I have a mid-2012 Macbook pro 13" Model No. A1278 (EMC 2554*). I'm running MacOS Sierra 10.12 and Windows 10 Build 10240 on 750GB disk.
Without doing proper research, I stupidly used Disk Utility to add a new 139GB partition to the same disk that had MacOS and Bootcamp and made the filesystem as ExFat because I wanted both my MacOS and Windows to be able to read and write to it.
Lo and behold, Boot Camp was no longer functioning. Whilst MacOS still boots, the Boot Camp partition now no longer showed up in the Startup boot option menu, though it did in the Disk Utlility and on the MacOS desktop. Attempting to boot straight off of bootcamp showed the following message:
No bootable device — insert boot disk and press any key
So I followed this tutorial:
http://nerdr.com/bootcamp-partition-lost-repairing-mac-partitions/
I already know I may have made a mistake because I was using that tutorial and an answer from other forum posts (https://discussions.apple.com/message/19071422#19071422 & I can no longer boot into macOS after resizing my bootcamp partition). The nerdr tutorial in the link above says to use gptfdisk and I was using the terminal app gdisk based on the answer in the forum.
After following the Nerdr procedure exactly using gdisk, however, it had all the same menu options so I didn't know if there is a difference. After I was done, Bootcamp was completely erased. Now here's what gdisk shows as my new partition table:
Command (? for help): p
Disk /dev/disk0: 1465149168 sectors, 698.6 GiB
Sector size (logical): 512 bytes
Disk identifier (GUID): DC08A243-0BDF-4D84-870F-044744CBFD1A
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 1465149134
Partitions will be aligned on 8-sector boundaries
Total free space is 70891845 sectors (33.8 GiB)
Number Start (sector) End (sector) Size Code Name
1 40 409639 200.0 MiB EF00 EFI System Partition
2 409640 1100019007 524.3 GiB AF00
3 1100019008 1101288543 619.9 MiB AB00
4 1101288544 1392987759 139.1 GiB 0700
5 1392987760 1394257295 619.9 MiB AB00 Recovery HD
These terminal outputs might also help:
diskutil list:
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *750.2 GB disk0
1: EFI EFI 209.7 MB disk0s1
2: Apple_HFS 750GB HD 563.0 GB disk0s2
3: Apple_Boot Recovery HD 650.0 MB disk0s3
4: Microsoft Basic Data TD 149.4 GB disk0s4
5: Apple_Boot 650.0 MB disk0s5
diskutil cs list:
No CoreStorage logical volume groups found
I think the data is still probably there, it is now just missing on the partition table. As you can see, the Recovery HD disk ends on sector 1394257295 and the last available sector is 1465149134. It says there is 33.8gb of free space, and the Windows bootcamp partition was around 39gb if I remember correctly.
I don't have anything backed up or have time machine running.
I thought restoring the partition I made back to the original partition may fix. I was not able to restore the ExFat partition back to the 750GB hard drive. I get message "Restore Process Has Failed" and the following list of commands:
Validating target…
Validating source…
Repartitioning target device…
Source volume is read-write and cannot be unmounted, so it can't be block copied.
Operation failed…
I get the above message over and over, even after unmounting it, reformatting the file system as MacOS journaled, and so on. Lastly I don't know if bootcamp was booting using MBR or GPT, but the disk did have a windows folder on it if that helps.
How do I recover my lost NTFS partition?
Edit: Output for David Anderson
There is no output for "dd if=/dev/disk0 bs=512 skip=1394257296 count=50000000 | fgrep -o -a -b "BOOTMGR is compressed":
Best Answer
If you need a better explanation of any step given below, please post a comment.
The answer given below assumes a sector size of 512 bytes. For larger sector sizes, you will need to make the appropriate adjustments. Below are the basic steps needed to find and restore a lost Windows Boot Camp partition. None of the steps require the use of third party software.
If applicable, disable System Integrity Protection (SIP). You need to do this to get access to
/dev/disk0. In other words, you need to be able to read the data stored on the disk you are booted from.The command to disable SIP is given below. You will need to boot to one of several macOS recovery modes or an external Mac startup disk, before executing the command from the Terminal application.
Actually, SIP does not need to be totally disabled. The following undocumented version of the
csrutilcommand can be used to at least disable the filesystem protections of SIP.After partially or completely disabling SIP, boot back to macOS (OS X).
Launch the Terminal application and enter the command given below.
This allows you to read (but not write) from
/dev/disk0without preceding your commands withsudo.Next, you need to determine which sectors may contain your missing NTFS partition. This can be accomplished by entering the command given below.
Below is the output from my computer. Since my computer has Fedora (linux) and rEFInd installed, the output below will differ from what would be typical. However, the Windows NTFS volume still resides in partition 4, as expected for a 2011 iMac.
In your case, you can substitute your output from
gdisk. What you need to look for is any large amounts free space. Your output shows free space starting at sector1394257296and ending a sector1465149134. This is70891839sectors which is about 36 GB of free space.You are now ready to start searching for the missing NTFS partition. To hex dump the first sector of my Windows NTFS Boot Camp partition, I entered the command given below.
Below is the output from the above command.
A description of the above output can be found at either Microsoft: NTFS Physical Structure or Wikipedia: NTFS Internals.
Imbedded in this sector are several strings. To find your NTFS partition, you will need to search for one of these strings. I will randomly choose the string
BOOTMGR is compressed. Since I know where my NTFS partition is, I can enter the command below to search for this string.The largest
countvalue my computer will allow is about50000000. This value may be different for your computer. So, if I wanted to search my entire NTFS partition, I would have to enter this command 4 times. Each time with askipvalue increased by50000000. Of course, one could write a shell script with a loop to repeat these commands, but I feel adding such a script here would be beyond the scope of this answer.The output, from entering the above command on my computer, is given below.
As expected, the the string was found inside the first sector searched. The rest of the matches can be ignored.
If your case, you would enter the command given below, where I assume a
countvalue of50000000would be valid.If this command does not return a match, you can assume your NTFS partition is not completely intact.
Verify a match resides in a valid Partition Boot Sector. Any given match value can be converted to a Partition Boot Sector starting value by first dividing the match value by the
bsvalue. Any remainder can be discarded. Next, add theskipvalue to the result. This is computed below for my first match value of425.Next, enter a command to hex dump the computed sector. For my computer, the command and output is shown in step 4. For the
-soption, you will need to substitute your starting sector value. Do not forget to append the letterbto your value.Minimally, the sector should start with the hex sequence
eb 52 90 4e 54 46 53 20 20 20 20 00and end with the hex sequence55 aa. Other values, to check for, can be found in the references given in step 4.Determine the NTFS partition start and size values. The partition start value is the same as Partition Boot Sector starting value. To determine the size, you will need to acquire the 8 hexadecimal byte values, stored in the Partition Boot Sector, starting at the 41st value. For my Partition Boot Sector shown in step 4, these values are shown below.
Next, you will need to convert from little endian to big endian by reversing the order of the bytes, as shown below.
Convert these values to single hexadecimal value by removing the spaces and preceding zeros, then adding
0xthe beginning of the result. Do so, for the above values, results in the single value shown below.Determine the decimal equivalent by using the command shown below.
Finally, round up this value to the nearest integer divisible by 8. In this case,
193097311is not divisible by 8. Therefore, this value needs to be rounded up to a value of193097312.Add the found partition to the GUID partition table (GPT). If this partition did not already exist in my computer, I could add it by entering the command shown below. In your case, you would use index option
-i 6in place of-i 4. Also, your beginning sector-band size-soption values would be different.My computer is running macOS 10.13.1. This command may not execute, if running OS X or an earlier version of macOS. If so, you will need to first start up from macOS Recovery over the Internet or an external Mac startup disk, then execute the alternative command given below from the Terminal application. Again, your
-i,-band-soption values would be different from what is shown below.Another alternative would be to use
gdiskto add the partition to the GPT.If necessary, enable SIP. This requires the same procedure as step 1, except the command to enable SIP is shown below.