MacOS – Unable to boot on the APFS partition

disk-utilityhard drivemacospartitionterminal

After a restart, I'm unable to boot on my macOS partition encrypted with FileVault on Catalina on a 2016 Macbook Pro.

I can only boot on my Bootcamp and Recovery partitions. It seems like the issue is very similar to this StackExchange question:
APFS partition inaccessible, container missing

Unfortunately, I'm not able to adapt @david-anderson's answer to my case because of a lack of technical knowledge on that subject.

Can anyone please help me?

Here is some command I typed to have more infos:

-bash-3.2# diskutil list disk0
/dev/disk0 (internal):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                         1.0 TB     disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS                         799.1 GB   disk0s2
   3:       Microsoft Basic Data Windows                 200.7 GB   disk0s3
   4:           Windows Recovery                         497.0 MB   disk0s4
-bash-3.2# gpt -r show disk0
      start       size  index  contents
          0          1         PMBR
          1          1         Pri GPT header
          2          4         Pri GPT table
          6      76800      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      76806  195082746      2  GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC
  195159552   48995014      3  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  244154566         58         
  244154624     121344      4  GPT part - DE94BBA4-06D1-4D40-A16A-BFD50179D6AC
  244275968        292         
  244276260          4         Sec GPT table
  244276264          1         Sec GPT header
-bash-3.2# diskutil cs list
No CoreStorage logical volume groups found
-bash-3.2# diskutil ap list
No APFS Containers found
-bash-3.2# diskutil list internal
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS                         799.1 GB   disk0s2
   3:       Microsoft Basic Data Windows                 200.7 GB   disk0s3
   4:           Windows Recovery                         497.0 MB   disk0s4
-bash-3.2# diskutil info disk0s2
   Device Identifier:        disk0s2
   Device Node:              /dev/disk0s2
   Whole:                    No
   Part of Whole:            disk0

   Volume Name:              Not applicable (no file system)
   Mounted:                  Not applicable (no file system)
   File System:              None

   Partition Type:           Apple_APFS
   OS Can Be Installed:      No
   Media Type:               Generic
   Protocol:                 PCI-Express
   SMART Status:             Not Supported
   Disk / Partition UUID:    42B60681-B193-40F8-AAD5-B2B2F43BD538

   Disk Size:                799.1 GB (799058927616 Bytes) (exactly 1560661968 512-Byte-Units)
   Device Block Size:        4096 Bytes

   Read-Only Media:          No
   Read-Only Volume:         Not applicable (no file system)

   Device Location:          Internal
   Removable Media:          Fixed

   Solid State:              Yes

Here is some other commands I tried in order to verify or repair the disk, with no luck:

-bash-3.2# diskutil verifyVolume disk0s2
Started file system verification on disk0s2
Verifying storage system
Storage system check exit code is 8
Error: -69716: Storage system verify or repair failed
Underlying error: 8: Exec format error
-bash-3.2# diskutil repairDisk disk0
Repairing the partition map might erase disk0s1, proceed? (y/N) y
Started partition map repair on disk0
Checking prerequisites
Checking the partition list
Adjusting partition map to fit whole disk as required
Checking for an EFI system partition
Checking the EFI system partition's size
Checking the EFI system partition's file system
Checking the EFI system partition's folder content
Checking all HFS data partition loader spaces
Checking booter partitions
Reviewing boot support loaders
Checking Core Storage Physical Volume partitions
Updating Windows boot.ini files as required
The partition map appears to be OK
Finished partition map repair on disk0

EDIT: here is the result of the command that @klanomath kindly asked:

-bash-3.2# dd if=/dev/disk0 bs=512 count=1 skip=614448 2>/dev/null | vis -wc; echo
3\M-@\M^N\M-P\M-<\0|\M^N\M-@\M^N\M-X\M->\0|\M-?\0\^F\M-9\0\^B\M-|\M-s\M-$Ph\^\\^F\M-K\M-{\M-9\^D\0\M-=\M->\a\M^@~\0\0|\v\^O\M^E\^P\^A\M^C\M-E\^P\M-b\M-q\M-M\^X\M^HV\0U\M-FF\^Q\^E\M-FF\^P\0\M-4A\M-;\M-*U\M-M\^S]r\^O\M^A\M-{U\M-*u\t\M-w\M-A\^A\0t\^C\M-~F\^Pf`\M^@~\^P\0t&fh\0\0\0\0f\M^?v\bh\0\0h\0|h\^A\0h\^P\0\M-4B\M^JV\0\M^K\M-t\M-M\^S\M^_\M^C\M-D\^P\M^^\M-k\^T\M-8\^A\^B\M-;\0|\M^JV\0\M^Jv\^A\M^JN\^B\M^Jn\^C\M-M\^Sfas\^^\M-~N\^Q\^O\M^E\f\0\M^@~\0\M^@\^O\M^D\M^J\0\M-2\M^@\M-k\M^BU2\M-d\M^JV\0\M-M\^S]\M-k\M^\\M^A>\M-~}U\M-*un\M^?v\0\M-h\M^J\0\^O\M^E\^U\0\M-0\M-Q\M-fd\M-h\^?\0\M-0\M-_\M-f`\M-hx\0\M-0\M^?\M-fd\M-hq\0\M-8\0\M-;\M-M\^Zf#\M-@u;f\M^A\M-{TCPAu2\M^A\M-y\^B\^Ar,fh\a\M-;\0\0fh\0\^B\0\0fh\b\0\0\0fSfSfUfh\0\0\0\0fh\0|\0\0fah\0\0\a\M-M\^ZZ2\M-v\M-j\0|\0\0\M-M\^X\240\M-7\a\M-k\b\240\M-6\a\M-k\^C\240\M-5\a2\M-d\^E\0\a\M^K\M-p\M-,<\0t\M-|\M-;\a\0\M-4\^N\M-M\^P\M-k\M-r+\M-I\M-dd\M-k\0$\^B\M-`\M-x$\^B\M-CInvalid\spartition\stable\0Error\sloading\soperating\ssystem\0Missing\soperating\ssystem\0\0\0\0bz\M^Yq\^T\^Q\^Y\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0U\M-*

[~] $ echo -n '3\M-@\M^N\M-P\M-<\0|\M^N\M-@\M^N\M-X\M->\0|\M-?\0\^F\M-9\0\^B\M-|\M-s\M-$Ph\^\\^F\M-K\M-{\M-9\^D\0\M-=\M->\a\M^@~\0\0|\v\^O\M^E\^P\^A\M^C\M-E\^P\M-b\M-q\M-M\^X\M^HV\0U\M-FF\^Q\^E\M-FF\^P\0\M-4A\M-;\M-*U\M-M\^S]r\^O\M^A\M-{U\M-*u\t\M-w\M-A\^A\0t\^C\M-~F\^Pf`\M^@~\^P\0t&fh\0\0\0\0f\M^?v\bh\0\0h\0|h\^A\0h\^P\0\M-4B\M^JV\0\M^K\M-t\M-M\^S\M^_\M^C\M-D\^P\M^^\M-k\^T\M-8\^A\^B\M-;\0|\M^JV\0\M^Jv\^A\M^JN\^B\M^Jn\^C\M-M\^Sfas\^^\M-~N\^Q\^O\M^E\f\0\M^@~\0\M^@\^O\M^D\M^J\0\M-2\M^@\M-k\M^BU2\M-d\M^JV\0\M-M\^S]\M-k\M^\\M^A>\M-~}U\M-*un\M^?v\0\M-h\M^J\0\^O\M^E\^U\0\M-0\M-Q\M-fd\M-h\^?\0\M-0\M-_\M-f`\M-hx\0\M-0\M^?\M-fd\M-hq\0\M-8\0\M-;\M-M\^Zf#\M-@u;f\M^A\M-{TCPAu2\M^A\M-y\^B\^Ar,fh\a\M-;\0\0fh\0\^B\0\0fh\b\0\0\0fSfSfUfh\0\0\0\0fh\0|\0\0fah\0\0\a\M-M\^ZZ2\M-v\M-j\0|\0\0\M-M\^X\240\M-7\a\M-k\b\240\M-6\a\M-k\^C\240\M-5\a2\M-d\^E\0\a\M^K\M-p\M-,<\0t\M-|\M-;\a\0\M-4\^N\M-M\^P\M-k\M-r+\M-I\M-dd\M-k\0$\^B\M-`\M-x$\^B\M-CInvalid\spartition\stable\0Error\sloading\soperating\ssystem\0Missing\soperating\ssystem\0\0\0\0bz\M^Yq\^T\^Q\^Y\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0U\M-*' | unvis | hexdump -Cv
00000000  33 c0 8e d0 bc 00 7c 8e  c0 8e d8 be 00 7c bf 00  |3.....|......|..|
00000010  06 b9 00 02 fc f3 a4 50  68 1c 06 cb fb b9 04 00  |.......Ph.......|
00000020  bd be 07 80 7e 00 00 7c  0b 0f 85 10 01 83 c5 10  |....~..|........|
00000030  e2 f1 cd 18 88 56 00 55  c6 46 11 05 c6 46 10 00  |.....V.U.F...F..|
00000040  b4 41 bb aa 55 cd 13 5d  72 0f 81 fb 55 aa 75 09  |.A..U..]r...U.u.|
00000050  f7 c1 01 00 74 03 fe 46  10 66 60 80 7e 10 00 74  |....t..F.f`.~..t|
00000060  26 66 68 00 00 00 00 66  ff 76 08 68 00 00 68 00  |&fh....f.v.h..h.|
00000070  7c 68 01 00 68 10 00 b4  42 8a 56 00 8b f4 cd 13  ||h..h...B.V.....|
00000080  9f 83 c4 10 9e eb 14 b8  01 02 bb 00 7c 8a 56 00  |............|.V.|
00000090  8a 76 01 8a 4e 02 8a 6e  03 cd 13 66 61 73 1e fe  |.v..N..n...fas..|
000000a0  4e 11 0f 85 0c 00 80 7e  00 80 0f 84 8a 00 b2 80  |N......~........|
000000b0  eb 82 55 32 e4 8a 56 00  cd 13 5d eb 9c 81 3e fe  |..U2..V...]...>.|
000000c0  7d 55 aa 75 6e ff 76 00  e8 8a 00 0f 85 15 00 b0  |}U.un.v.........|
000000d0  d1 e6 64 e8 7f 00 b0 df  e6 60 e8 78 00 b0 ff e6  |..d......`.x....|
000000e0  64 e8 71 00 b8 00 bb cd  1a 66 23 c0 75 3b 66 81  |d.q......f#.u;f.|
000000f0  fb 54 43 50 41 75 32 81  f9 02 01 72 2c 66 68 07  |.TCPAu2....r,fh.|
00000100  bb 00 00 66 68 00 02 00  00 66 68 08 00 00 00 66  |...fh....fh....f|
00000110  53 66 53 66 55 66 68 00  00 00 00 66 68 00 7c 00  |SfSfUfh....fh.|.|
00000120  00 66 61 68 00 00 07 cd  1a 5a 32 f6 ea 00 7c 00  |.fah.....Z2...|.|
00000130  00 cd 18 a0 b7 07 eb 08  a0 b6 07 eb 03 a0 b5 07  |................|
00000140  32 e4 05 00 07 8b f0 ac  3c 00 74 fc bb 07 00 b4  |2.......<.t.....|
00000150  0e cd 10 eb f2 2b c9 e4  64 eb 00 24 02 e0 f8 24  |.....+..d..$...$|
00000160  02 c3 49 6e 76 61 6c 69  64 20 70 61 72 74 69 74  |..Invalid partit|
00000170  69 6f 6e 20 74 61 62 6c  65 00 45 72 72 6f 72 20  |ion table.Error |
00000180  6c 6f 61 64 69 6e 67 20  6f 70 65 72 61 74 69 6e  |loading operatin|
00000190  67 20 73 79 73 74 65 6d  00 4d 69 73 73 69 6e 67  |g system.Missing|
000001a0  20 6f 70 65 72 61 74 69  6e 67 20 73 79 73 74 65  | operating syste|
000001b0  6d 00 00 00 00 62 7a 99  71 14 11 19 00 00 00 00  |m....bz.q.......|
000001c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200

I don't like the mention of the "Invalid partition table. Error loading operating system. Missing operating system" 🙁

Best Answer

Here the current superblock of the APFS container (block0 of disk0s2) was overwritten with an MBR. This will prevent the boot loader (and diskutil/Disk Utility) to recognize the APFS container as such.

A normal superblock (different Mac & different container size though) looks like this:

APFS container superblock

No real reason could be found why the superblock was overwritten!

To fix this (via TeamViewer & external boot volume with Catalina installed) another (older) superblock of disk0s2 was used to overwrite the MBR data.

  1. Install HexFiend and search for the magic bytes of a superblock: NXSB on partition disk0s2. The first occurance was after the first ~3 GB of disk0s2. The metadata part of an APFS container usually houses various older superblocks. The current superblock usually is the copy of one "older" superblock if the Mac was shut down properly previously.

    Although thereʼs only one container, there are several copies of the container superblock (an instance of nx_super block_t) stored on disk. These copies hold the state of the container at past points in time. Block zero contains a copy of the container superblock thatʼs used as part of the mounting process to find the checkpoints. Block zero is typically a copy of the latest container superblock, assuming the device was properly unmounted and was last modified by a correct Apple File System implementation. However, in practice, you use the block zero copy only to find the checkpoints and use the latest version from the checkpoint for everything else. Source

    The size of a superblock appears to be 1382 Bytes. Since an MBR has a size of 512 Bytes, I expected that the latter 870 Bytes (1382-512) of the superblock haven't been overwritten and decided to copy only the first 512 Bytes of an older superblock to keep as much as possible of the leftovers of the original one.

  2. dd the 512 Bytes of this older superblock to a file on the desktop:

    sudo dd if=/dev/disk0s2 of=/Users/user_name/oldsuperblock.bin bs=1 count=512 skip=3063808000 #"3063808000" is just an example Byte offset because the zsh history file with the original command is lost

  3. dd the file to block0:

    sudo dd if=/Users/user_name/oldsuperblock.bin of=/dev/disk0s2 bs=512 count=1
  4. Reboot the Mac to the temporary boot volume to "reload" the APFS superblock of the internal APFS container

  5. Repair the APFS container (with encrypted volumes!):

    diskutil repairVolume disk1

    diskutil (or better fsck_apfs) complained about a wrong checksum of the superblock but fixed it without any trouble.

  6. Check if the encrypted Data Volume can be mounted with Disk Utility > Mount. To unlock the volume a password of a user of the "broken" disk has to be entered.
  7. Boot to the internal boot volume
  8. SUCCESS!

Conclusion:

I haven't been able to find any numbering scheme or time stamps for superblocks in the Apple APFS documentation or by comparing the various older versions of the superblock I have found.

It's unclear whether it was pure luck to fetch a working older superblock. No current backup was available so it's even more uncertain whether reinstating an old superblock leads to data loss. At least the Mac booted and the encrypted volumes could be unlocked.

Related Question