I am running macOS High Sierra on a 2011 iMac. I was also running Windows 10 via BootCamp. In order to prepare for a 3rd OS, I installed reFind and resized the BootCamp partition to make space.
Unfortunately, this rendered the Windows partition unable to boot, I got the message "Missing Operating System" on a black screen.
Instead of accepting my limitations and sticking with Mac OS, I decided to remove the BootCamp partition, and proceed with reinstalling Windows into the free space. Initially this didn't work in legacy mode, so I (foolishly) decided to use EFI instead. I have successfully reinstalled Windows but the Mac partition now doesn't show up on the "ALT" menu, reFind has disappeared and the machine now only boots into Windows.
If I boot Mac OS from a USB, the mac partition is not shown and it is shown as "Unallocated Space" when I use Aomei in Windows 10.
Unfortunately, there are important un-backed up family photos etc on the Mac partition. My bad!
I do not believe that the mac partition has been erased, Windows is on the correct BootCamp partition.
My question is how to get the Mac partition booting again if possible, or at least get the data off. I am not bothered about losing Windows as it is a fresh install.
Many thanks in advance for any advice. Obviously the best advice was to take more care and avoid this situation!
Here is the result of the requested information based on this Readout:
gpt -r show disk0
start size index contents
0 1 PMBR
i 1 Pri GPT header
2 32 Pri GPT table
34 6
40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
409640 2542739416
2543149056 32768 2 GPT part - E3C9E316-0B5C-ADB8-817D-F92DF00215AE
2543181824 636884926 3 GPT part - EBD0A0A2-B9E5-4A33-87C0-68B6B72699C7
3180066750 726962385
3907029135 32 Sec GPT table
3907029167 1 Sec GPT header
Best Answer
Your iMac contains a 2 TB non-4k disk (I suppose it's an HDD) and macOS High Sierra is (was) installed.
2542739416 blocks of your disk starting at block 409640 are not allocated to partitions.
Your lost partition(s) can be expected to be found & restored in the unallocated disk space.
The default Apple partition layout for an HDD is 1. EFI 2. main system and 3. Recovery HD (and 4. additional partitions created by the user e.g. Boot Camp). EFI and Recovery HD have a default size on 512-disks:
The eligible partition types for an HDD are either standard HFS+ or CoreStorage (usually if the main system volume was encrypted or the Mac contains a Fusion Drive). APFS is also possible but not recommended by Apple. Re-formatting an HDD to APFS would have been done by the user.
On an SSD the default partition type would be APFS with no recovery partition.
To detect the former partition type boot to Internet Recovery Mode:
Get the partition details (below I assume the internal disk has the device identifier disk0):
diskutil umountDisk disk0
vis the first 3 blocks starting with block409640 of disk0:
If you had a standard partition previously the first 1024 Bytes only contain non-printable (zeros):
\0\0\0\0\0\0...
After ~Byte 1030 you will see the following sequence: \0HFSJ\0If you had a CoreStorage partition some non-zeros in the first 512 Bytes and the string CS (
...\0CS\^A...
) are shown:If you had a APFS partition the string NXSB (
...\0NXSB\0\^P...
) is shown in the first few bytes:If you have a second full-fledged macOS boot drive you can use hexdump instead:
diskutil umountDisk disk0
hexdump the first 3 blocks starting with block409640 of disk0:
The following result identfies it as a normal OS X partition:
The first number is the byte count in hex: 0000000: 0; 0000600: 1536. The * denotes identical lines. This means: the first two blocks (0x000-0x3ff) are all zeros.
A CoreStorage partition shows some non-zeros in the first block (0x000-0x1ff):
The line starting with byte 0x130 shows the UUID of the Physical Volume, the line starting with byte 0x140 shows the UUID of the Logical Volume Group.
The string 48 46 53 4a (= "HFSJ") in the first 16 bytes of the third blocks identifies a Journaled HFS+ volume on both partition types.
An APFS container looks like this:
The string 4e 58 53 42 (= "NXSB") starting with byte 0x020 in the first block is the magic string of an APFS container superblock and identifies it as APFS container. The UUID of the container starts at 0x48 (here: 11 f1 5e 40 ...)
If you have found a standard partition (which usually is accompanied by a Recovery HD), you can add them with the following commands:
If you have found a CoreStorage partition (which usually is accompanied by a Recovery HD), you can add them with the following commands:
If you have found an APFS partition (no Recovery HD - it's included in the APFS container!), you can add it with the following commands:
Booted to a normal system you have to prepend
sudo
to thegpt ...
commands. Under certain circumstances you have to disable SIP.Finally check the partitions/volumes:
Your previous partition layout may have contained a gap between the "former" Recovery HD and the Microsoft Reserved partition (size: 32768 blocks type: E3C9E316-0B5C-ADB8-817D-F92DF00215AE). Then the verifyVolume commands will fail and bigger guns have to be brought up. Don't try to repair or initialize anything if asked!
If you run into unexpected problems, add a comment!