2

I am running macOS High Sierra on a 2011 iMac. I was also running Windows 10 via BootCamp. In order to prepare for a 3rd OS, I installed reFind and resized the BootCamp partition to make space.

Unfortunately, this rendered the Windows partition unable to boot, I got the message "Missing Operating System" on a black screen.

Instead of accepting my limitations and sticking with Mac OS, I decided to remove the BootCamp partition, and proceed with reinstalling Windows into the free space. Initially this didn't work in legacy mode, so I (foolishly) decided to use EFI instead. I have successfully reinstalled Windows but the Mac partition now doesn't show up on the "ALT" menu, reFind has disappeared and the machine now only boots into Windows.

If I boot Mac OS from a USB, the mac partition is not shown and it is shown as "Unallocated Space" when I use Aomei in Windows 10.

Unfortunately, there are important un-backed up family photos etc on the Mac partition. My bad!

I do not believe that the mac partition has been erased, Windows is on the correct BootCamp partition.

My question is how to get the Mac partition booting again if possible, or at least get the data off. I am not bothered about losing Windows as it is a fresh install.

Many thanks in advance for any advice. Obviously the best advice was to take more care and avoid this situation!

Here is the result of the requested information based on this Readout:

gpt -r show disk0
     start       size index contents             
         0          1       PMBR                 
         i          1       Pri GPT header       
         2         32       Pri GPT table        
        34          6                            
        40     409600     1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
    409640 2542739416                             
2543149056      32768     2 GPT part - E3C9E316-0B5C-ADB8-817D-F92DF00215AE 
2543181824  636884926     3 GPT part - EBD0A0A2-B9E5-4A33-87C0-68B6B72699C7 
3180066750  726962385                            
3907029135         32       Sec GPT table        
3907029167          1       Sec GPT header  
  • 1
    The best advice is to have a current (Time Machine) backup! Please add the output of gpt -r show disk0 (booted to Internet Recovery Mode (alt-cmd-R) or to macOS (USB) - depending on the kind of system on the USB - you have to prepend sudo ... and/or disable SIP) to your question. – klanomath Mar 21 '18 at 10:34
  • Thank you, I have added the readout to the bottom of my question. – Simon Baldwin Mar 21 '18 at 17:48
  • If you later want help installing macOS, Windows and Linux in a triple boot, let me know. I am currently using an 2011 iMac that is setup up for multi-boot using either the builtin Startup Manager of rEFInd. – David Anderson Mar 22 '18 at 9:33
  • @DavidAnderson I may well be asking for advice when I try to add the Linux partition... – Simon Baldwin Mar 25 '18 at 10:02
1

Your iMac contains a 2 TB non-4k disk (I suppose it's an HDD) and macOS High Sierra is (was) installed.

2542739416 blocks of your disk starting at block 409640 are not allocated to partitions.

Your lost partition(s) can be expected to be found & restored in the unallocated disk space.

The default Apple partition layout for an HDD is 1. EFI 2. main system and 3. Recovery HD (and 4. additional partitions created by the user e.g. Boot Camp). EFI and Recovery HD have a default size on 512-disks:

  • EFI: 409600 blocks(512)
  • Recovery HD: 1269536 blocks(512)

The eligible partition types for an HDD are either standard HFS+ or CoreStorage (usually if the main system volume was encrypted or the Mac contains a Fusion Drive). APFS is also possible but not recommended by Apple. Re-formatting an HDD to APFS would have been done by the user.

On an SSD the default partition type would be APFS with no recovery partition.


To detect the former partition type boot to Internet Recovery Mode:

  • Get the partition details (below I assume the internal disk has the device identifier disk0):

    diskutil list
    gpt -r show disk0
    
  • Unmount disk0 with diskutil umountDisk disk0
  • vis the first 3 blocks starting with block409640 of disk0:

    dd if=/dev/disk0 skip=409640 count=3 | vis -c
    

    If you had a standard partition previously the first 1024 Bytes only contain non-printable (zeros): \0\0\0\0\0\0... After ~Byte 1030 you will see the following sequence: \0HFSJ\0

    If you had a CoreStorage partition some non-zeros in the first 512 Bytes and the string CS (...\0CS\^A...) are shown:

    \^U\^D\^A\M-s\M^?\M^?\M^?\M^?\^A\0\^P\0\0\0\M-W\^A\a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\M^Pu\M-\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0CS\^A\0\0\0\^D\0\0\^P\0\0\0\0@\0X\M-7}\^C\0\0\0\0X\M-;}\^C\0\0\0\0X\M-?}\^C\0\0\0\0X\M-C}\^C\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\^P\0\0\0\^B\0\0\0006j v\^R\M-+\^U\M^[\f\M^CdG\M-y\^]...
    

    If you had a APFS partition the string NXSB (...\0NXSB\0\^P...) is shown in the first few bytes:

    ??[?\M^T\M^VD\^A\0\0\0\0\0\0\0\^X\f\0\0\0\0\0\0\^A\0\0\M^@\0\0\0\0NXSB\0\^P\0\0?7?\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\^B\0\0\0\0\0\0\0\^Q?^@1\^PL ?GSf~\M^KBչ?\0\0\0\0\0\0\^Y\f\0\0\0\0\0\0\^X\^A\0\0\^Xl\0\0\^A\0\0\0\0\0\0\0\^Y\^A\0\0\0\0\0\0!\0\0\0\M^@Z\0\0\^_\0\0\0\^B\0\0\0zZ\0\0\^F\0\0\0\0\^D\0\0\0\0\0\0007?\^C\0\0\0\0\0\^A\^D\0\0\0\0\0\0\0\0\0\0d\0\0\0\^B\^D\0\0\0\0\0\0\^F\^D\0\0\0\0\0\0\b\^D\0\0\0\0\0\0f?\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
    

If you have a second full-fledged macOS boot drive you can use hexdump instead:

  • Unmount disk0 with diskutil umountDisk disk0
  • hexdump the first 3 blocks starting with block409640 of disk0:

    sudo dd if=/dev/disk0 skip=409640 count=3 | hexdump
    

    The following result identfies it as a normal OS X partition:

    0000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 01 ff
    0000410 d3 8c 77 d3 d4 33 3c b0 00 00 00 00 d3 8c 5b b3
    0000420 00 00 02 a8 00 00 00 25 00 00 10 00 00 fe b7 f6
    0000430 00 fe 1e fa 00 ed 80 00 00 01 00 00 00 01 00 00
    0000440 00 00 10 f2 00 00 5a 9d 00 00 00 00 00 00 00 01
    0000450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000460 00 00 00 00 00 00 00 00 7d 9d b0 3a 02 31 62 f0
    0000470 00 00 00 00 00 1f e0 00 00 1f e0 00 00 00 01 fe
    0000480 00 00 00 01 00 00 01 fe 00 00 00 00 00 00 00 00
    0000490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    00004c0 00 00 00 00 00 60 00 00 00 60 00 00 00 00 06 00
    00004d0 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 00
    00004e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000510 00 00 00 00 03 10 00 00 03 10 00 00 00 00 31 00
    0000520 00 03 ac 00 00 00 31 00 00 00 00 00 00 00 00 00
    0000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000560 00 00 00 00 05 40 00 00 05 40 00 00 00 00 54 00
    0000570 00 00 10 00 00 00 54 00 00 00 00 00 00 00 00 00
    0000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000600
    

    The first number is the byte count in hex: 0000000: 0; 0000600: 1536. The * denotes identical lines. This means: the first two blocks (0x000-0x3ff) are all zeros.

    A CoreStorage partition shows some non-zeros in the first block (0x000-0x1ff):

    0000000 0c 73 a1 a9 ff ff ff ff 01 00 10 00 07 14 d7 01
    0000010 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000030 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000040 00 20 c1 cc 0f 00 00 00 00 00 00 00 00 00 00 00
    0000050 00 00 00 00 00 00 00 00 43 53 01 00 00 00 04 00
    0000060 00 10 00 00 00 00 40 00 11 bc fc 00 00 00 00 00
    0000070 11 c0 fc 00 00 00 00 00 11 c4 fc 00 00 00 00 00
    0000080 11 c8 fc 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00000a0 00 00 00 00 00 00 00 00 10 00 00 00 02 00 00 00
    00000b0 62 02 98 59 ee a9 ab 51 9b 49 23 90 2e f8 8b 43
    00000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000130 e4 6e f8 f2 63 99 45 c1 b2 13 86 28 a5 18 46 6d
    0000140 c4 51 c0 f6 32 f9 43 ab 8e 59 42 d2 1a ef f6 50
    0000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000400 48 2b 00 04 80 00 21 00 48 46 53 4a 00 00 01 ff
    0000410 d1 98 a4 93 d4 33 8b d5 00 00 00 00 d1 98 88 73
    0000420 00 06 07 53 00 01 82 39 00 00 10 00 00 fb 6a 00
    0000430 00 c5 1c 55 00 25 73 c7 00 01 00 00 00 01 00 00
    0000440 00 0d e2 65 00 3e a2 fb 00 00 00 00 02 20 00 fb
    0000450 00 00 00 31 00 06 b9 ef 00 00 00 00 00 00 00 00
    0000460 00 00 00 00 00 00 00 31 fb 48 1e a0 6c 47 a2 9f
    0000470 00 00 00 00 00 1f e0 00 00 1f e0 00 00 00 01 fe
    0000480 00 00 00 01 00 00 01 fe 00 00 00 00 00 00 00 00
    0000490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    00004c0 00 00 00 00 00 60 00 00 00 60 00 00 00 00 06 00
    00004d0 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 00
    00004e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000510 00 00 00 00 0e 40 00 00 01 30 00 00 00 00 e4 00
    0000520 00 00 10 00 00 00 e4 00 00 00 00 00 00 00 00 00
    0000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000560 00 00 00 00 11 d0 00 00 01 30 00 00 00 01 1d 00
    0000570 00 02 80 00 00 00 72 00 00 13 30 97 00 00 13 00
    0000580 00 15 c5 aa 00 00 13 00 00 18 2d 23 00 00 13 00
    0000590 00 19 d8 fb 00 00 13 00 00 1b 76 cb 00 00 13 00
    00005a0 00 1c 34 70 00 00 13 00 00 1d 0e 4d 00 00 13 00
    00005b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    0000600
    

    The line starting with byte 0x130 shows the UUID of the Physical Volume, the line starting with byte 0x140 shows the UUID of the Logical Volume Group.

    The string 48 46 53 4a (= "HFSJ") in the first 16 bytes of the third blocks identifies a Journaled HFS+ volume on both partition types.

    An APFS container looks like this:

    0000000 e7 ec ab 5b a2 94 96 44 01 00 00 00 00 00 00 00
    0000010 18 0c 00 00 00 00 00 00 01 00 00 80 00 00 00 00
    0000020 4e 58 53 42 00 10 00 00 f6 37 ff 00 00 00 00 00
    0000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000040 02 00 00 00 00 00 00 00 11 f1 5e 40 31 10 4c 20
    0000050 bb 47 53 66 7e 8b 42 d5 b9 c4 00 00 00 00 00 00
    0000060 19 0c 00 00 00 00 00 00 18 01 00 00 18 6c 00 00
    0000070 01 00 00 00 00 00 00 00 19 01 00 00 00 00 00 00
    0000080 21 00 00 00 80 5a 00 00 1f 00 00 00 02 00 00 00
    0000090 7a 5a 00 00 06 00 00 00 00 04 00 00 00 00 00 00
    00000a0 37 fd 03 00 00 00 00 00 01 04 00 00 00 00 00 00
    00000b0 00 00 00 00 64 00 00 00 02 04 00 00 00 00 00 00
    00000c0 06 04 00 00 00 00 00 00 08 04 00 00 00 00 00 00
    00000d0 66 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    00003d0 00 00 00 00 00 00 00 00 16 21 06 00 00 00 00 00
    00003e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    *
    00004f0 00 00 00 00 00 00 00 00 91 3d 0f 00 00 00 00 00
    0000500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0000510 78 f4 09 00 00 00 00 00 01 00 00 00 00 00 00 00
    0000520 01 00 04 00 08 00 00 00 00 00 00 00 00 00 00 00
    0000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    

    The string 4e 58 53 42 (= "NXSB") starting with byte 0x020 in the first block is the magic string of an APFS container superblock and identifies it as APFS container. The UUID of the container starts at 0x48 (here: 11 f1 5e 40 ...)


If you have found a standard partition (which usually is accompanied by a Recovery HD), you can add them with the following commands:

diskutil umountDisk disk0
gpt add -i 5 -b 2541879520 -s 1269536 -t 426F6F74-0000-11AA-AA11-00306543ECAC disk0
diskutil umountDisk disk0
gpt add -i 4 -b 409640 -s 2541469880 -t 48465300-0000-11AA-AA11-00306543ECAC disk0

If you have found a CoreStorage partition (which usually is accompanied by a Recovery HD), you can add them with the following commands:

diskutil umountDisk disk0
gpt add -i 5 -b 2541879520 -s 1269536 -t 426F6F74-0000-11AA-AA11-00306543ECAC disk0
diskutil umountDisk disk0
gpt add -i 4 -b 409640 -s 2541469880 -t 53746F72-6167-11AA-AA11-00306543ECAC disk0

If you have found an APFS partition (no Recovery HD - it's included in the APFS container!), you can add it with the following commands:

diskutil umountDisk disk0
gpt add -i 4 -b 409640 -s 2542739416 -t 7C3457EF-0000-11AA-AA11-00306543ECAC disk0

Booted to a normal system you have to prepend sudoto the gpt ... commands. Under certain circumstances you have to disable SIP.


Finally check the partitions/volumes:

diskutil verifyDisk disk0
diskutil verifyVolume disk0s2
diskutil verifyVolume disk0s3

Your previous partition layout may have contained a gap between the "former" Recovery HD and the Microsoft Reserved partition (size: 32768 blocks type: E3C9E316-0B5C-ADB8-817D-F92DF00215AE). Then the verifyVolume commands will fail and bigger guns have to be brought up. Don't try to repair or initialize anything if asked!


If you run into unexpected problems, add a comment!

  • I can confirm that the missing main Mac OS partition was from 409640 to 2542739416. The empty space from 3180066750 to 726962385 was space that I made to install Linux later. I did not reformat to APFS so it should still be HFS+. I'll have a go at this later, thank you so much! – Simon Baldwin Mar 22 '18 at 9:26
  • @SimonBaldwin As mentioned in the bigger guns link, similar methods to detect the end of an HFS+ partition exist - it requires some searching on the block level though. Additionally the size of an HFS+, CS or APFS partition is stored in the header block - but it's more complicated to get it. Example (APFS): apple.stackexchange.com/a/312964/93229 . If the method outlined above fails, I will add an explanation. – klanomath Mar 22 '18 at 9:40
  • I found a standard partition and followed the instructions for that section. On running diskutil verifyDisk disk0, I got the message "Problems were found with the partition map which might prevent booting Error -69846: Unrecognised file system". Both volume verify commands also led to errors. – Simon Baldwin Mar 23 '18 at 17:58
  • @SimonBaldwin Sometimes a hexdump of the first 3 blocks sudo dd if=/dev/disk0 skip=409640 count=3 | hexdump or sudo dd if=/dev/disk0 of=/Users/<username>/Desktop/3blocks.raw skip=409640 count=3 is sufficient. Either post the hexdump somewhere "as text" or send me the file: klanomath(at)googlemail.com – klanomath Mar 23 '18 at 18:10
  • Thank you, I have to go out now but will maybe do this on Sunday. When would be convenient?What time zone are you in? I can boot the computer into windows or I have a bootable Snow Leopard partition on an external drive. I guess I could also do the hexdump to an expternal drive and send it to you first. Thanks again! – Simon Baldwin Mar 23 '18 at 18:15
0

I think your only choice at this point is to try to recover data using Data Rescue. But it's going to be a big mess. This kind of data recovery doesn't give you nice neat clean photo libraries, you're going to get basically every possible file it can find all mixed together a few giant folders. I'd stop using the Mac right away. You may have reformatted your mac partition and install windows on top of that. If so, you'll still get SOME deleted data from it, but you'll get less and less every minute you run windows.

  • I can see that Windows is in the correct Bootcamp partition, the former mac partition is listed as "Unallocated Space" so at least it is not being used for the moment. – Simon Baldwin Mar 21 '18 at 11:42
  • Just to play it safe, if the missing data is truly important, I would not use the computer at all until you are finished running a deleted file recovery Data Rescue. It's also possible that you have a free space "partition" that is the same size as your old Mac partition, but it's not actually that partition. Meaning you still could possibly be overwriting your files by running Windows. I would not risk it. – l008com Mar 21 '18 at 12:07
0

I used @klanomath's solution to make the Mac partition bootable again and made a Time Machine backup. I then tried to repair the remaining errors using Disk Utility. As @klanomath warned, this made the disk unbootable again. I then wiped the hard drive and tried to restore from the Time Machine backup. After 7 hours, the restore failed so I re-installed High Sierra from Internet recovery then imported the information from Time Machine. This worked and I now need to (carefully) reinstall Windows 10 (via Bootcamp) and perhaps Ubuntu (if I am feeling brave and I have an up-to-date backup!)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .