APFS partition inaccessible, container missing

Question

I'm running macOS Mojave on a late-2015 4k 21.5" iMac.

I have lost access to my internal hard drive, but I can use my iMac by running macOS from an external drive or through recovery mode.

When I hold down the option key on boot, the only available drive shown is my external one. Last time I tried booting without holding option, I was greeted by the folder icon with the question mark in it.

I have not deleted my data, not even accidentally, it is all still there and I can see it using iBoysoft APFS data recovery.

This problem started when I tried to install Ubuntu on a partition using this guide https://www.maketecheasier.com/install-dual-boot-ubuntu-mac/ (I tried to follow all the steps carefully, but I may have made a mistake) and afterwards in Disk Utility my drive was called FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF. My Mac was still running fine, but when I restarted it, it would no longer boot into macOS. I searched the internet for this problem and any solutions and I found a few. I went through these guides and did as they said, and I'm pretty confident I changed the numbers for sizes etc. correctly for my own situation, but even after following these guides I still cannot boot into macOS on my internal HD.

My HD is 1TB, my mac partition is 960GB, my Ubuntu one was 40GB but I deleted that and installed macOS Sierra on it, but that disappeared at some point too.

I managed to get my Mac to recognise that the data is in APFS format and that it's actually there, it just wont interact with it outside of terminal.

My APFS partition doesn't seem to have a container, as far as I understand APFS (not very far), it needs a container. I did not delete the container but I think it has been lost. Maybe it need to be rebuilt or the APFS partition needs to be put in one somehow, but I don't know how to do either of those things.

Another note is that the partition was 960GB but now shows as 883GB - I don't know what this means, that may have been the amount of data on the partition, but that seems maybe a little high.

I'm not nearly good enough with macOS or terminal to be messing around with it without help and I probably shouldn't have tried to install Ubuntu on my main hard drive without a recent backup, but I could really do with some help and I'd appreciate it a lot.

here are the results of some terminal commands, they will be more reliable than my guesses and explanations:

diskutil list

(disk0 is my internal HD, disk1 & disk2 are just the external USB drive I installed macOS on so that I can still use my iMac)

sudo gpt -r show disk0

sudo dd if=/dev/disk0 bs=512 count=1 skip=409640 | hexdump -Cv

sudo dd if=/dev/disk0 bs=512 count=1 skip=228482040 | hexdump -Cv

Edit 20/10 22:30: After trying to mount or repair the volumes of disk0 in any way I could on my USB drive macOS install, I gave booting into recovery mode another try. I tried repairing in Disk Utility, but it told me I needed to do that in recovery mode (I was in recovery mode) and told me to press continue and nothing happened, so I used diskutil repairvolume in the recovery terminal and it said something about how I couldn't because my APFS volume doesn't have a container (other diskutil commands told me that it wasn't an APFS volume or didn't even use APFS, so I think its lack of container was giving my computer a hard time). I looked around some more, searching the error messages I got, and came up pretty empty (it doesn't help that APFS is relatively new and so is Mojave). So now I'm currently running some APFS data recovery software (Disk Drill) so I can do a fresh install of macOS on my iMac internal HD and just import my recovered old data onto it. Before I wipe my internal HD I'll try fixing it in single user mode with '/sbin/fsck -fy', but I'm not hopeful. This will presumably take at least a day though, and may not work out as planned, so if anyone can provide me with a way of creating an APFS container and putting my APFS volume into it so that my system can read it, that would be great. If you need the results of terminal used in recovery mode, I can do that, but unless there's a way of capturing screenshots in recovery mode, they'll be photos of a screen.

Current 'diskutil list disk0' and 'sudo gpt -r show disk0' results

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                 Apple_Boot                         650.0 MB   disk0s2
   3:                 Apple_APFS                         883.2 GB   disk0s3


       start        size  index  contents
           0           1         PMBR
           1           1         Pri GPT header
           2          32         Pri GPT table
          34           6         
          40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
      409640   226802864         
   227212504     1269536      2  GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
   228482040  1725043095      3  GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC
  1953525135          32         Sec GPT table
  1953525167           1         Sec GPT header

Thank you for any help or suggestions

Answer 1

Note: Posting images of the output from the Terminal application can often lead to users not posting an answer to a question. You should copy and paste the text to your question. Once pasted, highlight the text, then click on the code sample button {} to format the text.

Your current APFS partition (disk0s2) does not appear to be valid for several reasons. Below are three reasons.

1. The magic number stored in the header is incorrect. Also, the header defines the block size to be 2,385,839,421 bytes and the APFS container to be 2,777,634,813,198,357 TB in size. The magic number should be BSXN. The block size should be 4096 bytes and the container should be less than or equal to 883,222,061,056 bytes in size.
2. The APFS partition size of 1,725,043,095 logical sectors is not divisible by 8.
3. The APFS partition should appear either immediately and soon after the EFI partition (disk0s1). Here, the partition starts 116,773,068,800 bytes after the end of the EFI partition.

It appears that an APFS partition of 960,018,657,280 bytes in size did occur immediately after the EFI partition (disk0s1). The problem is the data stored in the APFS partition was partially overwritten by the data now stored in disk0s3. The type and location of disk0s3 would indicate that macOS Sierra may have been installed close or immediately before disk0s3. If this is true, then additional data stored in the APFS partition may have been overwritten.

Note: The partition entries stored in the GPT are not in ascending order. While this does not create problems for Ubuntu, this condition oftend leads to an incorrectly functioning macOS.

To correct the GPT, you need to remove the second and third entries. The commands are given below.

Note: You must unmount all volumes from disk0 before entering the commands given below.

sudo gpt remove -i 2 /dev/disk0
sudo gpt remove -i 3 /dev/disk0

The command below will add the APFS container to the GPT.

sudo gpt add -i 2 -b 409640 -s 1875036440 -t apfs /dev/disk0

There is no guarantee fixing the GPT will automatically lead to a correctly functioning APFS partition.

When finished, the output from sudo gpt -r show /dev/disk0 should appear as shown below.

     start        size  index  contents
         0           1         PMBR
         1           1         Pri GPT header
         2          32         Pri GPT table
        34           6         
        40      409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
    409640  1875036440      2  GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC
1875446080    78079055         
1953525135          32         Sec GPT table
1953525167           1         Sec GPT header

Answer 2

David Anderson's answer above is gold. Do bear in mind, that the values used in the command below (1875036440 blocks(512)) used here is as per the situation given by OP.

sudo gpt add -i 2 -b 409640 -s 1875036440 -t apfs /dev/disk0

Change those values according to the output of your sudo gpt -r show disk0. Replace them with the size of your messed up partition.

For example, I had the exact same prob as OP. I had 3 partitions for my SDD. The first parition (APFS) got messed up. The rest of the partitions (partition2, partition3) were HFS.

In the gpt add command I entered the size of my partition , and voila, on restarting my computer, MacOS came back.

Answer 3

Hint for Recovery: Data might still be accessible using linux and apfs-fuse

Unfortunately I've ran into the same problem on my Bootcamp setup while attempting to extend my MacOS partition using Disk Utility after shrinking my Windows partition using diskmgmt. It displayed an error but remained usable until the next reboot. Afterwards MacOS wasn't shown among the startup options and Windows would't boot as well. Even when running Internet Recovery, the disk couldn't be erased neither using Disk Utility nor diskutil. Reinstalling MacOS obviously failed. This is where I've come to read this highly informative thread.

Luckily I'm "triple booting" with Debian on a USB disk and decided on attempting to mount the MacOS partition before doing further modifications to it. Therefore I've checked lsblk and found the partition to be correctly registered there:

• /dev/sda1: Macintosh Boot
• /dev/sda2: Macintosh System & Data (FileVault)
• /dev/sda3: Windows Boot
• /dev/sda4: Windows System & Data (Bitlocker)

The respective labels can be retrieved using blkid.

Next I've downloaded the apfs-fuse source and followed the installation instructions, whereby the package cmake-curses-gui was additionally required. Upon completion, the compiled apfs-fuse application can be used to mount the MacOS partition - preferably read only.

As the partition seems to be accessible, I don't understand why Disk Utility is incapable to fix the present error. But given this option to backup even recent changes, the consequences remain mild.