How to recover Bootcamp NTFS Partition?

[iamandrebulatov]

Yeah, I copy/pasted it I swear, with tilde and all, but still "permission denied":

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ dd if=/dev/disk0s4 of=~/4sdisk0s4.bin count=4
dd: /dev/disk0s4: Permission denied

- Andre

 

[murphychris]

dd: /dev/disk0s4: Permission denied[/CODE]

Put sudo in front of that command.

 

[iamandrebulatov]

Ah, okay, excellent.
Here is the result:

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo dd if=/dev/disk0s4 of=~/4sdisk0s4.bin count=4
4+0 records in
4+0 records out
2048 bytes transferred in 0.024898 secs (82255 bytes/sec)
Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ hexdump -C ~/4sdisk0s4.bin
00000000  ea 00 00 01 29 00 00 01  20 00 00 01 2f 00 00 01  |....)... .../...|
00000010  04 00 00 01 07 00 00 01  0d 00 00 01 0f 00 00 01  |................|
00000020  25 00 00 01 26 00 00 01  20 00 00 01 04 00 00 01  |%...&... .......|
00000030  21 00 00 01 1a 00 00 01  1d 00 00 01 2b 00 00 00  |!...........+...|
00000040  fe 00 00 00 ff 00 00 01  23 00 00 01 10 00 00 01  |........#.......|
00000050  18 00 00 01 18 00 00 01  1f 00 00 01 08 00 00 01  |................|
00000060  22 00 00 00 f3 00 00 01  25 00 00 01 15 00 00 01  |".......%.......|
00000070  25 00 00 01 06 00 00 01  06 00 00 01 25 00 00 01  |%...........%...|
00000080  11 00 00 01 39 00 00 01  13 00 00 01 09 00 00 01  |....9...........|
00000090  16 00 00 01 09 00 00 01  22 00 00 01 0c 00 00 01  |........".......|
000000a0  2e 00 00 01 1c 00 00 01  10 00 00 01 0b 00 00 01  |................|
000000b0  0b 00 00 01 10 00 00 01  11 00 00 01 1a 00 00 01  |................|
000000c0  2c 00 00 01 33 00 00 01  33 00 00 01 1e 00 00 00  |,...3...3.......|
000000d0  fa 00 00 01 2d 00 00 01  27 00 00 01 1c 00 00 01  |....-...'.......|
000000e0  02 00 00 01 22 00 00 01  0b 00 00 01 21 00 00 01  |....".......!...|
000000f0  25 00 00 01 36 00 00 00  fe 00 00 01 20 00 00 01  |%...6....... ...|
00000100  2f 00 00 01 0f 00 00 01  02 00 00 01 09 00 00 01  |/...............|
00000110  1b 00 00 01 09 00 00 01  20 00 00 01 1c 00 00 01  |........ .......|
00000120  15 00 00 01 10 00 00 01  19 00 00 01 18 00 00 01  |................|
00000130  21 00 00 01 1f 00 00 01  1d 00 00 01 04 00 00 01  |!...............|
00000140  0f 00 00 01 1d 00 00 01  0e 00 00 01 0c 00 00 01  |................|
00000150  2a 00 00 01 0c 00 00 01  0b 00 00 01 1e 00 00 00  |*...............|
00000160  f4 00 00 01 21 00 00 01  24 00 00 01 03 00 00 01  |....!...$.......|
00000170  3b 00 00 01 16 00 00 01  07 00 00 01 16 00 00 01  |;...............|
00000180  1b 00 00 00 fe 00 00 01  2c 00 00 01 2b 00 00 01  |........,...+...|
00000190  1c 00 00 01 1a 00 00 01  21 00 00 01 1a 00 00 01  |........!.......|
000001a0  26 00 00 01 12 00 00 01  1c 00 00 01 19 00 00 01  |&...............|
000001b0  08 00 00 01 05 00 00 01  1e 00 00 01 15 00 00 01  |................|
000001c0  36 00 00 01 0b 00 00 01  13 00 00 00 fc 00 00 01  |6...............|
000001d0  0b 00 00 01 2f 00 00 01  17 00 00 01 25 00 00 01  |..../.......%...|
000001e0  1d 00 00 01 17 00 00 00  fd 00 00 01 28 00 00 00  |............(...|
000001f0  fd 00 00 01 17 00 00 01  20 00 00 01 02 00 00 01  |........ .......|
00000200  09 00 00 01 30 00 00 01  1f 00 00 01 0a 00 00 01  |....0...........|
00000210  28 00 00 01 3f 00 00 00  f7 00 00 01 1f 00 00 01  |(...?...........|
00000220  2d 00 00 01 14 00 00 00  f5 00 00 01 2e 00 00 00  |-...............|
00000230  f7 00 00 01 29 00 00 01  1e 00 00 00 f6 00 00 01  |....)...........|
00000240  26 00 00 01 0f 00 00 01  29 00 00 01 08 00 00 01  |&.......).......|
00000250  2a 00 00 00 fe 00 00 01  0f 00 00 01 27 00 00 01  |*...........'...|
00000260  28 00 00 01 0a 00 00 01  24 00 00 01 05 00 00 01  |(.......$.......|
00000270  25 00 00 01 23 00 00 01  02 00 00 00 fe 00 00 01  |%...#...........|
00000280  27 00 00 01 20 00 00 01  22 00 00 01 12 00 00 01  |'... ...".......|
00000290  25 00 00 01 1b 00 00 01  21 00 00 01 1d 00 00 01  |%.......!.......|
000002a0  17 00 00 01 2c 00 00 01  20 00 00 00 ec 00 00 01  |....,... .......|
000002b0  27 00 00 01 11 00 00 01  21 00 00 01 08 00 00 01  |'.......!.......|
000002c0  27 00 00 01 0e 00 00 00  f9 00 00 01 1e 00 00 01  |'...............|
000002d0  1c 00 00 01 11 00 00 01  01 00 00 01 25 00 00 01  |............%...|
000002e0  1c 00 00 01 31 00 00 00  fe 00 00 01 26 00 00 00  |....1.......&...|
000002f0  fc 00 00 01 2e 00 00 01  18 00 00 01 1d 00 00 01  |................|
00000300  15 00 00 00 fe 00 00 01  19 00 00 01 0f 00 00 01  |................|
00000310  28 00 00 01 25 00 00 01  2c 00 00 01 23 00 00 01  |(...%...,...#...|
00000320  1d 00 00 01 1d 00 00 01  21 00 00 00 ff 00 00 01  |........!.......|
00000330  22 00 00 01 01 00 00 01  05 00 00 01 2c 00 00 01  |"...........,...|
00000340  1b 00 00 01 21 00 00 01  00 00 00 01 13 00 00 01  |....!...........|
00000350  38 00 00 01 03 00 00 00  f6 00 00 01 0b 00 00 01  |8...............|
00000360  19 00 00 01 07 00 00 01  1e 00 00 01 25 00 00 01  |............%...|
00000370  22 00 00 01 2c 00 00 01  00 00 00 01 1d 00 00 01  |"...,...........|
00000380  27 00 00 01 21 00 00 01  06 00 00 01 24 00 00 01  |'...!.......$...|
00000390  21 00 00 01 1b 00 00 01  17 00 00 01 10 00 00 01  |!...............|
000003a0  18 00 00 01 20 00 00 01  09 00 00 01 2d 00 00 01  |.... .......-...|
000003b0  1a 00 00 01 15 00 00 01  1d 00 00 00 f6 00 00 01  |................|
000003c0  2f 00 00 01 1b 00 00 01  07 00 00 01 32 00 00 00  |/...........2...|
000003d0  f9 00 00 01 0d 00 00 01  19 00 00 01 1a 00 00 01  |................|
000003e0  23 00 00 01 0f 00 00 01  2c 00 00 00 ff 00 00 01  |#.......,.......|
000003f0  1a 00 00 01 15 00 00 01  30 00 00 00 e8 00 00 01  |........0.......|
00000400  25 00 00 01 31 00 00 00  ff 00 00 01 28 00 00 01  |%...1.......(...|
00000410  1a 00 00 01 08 00 00 01  28 00 00 01 0f 00 00 01  |........(.......|
00000420  23 00 00 01 0b 00 00 01  0d 00 00 01 29 00 00 01  |#...........)...|
00000430  02 00 00 01 2a 00 00 01  1c 00 00 01 07 00 00 01  |....*...........|
00000440  18 00 00 01 35 00 00 01  17 00 00 01 07 00 00 01  |....5...........|
00000450  01 00 00 01 1f 00 00 01  03 00 00 01 27 00 00 01  |............'...|
00000460  1f 00 00 01 2d 00 00 01  1c 00 00 01 16 00 00 01  |....-...........|
00000470  0e 00 00 01 04 00 00 01  10 00 00 01 2d 00 00 01  |............-...|
00000480  01 00 00 01 06 00 00 01  09 00 00 01 37 00 00 01  |............7...|
00000490  0c 00 00 01 2a 00 00 00  fd 00 00 01 29 00 00 01  |....*.......)...|
000004a0  1d 00 00 01 1b 00 00 01  07 00 00 01 01 00 00 01  |................|
000004b0  15 00 00 01 16 00 00 01  29 00 00 01 22 00 00 01  |........)..."...|
000004c0  1f 00 00 01 1e 00 00 01  1c 00 00 01 29 00 00 00  |............)...|
000004d0  fc 00 00 01 11 00 00 01  28 00 00 01 17 00 00 01  |........(.......|
000004e0  2f 00 00 00 f5 00 00 01  23 00 00 01 0a 00 00 01  |/.......#.......|
000004f0  1b 00 00 01 29 00 00 01  12 00 00 01 10 00 00 01  |....)...........|
00000500  27 00 00 01 18 00 00 01  12 00 00 01 20 00 00 01  |'........... ...|
00000510  10 00 00 01 20 00 00 01  23 00 00 01 18 00 00 01  |.... ...#.......|
00000520  2b 00 00 01 08 00 00 01  16 00 00 01 19 00 00 00  |+...............|
00000530  f0 00 00 01 29 00 00 01  23 00 00 01 17 00 00 01  |....)...#.......|
00000540  03 00 00 01 2d 00 00 01  0b 00 00 01 23 00 00 01  |....-.......#...|
00000550  0f 00 00 01 33 00 00 01  1d 00 00 01 22 00 00 01  |....3......."...|
00000560  2f 00 00 01 1c 00 00 00  fa 00 00 01 18 00 00 01  |/...............|
00000570  16 00 00 01 23 00 00 01  1b 00 00 01 09 00 00 00  |....#...........|
00000580  fa 00 00 01 09 00 00 01  00 00 00 01 11 00 00 01  |................|
00000590  12 00 00 01 31 00 00 01  0d 00 00 01 26 00 00 01  |....1.......&...|
000005a0  14 00 00 01 1a 00 00 01  1b 00 00 01 0a 00 00 01  |................|
000005b0  26 00 00 01 11 00 00 01  13 00 00 01 1a 00 00 01  |&...............|
000005c0  2b 00 00 01 0d 00 00 01  2b 00 00 01 21 00 00 01  |+.......+...!...|
000005d0  05 00 00 01 1f 00 00 00  f9 00 00 01 13 00 00 01  |................|
000005e0  1b 00 00 01 18 00 00 01  09 00 00 01 1f 00 00 01  |................|
000005f0  0f 00 00 01 3e 00 00 01  04 00 00 01 1b 00 00 01  |....>...........|
00000600  21 00 00 01 0b 00 00 01  24 00 00 00 fe 00 00 01  |!.......$.......|
00000610  18 00 00 01 23 00 00 01  00 00 00 01 16 00 00 01  |....#...........|
00000620  30 00 00 01 1c 00 00 00  ef 00 00 01 23 00 00 01  |0...........#...|
00000630  21 00 00 01 03 00 00 01  1b 00 00 01 30 00 00 01  |!...........0...|
00000640  1d 00 00 01 07 00 00 01  07 00 00 01 0e 00 00 01  |................|
00000650  2e 00 00 01 25 00 00 01  27 00 00 01 1b 00 00 01  |....%...'.......|
00000660  16 00 00 01 22 00 00 00  f7 00 00 01 24 00 00 00  |....".......$...|
00000670  f3 00 00 01 32 00 00 01  15 00 00 01 12 00 00 01  |....2...........|
00000680  15 00 00 01 09 00 00 01  1f 00 00 01 09 00 00 01  |................|
00000690  15 00 00 01 19 00 00 01  0e 00 00 01 0f 00 00 01  |................|
000006a0  05 00 00 01 24 00 00 01  20 00 00 01 28 00 00 01  |....$... ...(...|
000006b0  1c 00 00 01 20 00 00 01  12 00 00 01 26 00 00 01  |.... .......&...|
000006c0  1c 00 00 01 12 00 00 01  22 00 00 01 13 00 00 01  |........".......|
000006d0  0f 00 00 01 28 00 00 01  2a 00 00 01 0c 00 00 01  |....(...*.......|
000006e0  25 00 00 00 e9 00 00 01  28 00 00 01 22 00 00 00  |%.......(..."...|
000006f0  f7 00 00 01 15 00 00 01  09 00 00 01 1e 00 00 01  |................|
00000700  24 00 00 01 27 00 00 01  24 00 00 01 11 00 00 01  |$...'...$.......|
00000710  27 00 00 01 13 00 00 01  06 00 00 01 24 00 00 01  |'...........$...|
00000720  0b 00 00 01 2d 00 00 01  12 00 00 01 17 00 00 01  |....-...........|
00000730  09 00 00 01 2a 00 00 01  14 00 00 01 0f 00 00 01  |....*...........|
00000740  25 00 00 01 17 00 00 01  1e 00 00 01 0e 00 00 01  |%...............|
00000750  37 00 00 01 0e 00 00 01  05 00 00 01 1f 00 00 01  |7...............|
00000760  01 00 00 01 2a 00 00 01  0a 00 00 01 0d 00 00 01  |....*...........|
00000770  01 00 00 01 1d 00 00 01  33 00 00 01 07 00 00 01  |........3.......|
00000780  2a 00 00 01 0c 00 00 01  09 00 00 01 1d 00 00 01  |*...............|
00000790  28 00 00 01 0c 00 00 01  0f 00 00 01 1a 00 00 01  |(...............|
000007a0  1f 00 00 01 08 00 00 01  24 00 00 01 15 00 00 01  |........$.......|
000007b0  0c 00 00 01 19 00 00 01  32 00 00 01 08 00 00 01  |........2.......|
000007c0  21 00 00 01 08 00 00 01  1f 00 00 00 fe 00 00 01  |!...............|
000007d0  22 00 00 01 22 00 00 01  08 00 00 01 29 00 00 01  |"...".......)...|
000007e0  2b 00 00 01 22 00 00 01  16 00 00 01 00 00 00 01  |+..."...........|
000007f0  25 00 00 01 03 00 00 01  25 00 00 01 25 00 00 01  |%.......%...%...|
00000800

 

[murphychris]

I have no idea what it is, but it does not seem to be the first 2-4 sectors of a valid NTFS or FAT32 volume.

 

[iamandrebulatov]

You think it's gone for good now?
Know of anything else I can try?

I don't need Windows 7 OS but it would be amazing if I could just access the partition and attempt to salvage some files.

 

[murphychris]

You think it's gone for good now?

No idea, since I don't know what happened. Nor do I have any idea what the state of the disk partitioning was before all of this. But it's starting to sound the OS X installer is trying to fix unsynced GPT and MBRs, but is deferring to the GPT instead of the MBR for the Windows entry. Yet it's the MBR that will have the correct entry after a Windows NTFS resize. The GPT entry will be wrong. Once the proper start sector is lost, it's a needle in a haystack to try and find it.

Know of anything else I can try?

How big was the Windows/Bootcamp partition before you resized it in Windows? It might be possible to make an educated guess where the start is.

I don't need Windows 7 OS but it would be amazing if I could just access it and attempt to salvage some files.

It would be amazing. Those files are only slightly larger than the needle we're trying to find above.

 

[balamw]

Once the proper start sector is lost, it's a needle in a haystack to try and find it.

In these cases, what I will usually do is get an HDD that is larger than the one I am trying to recover and dd the whole damaged drive off to the new large drive as a file. If you know how to replace the internal drive in your machine, this is usually a good time to just stick a new drive in the box and set the old one you want to work on aside.

You can search for the magic strings (using a hex editor, "EB 52 90 4E 54 46 53 20 20 20 20") that correspond to an NTFS partition in the dd file to determine the appropriate offset without fear of damaging the original drive.

If you have an idea of how big the minimum Mac OS X partition size should be you can skip that much in your dd image to help simplify matters a bit.

But seriously, I'd get ready to backup what you can and restore.

B

 

[iamandrebulatov]

How big was the Windows/Bootcamp partition before you resized it in Windows? It might be possible to make an educated guess where the start is.

The original Boot Camp size was 50.2GB as the size would appear in Disk Utility. That also happens to be the size Disk Utility now shows for it however labeling it "disk0s4 = 50.2GB".

I think when I needed more space for Windows, I went into Lion, freed up a bunch more space, and then went back into Windows and added about 50GB through some partitioning application, but I don't remember the exact size, though def around 100GB for Boot Camp and about 390-400GB for OS X.

This is what I had before messing with the tables

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo gpt -r -vv show disk0
Password:
gpt show: disk0: mediasize=500107862016; sectorsize=512; blocks=976773168
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 976773167
      start       size  index  contents
          0          1         MBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  780949384      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  781359024    1367192      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  782726216   96005048         
  878731264   98041856      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  976773120         15         
  976773135         32         Sec GPT table
  976773167          1         Sec GPT header
Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo fdisk /dev/disk0
Disk: /dev/disk0	geometry: 60801/255/63 [976773168 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>
 2: AF 1023 254  63 - 1023 254  63 [    409640 -  780949384] HFS+        
 3: AB 1023 254  63 - 1023 254  63 [ 781359024 -    1367192] Darwin Boot 
 4: 0C 1023 254  63 - 1023 254  63 [ 878731264 -   98041856] Win95 FAT32L

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo gdisk -l /dev/disk0
GPT fdisk (gdisk) version 0.8.5

Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.
Disk /dev/disk0: 976773168 sectors, 465.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): E9E5D469-91DB-4790-8196-991FBD914D6F
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 976773132
Partitions will be aligned on 8-sector boundaries
Total free space is 55099451 sectors (26.3 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI System Partition
   2          409640       822264639   391.9 GiB   AF00  Macintosh HD
   3       822264640       823631831   667.6 MiB   AB00  Recovery HD
   4       878731264       976773119   46.8 GiB    0700  BOOTCAMP

Do you think it's possible that if worst comes to worst, I can just take, like you said, an educated guess and start it somewhere in the empty unused space in hopes that I can force OS X to see it as NTFS just so I can explore it in Finder in hopes of salvage?

In any case, you're the man for all of this, thank you very much. I've already learnt so much from this.

PS: from the original tables, I think the Bootcamp parition is maybe these entries:

  782726216   96005048         
  878731264   98041856      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

and these (***and I'm assuming that these following numbers are the correct ones because the MBR wouldn't be altered by the final Disk Utility re-partitioning that I did):

 3: AB 1023 254  63 - 1023 254  63 [ 781359024 -    1367192] Darwin Boot 
 4: 0C 1023 254  63 - 1023 254  63 [ 878731264 -   98041856] Win95 FAT32L

 

[iamandrebulatov]

I'm assuming that these following numbers are the correct ones because the MBR wouldn't be altered by the final OS X Disk Utility repartitioning that I did:

 3: AB 1023 254  63 - 1023 254  63 [ 781359024 -    1367192] Darwin Boot 
 4: 0C 1023 254  63 - 1023 254  63 [ 878731264 -   98041856] Win95 FAT32L

Unless you know Darwin Boot to be something normal and necessary, I am also assuming that it is the work of some W7 application that was done in the process of the W7 resizing/repartitioning. This is probably moot and corresponds to Lion's Recovery HD.

 

[iamandrebulatov]

...
You can search for the magic strings (using a hex editor, "EB 52 90 4E 54 46 53 20 20 20 20") that correspond to an NTFS partition in the dd file to determine the appropriate offset without fear of damaging the original drive.
....
But seriously, I'd get ready to backup what you can and restore.

B

Hopefully I can nip this somehow without resorting to that but I do agree with you, now that I've had this little scare, I'm def going to get another drive and start backing up regularly.

Also good to know that I have a last resort option, thank you.

 

[murphychris]

balamw's advice is good. If the data is important, you can use dd to make a copy. You obviously need a drive anyway so you can start making regular backups. The proper command to start imaging, which almost certainly will capture a large percentage of the former OS X volume, but at least you won't miss a viable portion of the NTFS volume - if it's still valid at all.

dd if=/dev/disk0 of=/Volumes/<2nd_disk_name>/sectorcopy_disk_start782726216s.img skip=782726216 bs=256k

That probably scolls off to the right, make sure you get the whole thing.

This will skip the first 782726216 sectors of disk0, and start sector copying the rest of them, 256KB blocks at a time, to the end of the disk, and putting them into a file "sectorcopy_disk_start782726216s.img"

You can then do a search on this file:

hexdump -C sectorcopy_disk_start782726216s.img | grep "eb 52 90 4e 54 46 53 20"

This could take hours. And if you've made more than one NTFS volume on the disk without zeroing it, you'll get multiple hits for this string. Only one will be correct.

The hex values on the left side are 1 sector per x200 (that's hex 200, in decimal it's 512). So you'll have to get the hex value on the left for the line where "eb 52 90 4e...." appears. To get the offset in sectors:
a.) convert the hex value to decimal, divide by 512.
b.) divide by x200 in a hex calculator, convert to decimal.

The sector offset is what you will *add* to 782726216. The result is the start sector for the hypothetical NTFS volume. Equally important is the ending sector and that's like a whole other explanation.

If you're lost now, forget it. Send the disk to data recovery service if it's worth $2000-$4000. If not, write off the data and move on. In order for this to work you'l have to do this at least once, and possibly iterate twice the number of times you've formatted this disk NTFS since it was zero'd.

-------------

Darwin Boot is the Recovery HD. This is Lion? Or Mountain Lion you upgraded to?


-------------

And FYI, the above is about 1/2 of what's needed to recover this. Once you find the NTFS volume header, you still have to test if it's valid. And I only know a likely rudimentary of doing this which is to try and mount the volume read only (OS X does this by default btw, so long as you don't have NTFS writes enabled or 3rd party NTFS read/write software). If it mounts, get the data off ASAP. If not, then you have to compute the next offset, do the addition again, change the partition start sector, and reboot.

BTW, I notice some evidence you're not rebooting in between uses of gdisk, as it says you need to do. Not a good idea. You should reboot right after changing either partition table.

It's also possible that you find the proper NTFS volume start sector, but it needs repair (probably unlikely) before it will mount, even read only. In that case you've got a set of iterations where you try a non-destructive repair using a Windows installer disk, and chkdsk to see what it says about each of these. I think that's non-destructive. You'd have to research it. I've seen chkdsk see impossibly small NTFS volumes and say "yay! perfect!" and yet it's like 512KB which is definitely not a Windows partition of any sort.

 

[iamandrebulatov]

Yeah, all of that sounds way to complex for me.

I don't understand how this could have happened lol
All I did was reboot out of Windows into OS X and then all this. And as far as I can tell, the disk is not damaged.

What I was saying was, from this original entry:

  782726216   96005048         
  878731264   98041856      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

It looks like 2 partitions about equal size. I know #4 is the Bootcamp...
Is it possible that the nameless partition above 4 is the second half that I added through Windows? Meaning, 782726216 would be the starting sector for the NTFS partition.

Darwin Boot is the Recovery HD. This is Lion? Or Mountain Lion you upgraded to?

I have Lion. I had Lion when I made the Bootcamp partition.

 

[murphychris]

I don't understand how this could have happened lol

Apple's documentation only vaguely alludes to the fact that there is no prescribed method to resize a Bootcamp volume, only remove it. There is no express warning, anywhere, that I'm aware of, that says not to use Windows utilities to resize NTFS volumes. How this happens is due to the hybrid MBR, which is a non-standard thing. Apple's own technote says that once a disk has a hybrid MBR, it is an invalid GPT disk, and goes so far as to say the disk shouldn't be manipulated at all. From the technote:

Warning: Failure to comply with this recommendation may result in the loss of user data.

If only they followed their own advice, this would not have happened to you.

I haven't sorted out the exact steps for reproducing this, but there are a lot of these cases on various forums. The bottom line is that you can only use 3rd party "Bootcamp" aware utilities that know how to properly manipulate such non-standard dual-boot disks, and properly edit both the MBR and GPT. As far as I know, none of them are Windows based, they're all OS X based.

Is it possible that the nameless partition above 4 is the second half that I added through Windows? Meaning, 782726216 would be the starting sector for the NTFS partition.

Could be. You can try:

sudo dd if=/dev/disk0 of=~/ntfsguess4s.bin [s]seek[/s]skip=782726216 count=4
hexdump -C ~/ntfsguess4s.bin

 

[iamandrebulatov]

It says I have "no space left", so I am assuming this .bin would be a large file for which I don't have enough space...

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo dd if=/dev/disk0 of=~/ntfsguess4s.bin seek=782726216 count=4
dd: truncating /Users/andrebulatov/ntfsguess4s.bin: No space left on device

If I'm correct, do I need about 100GB for this?

Also concerning whether it is the correct sector or not, if you notice, there are many unused sectors on the original pre-tampered MBR:

 3: AB 1023 254  63 - 1023 254  63 [ 781359024 -    1367192] Darwin Boot 
 4: 0C 1023 254  63 - 1023 254  63 [ 878731264 -   98041856] Win95 FAT32L

Looks like there are 96005048 sectors missing from this table between entry 3 and 4.
[(878731264 - (781359024 + 1367192)) = 96005048] <--- Look I can do basic maths!!!

96005048 is also the exact size of the entry between 3 and 4 on the long GPT table and it's also just a little less than Bootcamp is listed on these tables, which would make perfect sense because when I resized it in W7 I added just a little less than the 50GB I already had.

 

[murphychris]

It says I have "no space left", so I am assuming this .bin would be a large file for which I don't have enough space...

Yeah that's why two people suggested doing this onto another disk entirely.

If I'm correct, do I need about 100GB for this?

Yep. You might look in your home folder and see if it created anything, or if upon error it was deleted. If it's still there, throw it away and empty the trash. Filling up the file system to the brim is a great way to break it.

 

[iamandrebulatov]

Hmm, I now have 194GB free and it still says not enough space. The .bin file it makes comes out as "Zero bytes."

Any suggestions besides trying it onto a different drive?

 

[murphychris]

Oops. My fault. skip instead of seek! See, listening to even semi-knowledgable people on a forum risks your data. Yeah make sure you find that file and delete it if it exists.

sudo dd if=/dev/disk0 of=~/ntfsguess4s.bin skip=782726216 count=4

----------

This particular file should be 4 sectors in size, hence count=4. So actually it should be 2KB in size. I was confused and thought you were executing the earlier command to copy the bulk of this drive to an image for later processing. I just checked that command and correctly used skip in it.

skip= skips from the input device/file
seek= skips from the output device/file

 

[iamandrebulatov]

Haha!
That created a 2KB file.

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo dd if=/dev/disk0 of=~/ntfsguess4s.bin skip=782726216 count=4
Password:
4+0 records in
4+0 records out
2048 bytes transferred in 0.039560 secs (51769 bytes/sec)

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ hexdump -C ~/ntfsguess4s.bin
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000800

 

[murphychris]

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ hexdump -C ~/ntfsguess4s.bin
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800[/CODE]

OK so the first four sectors there are totally empty so the Windows volume doesn't start at 782726216. I think Disk Utility has a tendency to sometimes separate partitions by as much as 128MB. So you could try:

sudo dd if=/dev/disk0 of=~/ntfsguess2_4s.bin skip=782726216 bs=128m count=1

bs changes the block size from default of 4KB, to 128MB in this case, and we only need one.

hexdump -C ~/ntfsguess2_4s.bin | grep "eb 52 90 4e 54 46 53 20"

 

[iamandrebulatov]

I got:

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo dd if=/dev/disk0 of=~/ntfsguess2_4s.bin skip=782726216 bs=128m count=1
0+0 records in
0+0 records out
0 bytes transferred in 0.000019 secs (0 bytes/sec)

 

[murphychris]

I got:

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo dd if=/dev/disk0 of=~/ntfsguess2_4s.bin skip=782726216 bs=128m count=1
0+0 records in
0+0 records out
0 bytes transferred in 0.000019 secs (0 bytes/sec)

Lovely. Try this.

sudo dd if=/dev/disk0 of=~/ntfsguess2_4s.bin skip=782726216 bs=1m count=128

 

[iamandrebulatov]

Haha, ooh so tricky! However, still zero:

Andre-Bulatovs-MacBook-Pro:~ andrebulatov$ sudo dd if=/dev/disk0 of=~/ntfsguess2_4s.bin skip=782726216 bs=1m count=128
0+0 records in
0+0 records out
0 bytes transferred in 0.000018 secs (0 bytes/sec)

 

[murphychris]

Weird. Try rdisk0 instead of disk0

sudo dd if=/dev/rdisk0 of=~/ntfsguess2_4s.bin skip=782726216 bs=128m count=1

 

[iamandrebulatov]

I tried both 128mb x 1count and 1mb x 128count, same thing.

 

[murphychris]

sudo dd if=/dev/rdisk0 of=~/ntfsguess2_4s.bin skip=782726216 count=262144

If that doesn't work I'm going to wonder if this is the same disk that accepted the same command with a count of 4!

----------

FWIW that diskX designation isn't guaranteed to be the same between reboots. If you've rebooted:

diskutil list

To see if you're using the correct designation. If this is a smaller disk, then that skip value is defining an LBA that doesn't exist on the drive, and hence nothing can be copied.