2

I think I severely ruined my partition table.

I had a BOOTCAMP partition, a macOS APFS partition, and an exFAT partition. I believe I also had 17GB of unallocated space.

I tried to shrink the BOOTCAMP partition, and I think that ruined the partition table. The BOOTCAMP partition errored on startup, and the macOS partition wasn't detected. From Internet Recovery, I reinstalled El Capitan from a USB drive onto another partition, while deleting the BOOTCAMP partition(I had a fairly recent backup). I'm currently using that, updated to High Sierra. It still does not see the older macOS partition, or the ~50GB of unallocated space(although I feel like most of that might be the missing macOS partition).

Furthermore, the Windows entry still shows when pressing alt/option on boot, although it errors like before. It doesn't show in startup disk or anywhere else.

I assume my BOOTCAMP partition is unrecoverable, which I'm mostly fine with. However, if possible, how can I recover my older macOS partition?

And mainly, how do I simply fix the partition table? Esp. the supposed Windows/BOOTCAMP partition that is there(although I'm sure it isn't) and the missing ~50GB

This is what Disk Utility says I have right now. Extra and Common are just empty partitions for now.

https://ibb.co/khN7pc

Below is the output from the command sudo gpt -r show disk0.

https://image.ibb.co/cyYxpc/Screen_Shot_2018_03_14_at_8_51_09_AM_1.png

  • Almost any question related to partition tables requires to add the partition table to the question: in Terminal.app enter sudo gpt -r show disk0 and (if BOOTCAMP is involved) sudo fdisk /dev/disk0 and add the output to your question. Under certain circumstances (booted to High Sierra) SIP has to be disabled to get a result! – klanomath Mar 13 '18 at 16:45
  • Unfortunately, the Windows partition tools only work properly when booted to either recovery mode or the installation media. The sequence of events you posted confuses me. You state you had a APFS partition when you reinstalled El Capitan, but APFS was not released until High Sierra. Next, you state you updated to High Sierra. So did you have an APFS partition when your tried to shrink the BOOTCAMP partition? – David Anderson Mar 13 '18 at 20:41
  • @DavidAnderson I installed El Capitan from a USB that already had it, to quickly have a usable computer. Yes, I had an APFS partition when I tried to shrink my BOOTCAMP partition. – PiAhoy Mar 14 '18 at 3:30
  • @klanomath I didn't have to disable SIP to get an output, but this is what I got ibb.co/ncFA9c – PiAhoy Mar 14 '18 at 3:33
3

The partition table of disk0 is not ruined at all - all changes made are rather unintended.

All partitions and volumes (EFI, Common, macOS and Extra) are properly marked and a diskutil verifyVolume disk0sYwill probably exit with no error.

A ruined partition table would miss the secondary partition header and table, or the primary and secondary header/table are different, or the CRC-32 checksums of the header and partition table entries are invalid.


Your partition table looks like this:

    start      size index contents                                        
        0         1       PMBR                                            
        1         1       Pri GPT header                                  
        2        32       Pri GPT table                                   
       34         6                                                       
       40    409600     1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B 
   409640  91672536                                                       
 92082176 168686104     2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC 
260768280    262144                                                       
261030424 177477424     3 GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC 
438507848  51464720     4 GPT part - 48465300-0000-11AA-AA11-00306543ECAC 
489972568    262151                                                       
490234719        32       Sec GPT table                                   
490234751         1       Sec GPT header  

The first partition with a size of 209.7 MB - the standard EFI partition - is followed by unallocated disk space with a size of 46.94 GB.

The second partition is a standard HFS+ partition with a size of 86.37 GB followed by unallocated disk space with a (standard) size of 134.2 MB.

The third is a APFS container partition with a size of 90.87 GB. The fourth partition is another standard HFS+ partition with a size of 26.35 GB.


A default SSD partition layout would probably look like this after installing High Sierra (APFS) and a BOOTCAMP partition though:

     start      size index contents                                        
         0         1       PMBR                                            
         1         1       Pri GPT header                                  
         2        32       Pri GPT table                                   
        34         6                                                       
        40    409600     1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B 
    409640         X     2 GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC 
  X+409640    262144      
  X+671784         Y     3 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
X+Y+671784       ...     ...  

The second unallocated disk space (262144 blocks) may be smaller or larger.

Consequently it depends on the size of your old macOS partition if parts of it were overwritten or not.

  • If X was equal to or smaller than 91672536 (blocks) your old macOS partition can be recovered completely.
  • If X was larger than 91672536 (blocks) and smaller than 260358640 (=91672536+168686104) (blocks) parts of your old macOS container partition were overwritten by creating the Common volume. Creating a new empty volume usually requires about 120 MB - 500 MB to write some file system metadata. Depending on the size of the APFS system/preboot/recovery volume parts of them may have been overwritten.

If the first block of your vanished APFS container (including your old macOS APFS system volume) wasn't overwritten you can detect its former size:

  • Boot to an external drive with macOS installed
  • Open Terminal and get the usual disk related details (below I assume the internal SSD has the disk identifier disk0):

    diskutil list
    sudo gpt -r show disk0
    
  • Unmount the SSD

    diskutil umountDisk disk0
    
  • dd/hexdump block 409640:

    sudo dd if=/dev/disk0 bs=512 skip=409640 count=1 | hexdump
    

    which will yield something like this (example only!):

    1+0 records in
    1+0 records out
    512 bytes transferred in 0.001917 secs (267067 bytes/sec)
    0000000 b9 e9 ff cb a4 6d fc f3 01 00 00 00 00 00 00 00
    0000010 fc da 09 00 00 00 00 00 01 00 00 80 00 00 00 00
    0000020 4e 58 53 42 00 10 00 00 29 ea 22 01 00 00 00 00
    0000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000040 02 00 00 00 00 00 00 00 d8 36 06 fb 2f 1f 42 7a
    0000050 b2 90 f5 cc 5c 85 9f 36 13 6f 08 00 00 00 00 00
    0000060 fd da 09 00 00 00 00 00 18 01 00 00 18 6c 00 00
    0000070 21 3c 06 00 00 00 00 00 28 c9 05 00 00 00 00 00
    0000080 70 00 00 00 18 0f 00 00 6e 00 00 00 02 00 00 00
    0000090 bc 0e 00 00 5c 00 00 00 af 6b 00 00 00 00 00 00
    00000a0 69 ad 04 00 00 00 00 00 01 04 00 00 00 00 00 00
    00000b0 00 00 00 00 64 00 00 00 03 04 00 00 00 00 00 00
    00000c0 a4 6b 00 00 00 00 00 00 a6 6b 00 00 00 00 00 00
    00000d0 a6 0d 01 00 00 00 00 00 00 00 00 00 00 00 00 00
    00000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000200
    

    the third line is the important one:

    ...
    0000020 4e 58 53 42 00 10 00 00 29 ea 22 01 00 00 00 00
    ...
    
    • 4e 58 53 42: magic string of an APFS container
    • 00 10 00 00: APFS block size: 4096
    • 29 ea 22 01 00 00 00 00 APFS container size in APFS blocks: 19065385 (=152523080 512-blocks)

      After re-arranging the Bytes 29 ea 22 01 00 00 00 00 > 00 00 00 00 29 ea 22 01 > 00 00 00 00 01 22 ea 29, you can get the decimal value here:

      enter image description here

    The size of the old APFS container in 512(blocks) is then APFS block size x container size in APFS blocks. In the example this is 4096/512 * 19065385 = 152523080 blocks.

  • depending of the former size remove the 2th partition:

    diskutil umountDisk disk0
    sudo gpt remove -i 2 /dev/disk0
    
  • restore the old partition (here with the size of the example: 152523080 blocks(512) - don't use this one accidentally!):

    diskutil umountDisk disk0
    sudo gpt add -i 2 -b 409640 -s 152523080 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0
    
  • check the APFS container

    diskutil verifyVolume disk0s2
    
  • check the APFS system volume

    diskutil list #get the device identifier of the APFS system volume and use it below (probably disk2s2)
    diskutil verifyVolume diskXsY
    

If you have problems analyzing the hexdump or other results and error messages please leave a comment!

  • Finally trying this, will recovery terminal work or will I have to actually install macOS on another drive? – PiAhoy Apr 14 '18 at 10:38
  • And I believe the 46.94GB might be the old macOS partition, but I'm not sure – PiAhoy Apr 14 '18 at 10:39
  • Also, even though I deleted the Windows partition, it still shows up(and errors) when pressing option/alt on boot – PiAhoy Apr 14 '18 at 10:57
  • I've gotten until here so far, not sure how to convert this: image.ibb.co/btJZqd/Screen_Shot_2018_05_12_at_11_15_41_PM.png – PiAhoy May 12 '18 at 17:52
  • X was = 262144 and I did have exactly 91672536 – PiAhoy May 13 '18 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .