Recovering a confused partition table

bootcamppartition

So I've got a MacBook Pro which I use for work (and thus every file is precious information) and my BootCamp partition was getting a bit small, so I resized it with GParted, but not before resizing the OS X partition using diskutil.

However, after modifying the partitions, when I hold the option key at boot, I exclusively see the "Windows" partition, no Macintosh HD or Recovery HD.

I can see both of these drives from Windows, and all files are intact.

Is there anything I can do to repair this without

Requiring a backup drive (My backups are done to a NAS and thus cannot be booted)
Damaging any data on the device
Going to the Apple Store (Nearest one is a good few hours away)

Can I use the Internet Recovery system to get into a recovery environment?

Edit: I should mention I have a 64GB flash drive that I can use for anything, and the backups are exclusively of my "Documents/IdeaProjects" folder since that's the "important" work-related stuff. All of Windows and my personal files are not backed up (since the NAS is a work-owned system)

Further edit: I can no longer boot to Windows. I should mention that the value of th data on this drive is such that I am fully willing to pay a professional recovery company anything to recover it. How does that process work if I need to do it?

Best Answer

Alright, I fixed it. I installed a Live image to my flash drive and copied the TestDisk software to it. My live image was Windows 10 To Go, but I believe any OS could handle it.

Then, I ran a scan using TestDisk, and re-enabled the "deleted" partitions. After doing this, I wrote the new GPT to disk, and rebooted. Held the option key, and the partitions showed back up.

I essentially followed this guide, but since my partitions weren't actually in the partition table, it showed them as 'deleted' - setting them back to 'primary' and writing it fixed it.

Moral of the story - Don't mess with any partitions on a Mac from anything else than software in OS X or you may trash your partition table.

Related Solutions

Repair Mac Partitions – How to Repair Mac Partitions Without Internet Recovery and Rescue USB

There is not much you can do with a stock Mac to fix the hard drive.

You could plug the hard drive in another Mac (as a secondary drive, not a boot one) and see what Disk Utility tells you (press command-space then type Disk Utility to launch it) about it but it's not guaranteed to help you much. I am not even sure it can correctly repair a boot hard drive.

Your best bet is using a disk repair program such as DiskWarrior (http://www.alsoft.com/diskwarrior/).

It costs a bit but has a very good reputation and saved many damaged hard drives. Cf http://daringfireball.net/2010/03/ode_to_diskwarrior_superduper_dropbox for a great example of it saving important data.

Fix Corrupted macOS Partition After GParted

GParted didn't really create unallocated disk space. Instead the MBR got bogus. The CoreStorage LVG and all subsequent containers got corrupted also, because the whole stack wasn't resized as required. Usually - in macOS - the whole stack is resized with the command diskutil cs resizeStack .... As far as I can say from remote, the ending boundary of the second partition was simply moved to lower block numbers which usually works with normal HFS+ volumes in GParted but not in this case with a CoreStorage stack. Fortunately some invisible data structures of the CS stack weren't overwritten.

Additionally the recovery partition wasn't moved properly. But this a different problem.

Instead of the MBR you should have a pMBR. After removing the bogus MBR you have to destroy and recreate the GUID partition table:

Boot to Internet Recovery Mode
Open Terminal in the menubar Utilities -> Terminal
Get an overview (especially the gpt command is important!):
```
diskutil list
gpt -r show disk0
```
Unmount disk0:
```
diskutil umountDisk /dev/disk0
```

Delete the MBR:

dd if=/dev/zero of=/dev/disk0 bs=512 count=1

Destroy the GUID partition table and create a new one (this also creates a fresh pMBR):
```
gpt destroy disk0
gpt create -f disk0
```

Rebuild all previous GUID partitions:

gpt add -i 1 -b 40 -s 409600 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B disk0
gpt add -i 3 -b 488965176 -s 1269536 -t 426F6F74-0000-11AA-AA11-00306543ECAC disk0
gpt add -i 2 -b 409640 -s 409602008 -t 53746F72-6167-11AA-AA11-00306543ECAC disk0

If you get a resource busy error after one of the steps, just unmount disk0 again with

diskutil umountDisk /dev/disk0

Check the disk with diskutil verifyDisk disk0 afterwards.

Enter diskutil cs list and check if all four CoreStorage containers appear: a Logical Volume Group, a Physical Volume and Logical Volume Family and a Logical Volume.

With the UUID of the Logical Volume mount the LV:

Example:

    +-> Logical Volume 9A7B21AA-F9FE-4E65-8C7E-ED2A73744C15
        ---------------------------------------------------
        Disk:                  disk17
        Status:                Online

Then use:

diskutil mount 9A7B21AA-F9FE-4E65-8C7E-ED2A73744C15

Then after getting the disk identifier of the mounted LV with diskutil list verify the volume:

diskutil verifyVolume disk17 # probably it's disk17, disk16 or disk18

Below I assume the disk identifier is disk17

If the Logical Volume Family and the Logical Volume don't appear try the following:

Boot to Internet Recovery Mode
Open Terminal in the menubar Utilities -> Terminal
Get an overview (especially the gpt command is important!):
```
diskutil list
gpt -r show disk0
```
Unmount disk0:
```
diskutil umountDisk /dev/disk0
```
Remove the current partition entry for the second partition:
```
gpt remove -i 2 disk0
```

Add a new "expanded" second partition entry:

gpt add -i 2 -b 409640 -s 488555536 -t 53746F72-6167-11AA-AA11-00306543ECAC disk0

Then repeat all verify steps:

Check the disk with diskutil verifyDisk disk0 afterwards.

Enter diskutil cs list and check if all four CoreStorage containers appear: a Logical Volume Group, a Physical Volume and Logical Volume Family and a Logical Volume.

With the UUID of the Logical Volume mount the LV:

Example:
```
    +-> Logical Volume 9A7B21AA-F9FE-4E65-8C7E-ED2A73744C15
        ---------------------------------------------------
        Disk:                  disk17
        Status:                Online
```
Then use:
```
diskutil mount 9A7B21AA-F9FE-4E65-8C7E-ED2A73744C15
```
Then after getting the disk identifier of the mounted LV with diskutil list verify the volume:
```
diskutil verifyVolume disk17 # probably it's disk16, disk17 or disk18
```
If you get errors backup the data or the whole partition to an external volume then repair the volume with diskutil repairVolume disk17.

One possibility to backup the data is dd. Attach a HFS+ formatted drive with at least 250 GB free space. Get the path to the external volume with ls /Volumes. Then unmount disk17 and disk0 with diskutil umountDisk disk17 and diskutil umountDisk disk0.

Then clone the partition to a file:
```
dd if=/dev/disk0s2 of=/Volumes/ExternalDriveName/disk0s2.rawdevice bs=4m
```
If the volume name contains spaces, escape the spaces with backslashes: ...of=/Volumes/ExternalDriveName\ With\ Spaces/disk0s2.rawdevice....

You can also use asr to restore the partition to another disk (as a temporary "backup"). Check man asr.

Best Answer

Related Solutions

Repair Mac Partitions – How to Repair Mac Partitions Without Internet Recovery and Rescue USB

Fix Corrupted macOS Partition After GParted

Related Question