Recover data from partition showing as FFFF

Question

How can I get back my data from the FFFF… partition which is ~350 GB by fixing the partition table?

   977105059           1                     Sec GPT header
Riccados—MacBook—Pro:~ Riccado$ sudo gpt —r show /dev/disk0s2
       start        size        index        contents
           0   683645536
Riccados—MacBook—Pro:~ Riccado$ sudo gpt —r show /day/disk0
       start        size        index        contents
           0           1                     PMBR
           1           1                     Pri GPT header
           2          32                     Pri GPT table
          34           6
          40      409600             1       GPT part — C12A7328—F81F-11D2-6A46-00A0C93EC938
      409640   683645536             2       GPT part — FFFFFFFF—FFFF—FFFF—FFFF—FFFFFFFFFFFF
   684055176     1269536             3       GPT part — 48465300-0000-11AA—AA11-00306543ECAC
   685324712    49224610             4       GPT part — OFC63DAF-8483-4772-8E79-3D69D8477DE4
   734549322         694
   734550016     8073216             5       GPT part — 0657FD6D—A4AB-43C4-84E5-0933C84B4F4F
   742623232   233212248             6       GPT part — 53746F72-6167-11AA—AA11-00306543ECAC
   975835480     1269544             7       GPT part — 426F6F74-0000-11AA—AA11-00306543ECAC
   977105024           3
   977105027          32                     Sec GPT table
   977105059           1                     Sec GPT header 
Riccados—MacBook—Pro:~ Riccado$ diskutil unmountDisk /dev/disk1
Unmount of disk1 failed: at least one volume could not be unmounted 
Riccados—MacBook—Pro:~ Riccado$

The disk is 500 GB in total. 350 GB is assigned for macOS, 120 GB for Windows and 30 GB for Ubuntu.

This morning when I woke up, I tried to boot my Mac but it didn't boot successfully as it is just showing the prohibitory sign. So I tried to fresh install macOS, pressing command ⌘-R when starting the Mac to enter Recovery Mode. But only the Windows partition (120 GB) is showing to reinstall macOS on instead of the original 350 GB partition. I reinstalled macOS on the 120 GB partition. Now I don't know how to retrieve my files back from the old 350 GB partition. They all are in same disk. Linux is not booting now too.

An example of how to install Ubuntu without disabling System Integrity Protection (SIP) and without using rEFInd can be found at: Installing Ubuntu on Mac with macOS and Windows already installed. In your case, the instructions will need modification if you are still using Core Storage. — David Anderson, Oct 24 '16 at 10:11

Community · Accepted Answer · 2017-04-13 12:45:23Z

The second partition of your internal disk got the wrong partition type, your data probably won't be lost.

A bootable OS X partition (except the Recovery HD) either has the GUID 48465300-0000-11AA-AA11-00306543ECAC for a standard OS X partition or the GUID 53746F72-6167-11AA-AA11-00306543ECAC for a CoreStorage partition. The FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF is an unknown partition type (but not no partition like the 000000-0000-0000.... one).

The first block of a standard OS X partition doesn't contain non-zeros, the first block of a CoreStorage partition contains some non-zeros. To get the first 3 blocks of a partition enter sudo dd if=/dev/diskXsY count=3 | hexdump.

The GUID can be modified with gpt. Modifying the GUID partition table with gpt requires to unmount the whole disk which can't be done if you boot to its Recovery HD or another boot volume on the same disk.

Boot to an independent OS X/macOS system providing hexdump. Here it was possible to boot to Internet Recovery because the disk contains a second OS X system (disk0s6) with hexdump. The (Internet) Recovery HD usually doesn't provide hexdump.
Open Terminal in the menubar Utilities > Terminal
Get an overview with diskutil list
Get an overview of your internal disk with the disk identifier found in the previous command. Below I assume the disk identifier of your internal disk is disk1 (replace it with the one you have found in your environment)
```
gpt -r show disk1
```
Unmount disk1 with diskutil umountDisk disk1 if booted to an external disk/thumb drive with a full OS X/macOS

hexdump the first 3 blocks of the FFFF... partition:

dd if=/dev/disk1s2 count=3 | hexdump

or (depending on your boot volume)

dd if=/dev/disk1s2 count=3 | /Volumes/2nd_SysVol_name/usr/bin/hexdump

The following result identifies it as a normal OS X partition:

0000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 01 ff
0000410 d3 8c 77 d3 d4 33 3c b0 00 00 00 00 d3 8c 5b b3
0000420 00 00 02 a8 00 00 00 25 00 00 10 00 00 fe b7 f6
0000430 00 fe 1e fa 00 ed 80 00 00 01 00 00 00 01 00 00
0000440 00 00 10 f2 00 00 5a 9d 00 00 00 00 00 00 00 01
0000450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000460 00 00 00 00 00 00 00 00 7d 9d b0 3a 02 31 62 f0
0000470 00 00 00 00 00 1f e0 00 00 1f e0 00 00 00 01 fe
0000480 00 00 00 01 00 00 01 fe 00 00 00 00 00 00 00 00
0000490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
00004c0 00 00 00 00 00 60 00 00 00 60 00 00 00 00 06 00
00004d0 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 00
00004e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000510 00 00 00 00 03 10 00 00 03 10 00 00 00 00 31 00
0000520 00 03 ac 00 00 00 31 00 00 00 00 00 00 00 00 00
0000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000560 00 00 00 00 05 40 00 00 05 40 00 00 00 00 54 00
0000570 00 00 10 00 00 00 54 00 00 00 00 00 00 00 00 00
0000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000600

The first number is the byte count in hex: 0000000: 0; 0000600: 1536. The * denotes identical lines. This means: the first two blocks (0x000-0x3ff) are all zeros.

A CoreStorage partition shows some non-zeros in the first block (0x000-0x1ff):

0000000 0c 73 a1 a9 ff ff ff ff 01 00 10 00 07 14 d7 01
0000010 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000030 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000040 00 20 c1 cc 0f 00 00 00 00 00 00 00 00 00 00 00
0000050 00 00 00 00 00 00 00 00 43 53 01 00 00 00 04 00
0000060 00 10 00 00 00 00 40 00 11 bc fc 00 00 00 00 00
0000070 11 c0 fc 00 00 00 00 00 11 c4 fc 00 00 00 00 00
0000080 11 c8 fc 00 00 00 00 00 00 00 00 00 00 00 00 00
0000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000a0 00 00 00 00 00 00 00 00 10 00 00 00 02 00 00 00
00000b0 62 02 98 59 ee a9 ab 51 9b 49 23 90 2e f8 8b 43
00000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000130 e4 6e f8 f2 63 99 45 c1 b2 13 86 28 a5 18 46 6d
0000140 c4 51 c0 f6 32 f9 43 ab 8e 59 42 d2 1a ef f6 50
0000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 01 ff
0000410 d1 98 a4 93 d4 33 8b d5 00 00 00 00 d1 98 88 73
0000420 00 06 07 53 00 01 82 39 00 00 10 00 00 fb 6a 00
0000430 00 c5 1c 55 00 25 73 c7 00 01 00 00 00 01 00 00
0000440 00 0d e2 65 00 3e a2 fb 00 00 00 00 02 20 00 fb
0000450 00 00 00 31 00 06 b9 ef 00 00 00 00 00 00 00 00
0000460 00 00 00 00 00 00 00 31 fb 48 1e a0 6c 47 a2 9f
0000470 00 00 00 00 00 1f e0 00 00 1f e0 00 00 00 01 fe
0000480 00 00 00 01 00 00 01 fe 00 00 00 00 00 00 00 00
0000490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
00004c0 00 00 00 00 00 60 00 00 00 60 00 00 00 00 06 00
00004d0 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 00
00004e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000510 00 00 00 00 0e 40 00 00 01 30 00 00 00 00 e4 00
0000520 00 00 10 00 00 00 e4 00 00 00 00 00 00 00 00 00
0000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000560 00 00 00 00 11 d0 00 00 01 30 00 00 00 01 1d 00
0000570 00 02 80 00 00 00 72 00 00 13 30 97 00 00 13 00
0000580 00 15 c5 aa 00 00 13 00 00 18 2d 23 00 00 13 00
0000590 00 19 d8 fb 00 00 13 00 00 1b 76 cb 00 00 13 00
00005a0 00 1c 34 70 00 00 13 00 00 1d 0e 4d 00 00 13 00
00005b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0000600

The line starting with byte 0x130 shows the UUID of the Physical Volume, the line starting with byte 0x140 shows the UUID of the Logical Volume Group.

The string 48 46 53 4a (= "HFSJ") in the first 16 bytes of the third blocks identifies a Journaled HFS+ volume.

First fix your Recovery partition:

diskutil umountDisk disk1
gpt remove -i 3 disk1
diskutil umountDisk disk1
gpt add -i 3 -b 684055176 -s 1269536 -t 426F6F74-0000-11AA-AA11-00306543ECAC disk1

Now remove the second partition:

diskutil umountDisk disk1
gpt remove -i 2 disk1
diskutil umountDisk disk1

re-add the partition with the proper type
either a normal OS X partition

gpt add -i 2 -b 409640 -s 683645536 -t 48465300-0000-11AA-AA11-00306543ECAC disk1

or (if you have found a CoreStorage partition)

gpt add -i 2 -b 409640 -s 683645536 -t 53746F72-6167-11AA-AA11-00306543ECAC disk1

Finally verify/repair the disk with diskutil verifyDisk disk1 and/or diskutil verifyVolume disk1s2. If a repair is needed use repair (instead of verify) as prefix in the above commands.

If you don't have an OS X/macOS volume with hexdump use this answer: How do I recover/fix my OS X partition?

grg · Accepted Answer · 2016-10-24 07:36:18Z

0

Open internet recovery mode using alt+command+R.
Go to Utilities → Terminal.
Check for overview of disk
```
gpt -r show /dev/disk0
```
Remove unnecessary partitions (for me I removed partitions 4, 5 and 6)
```
gpt remove -i 4 /dev/disk0 #removing partition 4 example
```
Since the 350 GB partition (partition 2) is the partition I wanted to correct as the main core partition I removed that partition first with
```
gpt remove -i 2 /dev/disk0
```
and then added it to the table again with
```
add -b STARTBLOCK -s NUMBERofBLOCK -i 2 -t 53746F72-6167-11AA-AA11-00306543ECAC
```

edited Oct 24 '16 at 7:36

grg♦

140k25222330

answered Oct 24 '16 at 5:13

Riccado

212

OK, but partition 3 still has the wrong GUID. – David Anderson Oct 24 '16 at 5:17
How can I fix that ? Partition 3 is Recovery HD. But now in my disk utility only my main 350 GB disk is showing. [may be because I removed the partitions 4,5,6 (around 150GB) ] . Do u have any idea how can I add the missing 150GB to my 350 GB so that I can get back my 500GB disk? – Riccado Oct 24 '16 at 5:24
Repair your gpt entry for the recovery hd, then verify the internal disk. Then try to resize the corestorage stack. After tantalizing a CS volume with linux/windows the resizeStack command often fails. – klanomath Oct 24 '16 at 5:34
I would assume that the "Recover HD" partition is now showing in the Finder application. This is not suppose happen. You can repeat the procedure you posted as an answer and change partition 3 to 426F6F74-0000-11AA-AA11-00306543ECAC. You should also check the attribute, but MacOS does not provide a command for this. – David Anderson Oct 24 '16 at 5:36
The question regarding the lost space has been asked many times here at Ask Different. The problem is these posted answers will not work until you fix the GUID for partition 3. The reason is that reclaiming the lost space requires relocating the Recover partition to the bottom of the disk and right now MacOS does not think you have a Recovery partition. – David Anderson Oct 24 '16 at 5:42

add a comment |

David Anderson · Accepted Answer · 2016-10-24 10:19:39Z

I can not tell if your second partition was a Core Storage partition or a regular HFS partition. I will assume the use of Core Storage.

I would recommend downloading the gdisk command. This command will allow you to view and modify partition attributes. MacOS does not have a command that can allow a user to do this.

Once downloaded, you can invoke the gdisk command to edit disk0 by entering as shown below.

sudo gdisk /dev/disk0

You will need to make the following changes.

The type for partition 2 should be 53746F72-6167-11AA-AA11-00306543ECAC. The gdisk command abbreviates this type by using the code AF05.
The type for partition 3 should be 426F6F74-0000-11AA-AA11-00306543ECAC. The gdisk command abbreviates this type by using the code AB00.
The attributes for partition 3 should be 0002000000000000. This means only bit 49 should be set.
The attributes for partition 7 should also be 0002000000000000. The attributes for all the other partitions should be 0000000000000000.

The command to change the type is t. The command to change the attributes is a, but first you have to enter expert mode by entering the command x. The w command can be used to write the changes back to the drive`.

Note: If you make a mistake, you can abort gdisk without making any changes by entering a controlC.

In the event partition 2 was not using core storage, the the GUID should be 48465300-0000-11AA-AA11-00306543ECAC. The gdisk command abbreviates this type by using the code AF00.

asked	2 years, 7 months ago
viewed	805 times
active	2 years, 4 months ago

Stack Exchange Network

current community

your communities

more stack exchange communities

Recover data from partition showing as FFFF

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged mac partition .

Linked

Hot Network Questions

Recover data from partition showing as FFFF

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged mac partition .

Linked

Related

Hot Network Questions