these letter commands mean different things on different menus, always use ? to display the current menu. Now write out the partition map.

The new protective MBR will make the disk a standard conforming GPT instead of this b.s. bootcamp hybrid MBR crap. When you reboot, you should have read only access to both of these Windows volumes. Back your stuff up. And now take the opportunity to blow away this whole disk, reinstall 10.9, repartition it using Bootcamp Assistant, reinstall Windows, and then restore your OS X and restore your Windows user data.

Or use a virtual machine to avoid these sorts of problems entirely.

But for Pete's sake, do not create even one more partition on this boot disk EVER. It's not supported.

 

[stanstan]

You can use testdisk to see if there's more than one valid NTFS superblock on this disk, and find a different start/end value - gets pretty tedious doing this so I think you're way better off time wise just blowing everything away, start from scratch, and restoring data from backups.

Fantastic! testdisk found the lost partition! Also, it could copy all the files from the "lost" partition.
Thank you so much murphychris!

PS: You can see the found/old structure in the attached image.

 

[grudi]

This is an anomaly I've not previously encountered, so I have no idea how this is happening. Normally with 5 ...

Chris

Thanks very much. I was able to recover the data from my lost partition and will re-create my installation with a properly partitioned disk. Only due to your knowledge and insights I was able to do this.

 

[isidoros]

Missing Operating System Windows 7 Bootcamp Partition

Hello guys, I'm new here and I've googled and read and read to no avail.. I couldn't find anything to help me.. Any advice would be much appreciated

I had a standard bootcamp setup, I installed windows 7 on a bootcamp partition (about 50GB) on OS 10.7.
Then I tried to install the new OS Mavericks, and during that installation after the first reboot, an error came up saying the installation failed and I should visit an apple help webpage.
I did what it told me, to repartition my OS partition and make it a little bigger. So I did.
I tried to install Mavericks again and the same thing happened. So I quit trying. (Didn't care that much.)

After a while I restarted my mac to boot at windows pressing the 'option' key, but the windows partition wasn't there! I could only boot from mac os.

So I stared looking around and I found something that could help me and it was something to do with rebuilding gpt I think.
I did that and it worked to the extent that now the windows partition was visible next to the OS at start-up. But when I choose Windows I immediately get the "Missing Operating System" error.


Here are some diagnostics:

sudo fdisk /dev/disk0

Disk: /dev/disk0	geometry: 60801/255/63 [976773168 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE    0   0   2 - 1023 254  63 [         1 -  878632959] <Unknown ID>
*2: 07 1023 254  63 - 1023 254  63 [ 878632960 -   98140160] HPFS/QNX/AUX
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused

diskutil list

/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.1 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2:                  Apple_HFS Macintosh HD            448.0 GB   disk0s2
   3:                 Apple_Boot                         650.0 MB   disk0s3
   4:       Microsoft Basic Data                         50.2 GB    disk0s4

sudo gdisk -l /dev/disk0

GPT fdisk (gdisk) version 0.8.8

Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.
Disk /dev/disk0: 976773168 sectors, 465.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 00006A76-35CB-0000-2D3B-0000824A0000
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 976773134
Partitions will be aligned on 8-sector boundaries
Total free space is 1953805 sectors (954.0 MiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI system partition
   2          409640       875409639   417.2 GiB   AF00  Customer
   3       875409640       876679175   619.9 MiB   AB00  Recovery HD
   4       878632960       976773119   46.8 GiB    0700  BOOTCAMP

sudo gpt -r -vv show disk0

gpt show: disk0: mediasize=500107862016; sectorsize=512; blocks=976773168
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 976773167
      start       size  index  contents
          0          1         MBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  875000000      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  875409640    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  876679176    1953784         
  878632960   98140160      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  976773120         15         
  976773135         32         Sec GPT table
  976773167          1         Sec GPT header

It's hard not to get lost in all that code!
I thank anyone in advance!


Maybe this also helps: