Mac – Lost the APFS partition after using EaseUS partition manager on Bootcamp

apfsbootbootcampmacpartition

I used macOS mojave(APFS partition) and Windows10(Bootcamp). And I tried to expand Bootcamp partition with moving Windows OEM partition by EaseUS partition master in windows.
After this, I can’t find APFS partition installed macOS.

I use MacBook Pro 2016.

I think “disk0s2” was APFS partition, but now it is “Windows Recovery” partition.

Do you have any ideas to solve this?
(I am Japanese, so I'm sorry for my poor English)

I tried “gpt show” and “diskutil list” on macOS Recovery
I tried “got show” and “diskutil list” on macOS Recovery

Additional information
I tried dd if=/dev/disk0s2 count=1 bs=512 command in a Terminal app of macOS Utility from network boot, and the terminal says,

-bash-3.2# dd if=/dev/disk0s2 count=1 bs=512 | vis -c
1+0 records in
1+0 records out
512 bytes transferred in 0.005472 secs (93568 bytes/sec)
)us??-ҵ?\^A\0\0\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^A\0\0\M^@\0\0\0\0NXSB\0\^P\0\0?\M^B?\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\^B\0\0\0\0\0\0\0"\^R???\M^_@}\M^Bvy57
?(h?8\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^X\^A\0\0 l\0\0?\M^J\0\0\0\0\0\0\^R\r\0\0\0\0\0\0\a\0\0\0004*\0\0\^E\0\0\0\^B\0\0\0\^S*\0\0!\0\0\0\M^Qr8\0\0\0\0\0\M^U?\b\0\0\0\0\0\^A\^D\0\0\0\0\0\0\0\0\0\0d\0\0\0\^C\^D\0\0\0\0\0\0\M^T\M^N\^A\0\0\0\0\0\M^V\M^N\^A\0\0\0\0\0?0\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0-bash-3.2#

.

Best Answer

From Windows, you can open a Command Prompt window as an Administrator. Next, you could enter the commands given below to change disk0s2 to an APFS type.

diskpart
select disk 0
select partition 2
set id=7C3457EF-0000-11AA-AA11-00306543ECAC override
gpt attributes=0x0000000000000000
exit

Update

The output from dd if=/dev/disk0s2 count=1 bs=512 | vis -c contains the character sequence NXSB which gives evidence that disk0s2 is a APFS container. The sequence that follows NXSB is \0\^P\0\0?\M^B?\^B\0\0\0\0\. This sequence indicates the size value of 49283834 in the GPT is wrong for the 2nd entry (disk0s2). This incorrect value would cause the APFS volume to remain unmounted. Unfortunately, because the sequence contains question mark (?) characters, the correct value for the size can not be precisely determined.

Based on this new information, I can only guess at a solution. Below is my best guess.

Enter the following commands while booted to macOS Internet Recovery.

diskutil unmountdisk /dev/disk0
gpt remove -i 2 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt remove -i 3 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt add -i 2 -b 76806 -s 49316602 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0

How to determine the exact size for disk0s2.

  1. While booted to macOS Internet Recovery, copy the first 512 bytes of disk0s2 to a flash drive. Below is an example, where the flash drive volume label is MYFLASHDRV. You will need a flash drive that is MS-DOS (FAT) or ExFAT formatted.

    dd if=/dev/disk0s2 count=1 bs=512 of=/Volumes/MYFLASHDRV/hexdump.bin

  2. Print out a hex dump of the saved file. Post the output to your question.

    Upload the hexdump.bin file to the website File to hexadecimal converter.

    Note: Before uploading the file, make sure the box labeled "Use 0x and comma as separator (C-like)" is unchecked and the box labeled "Insert newlines after each 16B" is checked off.

    Or, find another Mac and run the command shown below.

    hexdump -Cv /Volumes/MYFLASHDRV/hexdump.bin

    Or, boot to Windows, then download and run the command shown below. Here, I assume the flash drive is assigned the drive letter D:.

    writehex < D:\hexdump.bin

    Note: You will need to download the readgpt1.1.0x64.zip file from the readgpt website. You can extract the writehex.exe application from this zip file. This is a website that I created.

  3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). I can do this for you and update my answer. Or, you can read the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

Alternative method to determine the exact size for disk0s2.

  1. While booted to macOS Internet Recovery, enter the commands given below.

    export LC_CTYPE="ASCII"
dd if=/dev/disk0s2 bs=1 count=16 skip=32 2>/dev/null | vis -wc; echo

    If value of 49316602 posted in my above guess is correct, then you should get the following output.

    NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0

    If your results are different, then you can post your results and wait for me to update my answer. OR, you can proceed to step 2.

  2. Find another Mac and enter the command shown below. Here you need to replace the string with your results.

    Note: It is important that the string be enclosed by single quotes ('). Do not use double quotes (").

    echo -n 'NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0' | unvis | hexdump -Cv

    The above command would produce the following output.

    00000000  4e 58 53 42 00 10 00 00  fa 82 f0 02 00 00 00 00  |NXSB............|
00000010

  3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). The procedure for doing this is posted in the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

Related Question