How can I get back my data from the FFFF… partition which is ~350 GB by fixing the partition table?
977105059 1 Sec GPT header
Riccados—MacBook—Pro:~ Riccado$ sudo gpt —r show /dev/disk0s2
start size index contents
0 683645536
Riccados—MacBook—Pro:~ Riccado$ sudo gpt —r show /day/disk0
start size index contents
0 1 PMBR
1 1 Pri GPT header
2 32 Pri GPT table
34 6
40 409600 1 GPT part — C12A7328—F81F-11D2-6A46-00A0C93EC938
409640 683645536 2 GPT part — FFFFFFFF—FFFF—FFFF—FFFF—FFFFFFFFFFFF
684055176 1269536 3 GPT part — 48465300-0000-11AA—AA11-00306543ECAC
685324712 49224610 4 GPT part — OFC63DAF-8483-4772-8E79-3D69D8477DE4
734549322 694
734550016 8073216 5 GPT part — 0657FD6D—A4AB-43C4-84E5-0933C84B4F4F
742623232 233212248 6 GPT part — 53746F72-6167-11AA—AA11-00306543ECAC
975835480 1269544 7 GPT part — 426F6F74-0000-11AA—AA11-00306543ECAC
977105024 3
977105027 32 Sec GPT table
977105059 1 Sec GPT header
Riccados—MacBook—Pro:~ Riccado$ diskutil unmountDisk /dev/disk1
Unmount of disk1 failed: at least one volume could not be unmounted
Riccados—MacBook—Pro:~ Riccado$
The disk is 500 GB in total. 350 GB is assigned for macOS, 120 GB for Windows and 30 GB for Ubuntu.
This morning when I woke up, I tried to boot my Mac but it didn't boot successfully as it is just showing the prohibitory sign. So I tried to fresh install macOS, pressing command ⌘–R when starting the Mac to enter Recovery Mode. But only the Windows partition (120 GB) is showing to reinstall macOS on instead of the original 350 GB partition. I reinstalled macOS on the 120 GB partition. Now I don't know how to retrieve my files back from the old 350 GB partition. They all are in same disk. Linux is not booting now too.
Best Answer
The second partition of your internal disk got the wrong partition type, your data probably won't be lost.
A bootable OS X partition (except the Recovery HD) either has the GUID 48465300-0000-11AA-AA11-00306543ECAC for a standard OS X partition or the GUID 53746F72-6167-11AA-AA11-00306543ECAC for a CoreStorage partition. The FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF is an unknown partition type (but not no partition like the 000000-0000-0000.... one).
The first block of a standard OS X partition doesn't contain non-zeros, the first block of a CoreStorage partition contains some non-zeros. To get the first 3 blocks of a partition enter
sudo dd if=/dev/diskXsY count=3 | hexdump.The GUID can be modified with
gpt. Modifying the GUID partition table with gpt requires to unmount the whole disk which can't be done if you boot to its Recovery HD or another boot volume on the same disk.hexdump. Here it was possible to boot to Internet Recovery because the disk contains a second OS X system (disk0s6) with hexdump. The (Internet) Recovery HD usually doesn't provide hexdump.diskutil listGet an overview of your internal disk with the disk identifier found in the previous command. Below I assume the disk identifier of your internal disk is disk1 (replace it with the one you have found in your environment)
diskutil umountDisk disk1if booted to an external disk/thumb drive with a full OS X/macOShexdump the first 3 blocks of the FFFF... partition:
or (depending on your boot volume)
The following result identifies it as a normal OS X partition:
The first number is the byte count in hex: 0000000: 0; 0000600: 1536. The * denotes identical lines. This means: the first two blocks (0x000-0x3ff) are all zeros.
A CoreStorage partition shows some non-zeros in the first block (0x000-0x1ff):
The line starting with byte 0x130 shows the UUID of the Physical Volume, the line starting with byte 0x140 shows the UUID of the Logical Volume Group.
The string 48 46 53 4a (= "HFSJ") in the first 16 bytes of the third blocks identifies a Journaled HFS+ volume.
First fix your Recovery partition:
Now remove the second partition:
re-add the partition with the proper type
either a normal OS X partition
or (if you have found a CoreStorage partition)
Finally verify/repair the disk with
diskutil verifyDisk disk1and/ordiskutil verifyVolume disk1s2. If a repair is needed use repair (instead of verify) as prefix in the above commands.If you don't have an OS X/macOS volume with hexdump use this answer: How do I recover/fix my OS X partition?