How to recover Bootcamp NTFS Partition?

[Jyakomo]

How are you choosing Windows (System Preferences, or option key boot manager at the startup chime)?

Primarily through Mac's Toolbar "Restart in Windows" icon; however, I think the same thing will happen via System Preferences or a cold boot that goes directly to Windows based on previous (Windows) shutdown. But I can confirm that again with this new MBR.

Update: Yes, just confirmed that the same results with a cold boot.

Exactly when does the hang occur? This is before you see any indication Windows is booting? At the hang is there a cursor on a black screen or anything?

The hang occurs before any indication of Windows booting, after the Mac OS "chime". I don't see any cursor, just a blank screen.

Update: One other thing I didn't mention - the screen first appears white/light grey for about 20-25 seconds, then turns completely black, but no cursor, just black. Thus, my reference to a blank screen in my previous posts. Apologies for not giving this level of detail.

 

[murphychris]

The hang occurs before any indication of Windows booting, after the Mac OS "chime". I don't see any cursor, just a blank screen.

It's the CSM, Bootmgr, or Winload. There are some tests that could be done to narrow it down and maybe resolve the ambiguity - top on the list would be to test with a totally different bootloader (a non-Windows boot loader). If there's still a hang before anything appears on screen, it's virtually certain the problem is firmware (specifically the CSM).

On another note, I kinda' owe Apple Tech Support a reply since I have Applecare with my Mac-Mini. Are you ok if I share this exchange with them?

Yep.

Apple Tech Support seemed to right it off quickly as a Microsoft problem and not a Mac OS problem since I was able to boot Mac OS

That's totally bogus logic because Mac OS boots strictly in EFI mode without the CSM, whereas when booting Windows it's using the CSM. In effect Windows is using different firmware when it boots.

For example, the 2008 Macbook Pro, one of the Macs I have, can EFI boot OS X, and Linux from a USB stick. However, when I do this via the CSM, the USB bus vanishes. It's impossible to boot a BIOS dependent OS on this Mac via USB. And it's a firmware limitation. So the argument that since it works with OS X means that the problem isn't the hardware is bogus logic, they assume the hardware behaves the same with two OS's and that's untrue.

(from my perspective, I thought it too premature to discount BOOTCAMP without additional troubleshooting/symptoms).

And it is.

----------

Update: One other thing I didn't mention - the screen first appears white/light grey for about 20-25 seconds, then turns completely black, but no cursor, just black. Thus, my reference to a blank screen in my previous posts. Apologies for not giving this level of detail.

Interesting. That's a long delay at the gray screen. So when you disconnect the drive, is the gray screen still about 20-25 seconds? That whole gray screen phase is a firmware phase. Somewhere in there is when the CSM is executed, and then it does its own abbreviated POST, probably getting most of what it needs from EFI rather than doing it directly.

Too many people have 3TB USB drives connected for this to be a 3TB USB issue. This is a USB 3 drive? What Mac model? I suppose it could be related to USB 3.0... and not the sector size. xHCI might be new enough that it's not being dealt with by the CSM correctly (i.e. simply ignoring the attached USB 3.0 devices until later in the boot cycle).

 

[Jyakomo]

So when you disconnect the drive, is the gray screen still about 20-25 seconds?

Whether a cold-boot or from the Mac toolbar, its ~5 seconds before I hear the chime, then ~20 seconds of the white/grey screen, followed by ~10 seconds of the black screen before I get the "Starting Windows". So, this portion of the boot duration is about 35 seconds (5, 20, 10) before I see any text; namely the "Starting Windows" message. Keep in mind these are not scientific numbers, but approximate.

This is a USB 3 drive? What Mac model? /QUOTE]

Yes,from the Amazon order Seagate Backup Plus 3 TB USB 3.0 Desktop External Hard Drive (STCA3000101)

Mac Mini Mid 2011, running Lion (10.7.5). MacMini is running the Processor 2.5 GHz Intel Core i5,Memory 4 GB 1333 MHz DDR3.

 

[murphychris]

Seagate Backup Plus 3 TB USB 3.0 Desktop External Hard Drive (STCA3000101)

Well...maybe it's a USB 3.0 thing. That mini doesn't have USB 3.0, so the device falls back to USB 2.0. And I don't know how the CSM handles this. It'd require a lot of testing to find out if it's really 4096 logical sectors, or a USB 3.0 thing, or if it's a chipset bug.

And classic Apple, a 2011 Mac Mini, even if it has buggy firmware, has almost zero chance of seeing a firmware update again. The charge that Apple's firmware developers are incompetent, I think is sheer diplomacy. It's 2013, yet new Apple hardware still has firmware based on the Intel 1.10 which goes back to 2002. UEFI 2.0 was out in 2006, and 2.3.1 (current) has been out since 2011. So I consider their firmware situation to be fairly intentional.

 

[Jyakomo]

Post by murphychris. Follow-up concluding question

Anyway, the short term solution is to either disconnect the drive to boot Windows; or use a VM for Windows; or return the drive for a different 3TB drive that's 512e.

Final Comment
I have initiated the return process today since the purchase is new. I thank you for your help . . .

One final follow-up question
I have to change my strategy/approach to backups since I am running out of USB ports (actually prefer to minimize the usage of the USB ports). I'm leaning towards utilizing firewire since I can daisy chain some of the hard drives/hard drive enclosures. (I've got a lot of family VHS videos,, converting to digital).

Here's my question if you don't mind me asking . . . I want to think about purchasing external drives that support daisy chain whereby the drive can be powered down (ie, I know the firewire drives should all work in daisy chain fashion; however, do they follow the spec whereby any firewire drive does not need to be powered on. I'd like to know which external drives (and external enclosures) support the firewire specs. Is there a discussion forum that you can direct me to? Or where I can find the list of firewire drives that support the specs in terms of power up/down?

And again, thanks for all your help.

 

[murphychris]

I have initiated the return process today since the purchase is new.

It's a good idea. I just got some extra confirmation on GRUB devel (open source boot loader list) that this is likely problem with all existing BIOS. And it would not surprise me in the lease of existing CSM implementations are likewise affected.

do they follow the spec whereby any firewire drive does not need to be powered on.

I don't think this is knowable without asking presales to find out. Then if tech support doesn't know they can test it and let you know before they send you something they'll have to eat shipping on both ways (and for sure I'd make them do that if you ask presales and it doesn't work as expected).

I have a FW400/800 case, and FW400 case. If I connect the Mac via FW800 to the FW400 drive, it will power the FW400 without the FW800 being powered on. But the FW400 drive will not mount. It's getting power but isn't visible on the bus. I have to power on the FW800 drive for the FW400 drive to be visible.

 

[gptUser]

Hi, I'm having a similar problem except gdisk is telling me that my last partition (Windows partition) is too big for the disk. Any help is appreciated...

Warning! Mismatched GPT and MBR partition! MBR partition 4, of type 0x07,
has no corresponding GPT partition! You may continue, but this condition
might cause data loss in the future!

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI System Partition
   2          409640       485833255   231.5 GiB   AF00  Untitled 1
   3       486095400       487364935   619.9 MiB   AB00  Recovery HD
   4       487366656      1465147391   466.2 GiB   0700  UNTITLED 2

So it asks me to correct it and I say yes. But now it says the secondary partition table overlaps the last partition by 370 and that I will need to delete or resize the partition. Also my partition 4 is still too big...

Disk size is 1465147055 sectors (698.6 GiB)
MBR disk identifier: 0xDC1D9F65
MBR partitions:

Number  Boot  Start Sector   End Sector   Status      Code
   1                     1       409639   primary     0xEE
   2                409640    485833255   primary     0xAF
   3             486095400    487364935   primary     0xAB
   4      *      487366656   1465147391   primary     0x07

Recovery/transformation command (? for help): v

Problem: partition 4 is too big for the disk.

Warning! Secondary partition table overlaps the last partition by
370 blocks!
You will need to delete this partition or resize it in another utility.

Identified 2 problems!

Any suggestions??

 

[murphychris]

Any suggestions??

No. You haven't given enough information what you did to get into this situation.

Something wrote incorrect information to the MBR. Then you told gdisk to replace the GPT information with the incorrect MBR information. So chances are the Windows volume is lost without a lot of work. Maybe testdisk can help.

 

[gptUser]

No. You haven't given enough information what you did to get into this situation.

In short, I wiped my boot configuration on Windows so I had to repair it (all using Windows bcdedit tool). So I fixed the Windows BCD and can boot to it natively through the machine and through the option button at start up, but now I noticed that I don't see it when I boot to my Mac and look for the partition (in my Finder under devices or in Disk Utility with the debug menu).

So then on my Mac, the Disk Utility is not seeing it as per the diskutil list command but the VMware Raw Disk Tool is able to see it via the ...vmware-rawdiskCreator print disk0 command.

As I've been digging deeper (trying to gather info rather than trying to make changes) I've notice that some errors due to misalignments. gdisk says the Windows partition is too big for the disk. testdisk is saying heads and cylinders are mismatched and tracks per sectors too. Notice the bold/underlined text.

Disk /dev/disk0 - 750 GB / 698 GiB - [B][U]1465147055[/U][/B] sectors (RO)
Current partition structure:
     Partition                  Start        End    Size in sectors

> 1 P EFI GPT                        1     409639     409639                    

 Warning: Bad starting sector (CHS and LBA don't match)
  2 P HFS                       409640  485833255  485423616

 Warning: Bad starting sector (CHS and LBA don't match)
  3 P Darwin boot            486095400  487364935    1269536

 Warning: Bad starting sector (CHS and LBA don't match)
 Warning: number of heads/cylinder mismatches 71 (NTFS) != 1 (HD)
 Warning: number of sectors per track mismatches 63 (NTFS) != 1 (HD)
  4 * HPFS - NTFS            487366656 [U][B]1465147054[/B][/U]  977780399 [WIN]
    Next
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
>[Quick Search]  [ Backup ]
                            Try to locate partition

This is what I see when I do a Quick Search now with testdisk:

Disk /dev/disk0 - 750 GB / 698 GiB - [B][U]1465147055[/U][/B] sectors (RO)
     Partition               Start        End    Size in sectors
>* FAT32 LBA                     40     409639     409600 [EFI]
 P HFS                       409640  485833255  485423616
 P HFS                    486095400  487364935    1269536
 L HPFS - NTFS            487366656 [U][B]1465147391[/B][/U]  977780736 [WIN]

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue

I set the EFI partition to primary and the WIN partition to bootable and write it but the Start and End sectors look the same and seems to be the same config that I already have so nothing is happening (notice the bold/underlined text). But it is relieving to see my [WIN] partition since that is the correct name even.

So I think there can be a way to fix this if there's a Mac tool like bcdedit where I can repair or edit the Windows partition to fix the Start and End sectors. Of course, any more details you need to understand my predicament can be obtained.

 

[murphychris]

In short, I wiped my boot configuration on Windows so I had to repair it (all using Windows bcdedit tool).

That doesn't change the MBR entries. Just the BCD. Something altered the MBR, and did it incorrectly.

So I fixed the Windows BCD and can boot to it natively through the machine and through the option button at start up,

Back it up. Back up the Mac. Blow away the disk to a single partition (in Disk Utility's partition tab, set the disk from Current to 1 partition). Restore OS X from backup. Boot Camp Assistant to repartition the disk. Restore Windows. That's the easiest solution.

but now I noticed that I don't see it when I boot to my Mac and look for the partition (in my Finder under devices or in Disk Utility with the debug menu).

Both the MBR and GPT entries for the Windows volume are bogus because they define the volume as going off the end of the disk. Windows may be tolerant of this. Apparently OS X's read only NTFS support isn't.

As I've been digging deeper (trying to gather info rather than trying to make changes) I've notice that some errors due to misalignments. gdisk says the Windows partition is too big for the disk. testdisk is saying heads and cylinders are mismatched and tracks per sectors too. Notice the bold/underlined text.

Warning: Bad starting sector (CHS and LBA don't match)
2 P HFS 409640 485833255 485423616

CHS is old and not used by drives or OS's anymore, but the MBR has CHS encoded in them as well as LBA, because MBR comes from that era. The idea the MBR has mismatching CHS and LBA entries is not good. Either the tool modifying the MBR is buggy, or it's confused what the actual geometry of the drive is, as if the tool was used on the drive through a VM perhaps.

You could hexdump the MBR out and do a conversion on the CHS addresses, compared to LBA, and see if there's something more plausible with one vs the other. But that's a rat hole. Easier to just make backups, which you arguably should have already anyway, and blow away the drive and start over. And then don't use anything that touches the MBR that isn't explicitly designed for Boot Camp'd drives.

[quoteI set the EFI partition to primary and the WIN partition to bootable

You set it with what? GPT doesn't have such concepts. You should not be directly modifying the MBR. The GPT should be modified only, and then create a new hybrid MBR from the GPT.

So I think there can be a way to fix this if there's a Mac tool like bcdedit

No. BCD edit is a tool that edits the Windows boot configuration database, and OS X has nothing like that.

where I can repair or edit the Windows partition to fix the Start and End sectors. Of course, any more details you need to understand my predicament can be obtained.

There's no way to fix the start end sectors because the information you have between MBR and GPT is identical. So how are you going to fix it? Where are you going to get the right values? They aren't stored anywhere. You'd have to use something like ntfsfix or ntfsresize from NTFS-3G tools to probe the NTFS volume, find out how many sectors the volume is, and then make sure the volume is resized to something that can actually fit on your disk, then make sure the GPT has the proper start and end values based on the number of sectors of the resized NTFS volume. Then you create a hybrid MBR from the GPT.

I'm telling you, it's way way way easier, unless you want to learn more about partition schemes and file systems, to just back up and restore. You have that ability now.

 

[gptUser]

That doesn't change the MBR entries. Just the BCD. Something altered the MBR, and did it incorrectly.

I did try a system restore on Windows before fixing the BCD, I think that might have been what changed the MBR incorrectly, but I'm not sure since I didn't do much else.

I'm telling you, it's way way way easier, unless you want to learn more about partition schemes and file systems, to just back up and restore. You have that ability now.

I definitely don't mind learning about partition schemes and boot configurations. I was also looking at another thread, here they are directly re-creating the GPT.

sudo gpt remove -i 1 disk0
sudo gpt remove -i 2 disk0
sudo gpt remove -i 3 disk0
[...]
sudo gpt add -b 40 -i 1 -s 409600 -t efi disk0
sudo gpt add -b 409640 -i 2 -s 125829120 -t windows disk0
[...]

Would that be another option perhaps?

 

[murphychris]

I was also looking at another thread, here they are directly re-creating the GPT.

In that thread, the MBR has been modified, so the GPT contains stale information. Your MBR and GPT contain the same information.

sudo gpt add -b 40 -i 1 -s 409600 -t efi disk0

This will render the existing EFI system partition broken, because you're dropping 39 sectors from the replacement, compared to what's on the disk.

sudo gpt add -b 409640 -i 2 -s 125829120 -t windows disk0

And this adds an entry referring to OS X, Recovery HD, and Windows volumes, as a single partition. Where are you arriving at these ending values? In both cases they don't make sense.

Would that be another option perhaps?

It's an option that will make things more broken than they already are.

----------

Aha, you were copy pasting from the other thread. You should realize that every disk is unique. Instructions that fix someone else's disk have a very low probability (close to zero) of fixing yours.

That you can boot OS X, and from Recovery HD, and Windows, but can't read the Windows NTFS volume from OS X, implies the sole problem is with the ending sector value of GPT #4. To fix that, you need to use a tool that will tell you the size of the NTFS volume in sectors. Then you need to add that many sectors to the start sector for partition 4, to determine what the end sector value should be. Fix GPT entry #4. And then create a new hybrid MBR.

 

[gptUser]

That you can boot OS X, and from Recovery HD, and Windows, but can't read the Windows NTFS volume from OS X, implies the sole problem is with the ending sector value of GPT #4. To fix that, you need to use a tool that will tell you the size of the NTFS volume in sectors. Then you need to add that many sectors to the start sector for partition 4, to determine what the end sector value should be. Fix GPT entry #4. And then create a new hybrid MBR.

That sounds like what I was looking for. Do you know of a tool that can determine the number of sectors in a volume?

I also have a suspicion that the starting sector of that partition 3 is off too. So I could also use that tool to determine the end of partition 3 and then the proper start sector for partition 4.

Thanks again for the replies, the discussion is much appreciated and very interesting to learn about.

 

[murphychris]

That sounds like what I was looking for. Do you know of a tool that can determine the number of sectors in a volume?

ntfsinfo -m /dev/sdXY

X= disk designation, Y= partition designation. ntfsinfo can be found on some Linux distributions, notably the Fedora 18 LiveCD which can EFI boot some Mac models if you boot with the option key. The advantage of EFI booting is you can use dd to image a USB stick for booting. Whereas with the CSM-BIOS, you'll have to burn a CD/DVD.

ntfsinfo will report the volume size in clusters. So you need to multiply that value by the cluster size to get sectors. And then there is a padding for the partition, I believe it's 7 sectors. That is the partition needs to be 7 sectors larger than the volume.

I also have a suspicion that the starting sector of that partition 3 is off too. So I could also use that tool to determine the end of partition 3 and then the proper start sector for partition 4.

No. GPT #3 is Recovery HD, which is HFSJ formatted. ntfsinfo isn't going to give you useful information for an HFSJ volume. If you can boot from Recovery HD, then the start value is correct. If you can boot from Windows, its start value is also almost certainly correct (maybe absolutely certainly correct), because bootloaders are extremely intolerant, typically, of booting from a file system that actually has a different start point than expected. For the ending sector to be wrong is another matter. Windows kernel tends to kernel panic if the partition is smaller than the volume, but apparently can be somewhat tolerant if the partition is larger than the volume.

----------

FWIW, ntfsinfo is part of NTFS-3G utilities. I think testdisk leverages NTFS-3G so it's possible ntfsinfo is part of testdisk.

 

[joincto]

bootcamp problem: me too

Like several other posts on this thread I have had the BOOTCAMP partition become unusable -- 4 times already!

It happens infrequently but insofar as I can detect any pattern it seems to occur after (or during) a download or streaming of a video. I don't think it is virus related because the download itself is clean (subsequent inspection shows this).

The typical scenario is that there is some message from windows which disappears before one can read it (don't you just love that OS?), a busy cursor appears, the application becomes unresponsive, the explorer desktop icons vanish.

The only recovery seems to be to reboot, and you then find that the partition which contains the windows installation no longer mounts. The partition is still there, but in disk doctor appears to be FAT and not NTFS as expected.

This is my fourth experience of this kind, and I have read this thread with interest. But I don't think the gpt is corrupt. What is very clear is that something with BOOTCAMP is royally f...d up. Whether it is native to the bootcamp implementation or an unfortunate interaction with windows is unclear. But my usual rule of thumb is: if something is screwed up look no further that windooooooz for a reason.

 

[murphychris]

The partition is still there, but in disk doctor appears to be FAT and not NTFS as expected.

What is disk doctor?

This is my fourth experience of this kind, and I have read this thread with interest. But I don't think the gpt is corrupt. What is very clear is that something with BOOTCAMP is royally f...d up. Whether it is native to the bootcamp implementation or an unfortunate interaction with windows is unclear. But my usual rule of thumb is: if something is screwed up look no further that windooooooz for a reason.

Well that's a useless editorialization. You haven't provided any useful information about the state of the partition scheme, or volumes, before the problem occurred, and after the problem occurred.

In my opinion, Apple's implementation is ill advised in 2013, but if you use it exactly, and only, as they have documented, it's reasonably safe, albeit very limited and still more fragile of a system than using a VM.

 

[gigas65]

Hi. Can you please advise with that?
My Bootcamp partition does not boot but showing in OSX. At first i had a Bootcamp drive in my hard disk working properly. I made a winclone image after shrinking the NTFS filesystem to fit in my new SSD newmade Bootcamp partition and then i had 2 Bootcamp drives for a day, but i deleted the first (first in harddisk, second in SSD).

Now the remaining Bootcamp i made restoring the above image, does not boot and i am afraid i messed it up.

Can you please help? Giving info below.

Disk: /dev/disk0	geometry: 31130/255/63 [500118192 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE    0   0   2 -   25 127  14 [         1 -     409639] <Unknown ID>
 2: AF   25 127  15 - 1023 183  49 [    409640 -  264063968] HFS+        
 3: AB 1023 183  50 - 1023 190   9 [ 264473608 -    1269536] Darwin Boot 
*4: 07 1023 209  53 - 1023 223   5 [ 265744384 -  234373120] HPFS/QNX/AUX

GPT fdisk (gdisk) version 0.8.6

Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.
Disk /dev/disk0: 500118192 sectors, 238.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 8AC54F62-A719-4260-ADD4-3CEA49AE7F8E
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 500118156
Partitions will be aligned on 8-sector boundaries
Total free space is 1899 sectors (949.5 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI System Partition
   2          409640       264473607   125.9 GiB   AF00  Untitled
   3       264473608       265743143   619.9 MiB   AB00  Recovery HD
   4       265744384       500117503   111.8 GiB   0700  BOOTCAMP

gpt show: disk0: mediasize=256060514304; sectorsize=512; blocks=500118192
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 500118191
      start       size  index  contents
          0          1         MBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  264063968      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  264473608    1269536      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  265743144       1240         
  265744384  234373120      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  500117504        655         
  500118159         32         Sec GPT table
  500118191          1         Sec GPT header

Thank you in advance,
Alex!

 

[pkeukens]

Chris can you help?

Hi Chris can you help?

Somehow my bootcamp partition got corrupted. A while ago I extended my bootcamp partition with about 100 gb using a tool on windows which said it would work on bootcamp partitions as well. The problem was that the space was on the wrong side of the partition. After extending the partition all was well and worked probably. all of a sudden yesterday I booted into mac from windows and installed mac updates after that my bootcamp partition wasn't found anymore. I think what happend is that the 100 gb is lost and the partition shrunk back to it's original size.

here is the info from fdisk / gdisk and gpt I hope you can and are willing to help!

Disk: /dev/disk0	geometry: 121601/255/63 [1953525168 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE    0   0   2 -   25 127  14 [         1 -     409639] <Unknown ID>
 2: AF   25 127  15 - 1023 254  63 [    409640 - 1441562496] HFS+        
 3: AB 1023 254  63 - 1023 254  63 [1441972136 -    1269544] Darwin Boot 
*4: 07 1023 254  63 - 1023 254  63 [1443241984 -  510281728] HPFS/QNX/AUX

GPT fdisk (gdisk) version 0.8.7

Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.
Disk /dev/disk0: 1953525168 sectors, 931.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 000043F8-7260-0000-9270-0000F0350000
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1953525134
Partitions will be aligned on 8-sector boundaries
Total free space is 195309253 sectors (93.1 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI system partition
   2          409640      1441972135   687.4 GiB   AF00  Customer
   3      1441972136      1443241679   619.9 MiB   AB00  Recovery HD
   4      1638549504      1953523711   150.2 GiB   0700  BOOTCAMP

       start        size  index  contents
           0           1         MBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640  1441562496      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  1441972136     1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  1443241680         304         
  1443241984   195307520      4  
  1638549504   314974208      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  1953523712        1423         
  1953525135          32         Sec GPT table
  1953525167           1         Sec GPT header

Thanks in advance!

 

[murphychris]

Hi Chris can you help?

Weirdly, gdisk has the correct GPT information but the gpt program sees two partition 4's for some reason.

Try using gdisk to verify the GPT from the recovery menu.

sudo gdisk /dev/disk0
r
v
[result]
o
[result]
p
[result]

Post all of the results from start to finish, don't cut off headers for brevity.

If the verify is OK, I would actually write out the partition table
w

And then reboot and see if anything has changed, including rerunning the gpt -r -v show disk0 command to see if it now has one partition 4. If not, you'll have to get more aggressive - i.e. delete partition 4, readd it with the (presumably) correct start and end values from the first gdisk result, and write out the partition table, reboot again.

I think what happend is that the 100 gb is lost and the partition shrunk back to it's original size.

It appears to be correct in the MBR. It's unclear if it's correct in the GPT but Windows on BIOS hardware ignores the GPT anyway.

 

[pkeukens]

Weirdly

Hi Chris, thanks for your quick reply, here are the results:

The verify results:

Warning! Mismatched GPT and MBR partition! MBR partition 4, of type 0x07,
has no corresponding GPT partition! You may continue, but this condition
might cause data loss in the future!

Identified 1 problems!

The o Results:

Disk size is 1953525168 sectors (931.5 GiB)
MBR disk identifier: 0x00002F9A
MBR partitions:

Number  Boot  Start Sector   End Sector   Status      Code
   1                     1       409639   primary     0xEE
   2                409640   1441972135   primary     0xAF
   3            1441972136   1443241679   primary     0xAB
   4      *     1443241984   1953523711   primary     0x07

The P results:

Disk /dev/disk0: 1953525168 sectors, 931.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 000043F8-7260-0000-9270-0000F0350000
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1953525134
Partitions will be aligned on 8-sector boundaries
Total free space is 195309253 sectors (93.1 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI system partition
   2          409640      1441972135   687.4 GiB   AF00  Customer
   3      1441972136      1443241679   619.9 MiB   AB00  Recovery HD
   4      1638549504      1953523711   150.2 GiB   0700  BOOTCAMP

hmmm in the last result the bootcamp partition starts at a different sector.

Thanks Patrick

 

[murphychris]

Warning! Mismatched GPT and MBR partition!

Windows doesn't boot which implies the MBR is wrong, but to me the start and end values are more plausible than what's in the GPT.

Does the BOOTCAMP volume mount in the OS X Finder automatically? Or is it missing?

 

[pkeukens]

Windows doesn't boot which implies the MBR is wrong, but to me the start and end values are more plausible than what's in the GPT.

Does the BOOTCAMP volume mount in the OS X Finder automatically? Or is it missing?

Hi Chris,

Bootcamp doesn't mount in Mac OS X and it doesn't show in bootcamp menu where you can select start up disk.

The results from the o option should be the correct one I think. The results from p looks like what it was before I extended the partition. the start / end sector in the o option include the 100 GIG I extended the partition with.

At least that's what it looks like to me, from what I could tell is that the start sector of the MBR should be 1443241984 instead of 1638549504

 

[murphychris]

Hi Chris,

Bootcamp doesn't mount in Mac OS X and it doesn't show in bootcamp menu where you can select start up disk.

The results from the o option should be the correct one I think. The results from p looks like what it was before I extended the partition. the start / end sector in the o option include the 100 GIG I extended the partition with.

At least that's what it looks like to me, from what I could tell is that the start sector of the MBR should be 1443241984 instead of 1638549504

Yep. So what you need to do is use gdisk to delete partition 4. Then add a new partition which should default to 4, and then see if the default start LBA it proposes is correct. If so accept it, if not manually type in the correct start. And do the same for the end value. The type code should be 0700.

Write out the new partition table, reboot, and then rerun the fdisk and gpt commands to list the two partition maps and post that - and also mention whether or not the bootcamp volume is now mounting in the OS X Finder.

 

[pkeukens]

Yep. So what you need to do is use gdisk to delete partition 4. Then add a new partition which should default to 4, and then see if the default start LBA it proposes is correct. If so accept it, if not manually type in the correct start. And do the same for the end value. The type code should be 0700.

Write out the new partition table, reboot, and then rerun the fdisk and gpt commands to list the two partition maps and post that - and also mention whether or not the bootcamp volume is now mounting in the OS X Finder.

Hi Chris,

Can You Tell me how To do This, I'm not that familiar with gdisk, so help would be appreciated.

Thanks Patrick

 

[pkeukens]

Can see data now but can't boot yet

Yep. So what you need

Hi Chris,

I deleted the partition and recreated it with the start and end sector, now the drive mounts again in Mac OS X and I can see my data so that's good news. Now the only thing is I can't boot into it yet because bootcamp doesn't list the drive in it's menu. So when I go to "System preferences" and want to select startup disk it only lists Mac OS drive and not bootcamp.

here are the results from: sudo gpt -r -vv show disk0

gpt show: disk0: mediasize=1000204886016; sectorsize=512; blocks=1953525168
gpt show: disk0: Suspicious MBR at sector 0
gpt show: disk0: Pri GPT at sector 1
gpt show: disk0: Sec GPT at sector 1953525167
       start        size  index  contents
           0           1         MBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640  1441562496      2  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  1441972136     1269544      3  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
  1443241680         304         
  1443241984   510281728      4  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  1953523712        1423         
  1953525135          32         Sec GPT table
  1953525167           1         Sec GPT header

sudo fdisk /dev/disk0

Disk: /dev/disk0	geometry: 121601/255/63 [1953525168 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE    0   0   2 -   25 127  14 [         1 -     409639] <Unknown ID>
 2: AF   25 127  15 - 1023 254  63 [    409640 - 1441562496] HFS+        
 3: AB 1023 254  63 - 1023 254  63 [1441972136 -    1269544] Darwin Boot 
*4: 07 1023 254  63 - 1023 254  63 [1443241984 -  510281728] HPFS/QNX/AUX

sudo gdisk -l /dev/disk0

GPT fdisk (gdisk) version 0.8.7

Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.
Disk /dev/disk0: 1953525168 sectors, 931.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 000043F8-7260-0000-9270-0000F0350000
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1953525134
Partitions will be aligned on 8-sector boundaries
Total free space is 1733 sectors (866.5 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI system partition
   2          409640      1441972135   687.4 GiB   AF00  Customer
   3      1441972136      1443241679   619.9 MiB   AB00  Recovery HD
   4      1443241984      1953523711   243.3 GiB   0700  Microsoft basic data

sudo gdisk /dev/disk0
r
v
result:

No problems found. 1733 free sectors (866.5 KiB) available in 3
segments, the largest of which is 1423 (711.5 KiB) in size.

o result:

Disk size is 1953525168 sectors (931.5 GiB)
MBR disk identifier: 0x00002F9A
MBR partitions:

Number  Boot  Start Sector   End Sector   Status      Code
   1                     1       409639   primary     0xEE
   2                409640   1441972135   primary     0xAF
   3            1441972136   1443241679   primary     0xAB
   4      *     1443241984   1953523711   primary     0x07

the p result:

Disk /dev/disk0: 1953525168 sectors, 931.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 000043F8-7260-0000-9270-0000F0350000
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1953525134
Partitions will be aligned on 8-sector boundaries
Total free space is 1733 sectors (866.5 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI system partition
   2          409640      1441972135   687.4 GiB   AF00  Customer
   3      1441972136      1443241679   619.9 MiB   AB00  Recovery HD
   4      1443241984      1953523711   243.3 GiB   0700  Microsoft basic data

That's all the info, I hope you can help me to take this last hurdle and make it boot again, many thanks so far!

Cheers Patrick