MacOS – How to fix the partition table

apfsbootcampdisk-utilitymacospartition

I think I severely ruined my partition table.

I had a BOOTCAMP partition, a macOS APFS partition, and an exFAT partition. I believe I also had 17GB of unallocated space.

I tried to shrink the BOOTCAMP partition, and I think that ruined the partition table. The BOOTCAMP partition errored on startup, and the macOS partition wasn't detected. From Internet Recovery, I reinstalled El Capitan from a USB drive onto another partition, while deleting the BOOTCAMP partition(I had a fairly recent backup). I'm currently using that, updated to High Sierra. It still does not see the older macOS partition, or the ~50GB of unallocated space(although I feel like most of that might be the missing macOS partition).

Furthermore, the Windows entry still shows when pressing alt/option on boot, although it errors like before. It doesn't show in startup disk or anywhere else.

I assume my BOOTCAMP partition is unrecoverable, which I'm mostly fine with. However, if possible, how can I recover my older macOS partition?

And mainly, how do I simply fix the partition table? Esp. the supposed Windows/BOOTCAMP partition that is there(although I'm sure it isn't) and the missing ~50GB

This is what Disk Utility says I have right now. Extra and Common are just empty partitions for now.

https://ibb.co/khN7pc

Below is the output from the command sudo gpt -r show disk0.

https://image.ibb.co/cyYxpc/Screen_Shot_2018_03_14_at_8_51_09_AM_1.png

Best Answer

The partition table of disk0 is not ruined at all - all changes made are rather unintended.

All partitions and volumes (EFI, Common, macOS and Extra) are properly marked and a diskutil verifyVolume disk0sYwill probably exit with no error.

A ruined partition table would miss the secondary partition header and table, or the primary and secondary header/table are different, or the CRC-32 checksums of the header and partition table entries are invalid.

Your partition table looks like this:

    start      size index contents                                        
        0         1       PMBR                                            
        1         1       Pri GPT header                                  
        2        32       Pri GPT table                                   
       34         6                                                       
       40    409600     1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B 
   409640  91672536                                                       
 92082176 168686104     2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC 
260768280    262144                                                       
261030424 177477424     3 GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC 
438507848  51464720     4 GPT part - 48465300-0000-11AA-AA11-00306543ECAC 
489972568    262151                                                       
490234719        32       Sec GPT table                                   
490234751         1       Sec GPT header

The first partition with a size of 209.7 MB - the standard EFI partition - is followed by unallocated disk space with a size of 46.94 GB.

The second partition is a standard HFS+ partition with a size of 86.37 GB followed by unallocated disk space with a (standard) size of 134.2 MB.

The third is a APFS container partition with a size of 90.87 GB. The fourth partition is another standard HFS+ partition with a size of 26.35 GB.

A default SSD partition layout would probably look like this after installing High Sierra (APFS) and a BOOTCAMP partition though:

     start      size index contents                                        
         0         1       PMBR                                            
         1         1       Pri GPT header                                  
         2        32       Pri GPT table                                   
        34         6                                                       
        40    409600     1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B 
    409640         X     2 GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC 
  X+409640    262144      
  X+671784         Y     3 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
X+Y+671784       ...     ...

The second unallocated disk space (262144 blocks) may be smaller or larger.

Consequently it depends on the size of your old macOS partition if parts of it were overwritten or not.

  • If X was equal to or smaller than 91672536 (blocks) your old macOS partition can be recovered completely.
  • If X was larger than 91672536 (blocks) and smaller than 260358640 (=91672536+168686104) (blocks) parts of your old macOS container partition were overwritten by creating the Common volume. Creating a new empty volume usually requires about 120 MB - 500 MB to write some file system metadata. Depending on the size of the APFS system/preboot/recovery volume parts of them may have been overwritten.

If the first block of your vanished APFS container (including your old macOS APFS system volume) wasn't overwritten you can detect its former size:

  • Boot to an external drive with macOS installed

  • Open Terminal and get the usual disk related details (below I assume the internal SSD has the disk identifier disk0):

    diskutil list
sudo gpt -r show disk0

  • Unmount the SSD

    diskutil umountDisk disk0

  • dd/hexdump block 409640:

    sudo dd if=/dev/disk0 bs=512 skip=409640 count=1 | hexdump

    which will yield something like this (example only!):

    1+0 records in
1+0 records out
512 bytes transferred in 0.001917 secs (267067 bytes/sec)
0000000 b9 e9 ff cb a4 6d fc f3 01 00 00 00 00 00 00 00
0000010 fc da 09 00 00 00 00 00 01 00 00 80 00 00 00 00
0000020 4e 58 53 42 00 10 00 00 29 ea 22 01 00 00 00 00
0000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000040 02 00 00 00 00 00 00 00 d8 36 06 fb 2f 1f 42 7a
0000050 b2 90 f5 cc 5c 85 9f 36 13 6f 08 00 00 00 00 00
0000060 fd da 09 00 00 00 00 00 18 01 00 00 18 6c 00 00
0000070 21 3c 06 00 00 00 00 00 28 c9 05 00 00 00 00 00
0000080 70 00 00 00 18 0f 00 00 6e 00 00 00 02 00 00 00
0000090 bc 0e 00 00 5c 00 00 00 af 6b 00 00 00 00 00 00
00000a0 69 ad 04 00 00 00 00 00 01 04 00 00 00 00 00 00
00000b0 00 00 00 00 64 00 00 00 03 04 00 00 00 00 00 00
00000c0 a4 6b 00 00 00 00 00 00 a6 6b 00 00 00 00 00 00
00000d0 a6 0d 01 00 00 00 00 00 00 00 00 00 00 00 00 00
00000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000200

    the third line is the important one:

    ...
0000020 4e 58 53 42 00 10 00 00 29 ea 22 01 00 00 00 00
...
    • 4e 58 53 42: magic string of an APFS container
    • 00 10 00 00: APFS block size: 4096

    • 29 ea 22 01 00 00 00 00 APFS container size in APFS blocks: 19065385 (=152523080 512-blocks)

      After re-arranging the Bytes 29 ea 22 01 00 00 00 00 > 00 00 00 00 29 ea 22 01 > 00 00 00 00 01 22 ea 29, you can get the decimal value here:

      enter image description here

    The size of the old APFS container in 512(blocks) is then APFS block size x container size in APFS blocks. In the example this is 4096/512 * 19065385 = 152523080 blocks.

  • depending of the former size remove the 2th partition:

    diskutil umountDisk disk0
sudo gpt remove -i 2 /dev/disk0

  • restore the old partition (here with the size of the example: 152523080 blocks(512) - don't use this one accidentally!):

    diskutil umountDisk disk0
sudo gpt add -i 2 -b 409640 -s 152523080 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0

  • check the APFS container

    diskutil verifyVolume disk0s2

  • check the APFS system volume

    diskutil list #get the device identifier of the APFS system volume and use it below (probably disk2s2)
diskutil verifyVolume diskXsY

If you have problems analyzing the hexdump or other results and error messages please leave a comment!

Related Question