Lost my APFS partition after using EaseUS partition manager on Bootcamp

Question

I used macOS mojave(APFS partition) and Windows10(Bootcamp). And I tried to expand Bootcamp partition with moving Windows OEM partition by EaseUS partition master in windows. After this, I can’t find APFS partition installed macOS.

I use MacBook Pro 2016.

I think “disk0s2” was APFS partition, but now it is “Windows Recovery” partition.

Do you have any ideas to solve this? (I am Japanese, so I'm sorry for my poor English)

I tried “gpt show” and “diskutil list” on macOS Recovery

Additional information I tried the commands dd if=/dev/disk0s2 count=1 bs=512 | vis -c in a Terminal app of macOS Utility from network boot, and the terminal says,

-bash-3.2# dd if=/dev/disk0s2 count=1 bs=512 | vis -c
1+0 records in
1+0 records out
512 bytes transferred in 0.005472 secs (93568 bytes/sec)
)us??-ҵ?\^A\0\0\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^A\0\0\M^@\0\0\0\0NXSB\0\^P\0\0?\M^B?\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\^B\0\0\0\0\0\0\0"\^R???\M^_@}\M^Bvy57
?(h?8\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^X\^A\0\0 l\0\0?\M^J\0\0\0\0\0\0\^R\r\0\0\0\0\0\0\a\0\0\0004*\0\0\^E\0\0\0\^B\0\0\0\^S*\0\0!\0\0\0\M^Qr8\0\0\0\0\0\M^U?\b\0\0\0\0\0\^A\^D\0\0\0\0\0\0\0\0\0\0d\0\0\0\^C\^D\0\0\0\0\0\0\M^T\M^N\^A\0\0\0\0\0\M^V\M^N\^A\0\0\0\0\0?0\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0-bash-3.2#

.

Answer 1

From Windows, you can open a Command Prompt window as an Administrator. Next, you could enter the commands given below to change disk0s2 to an APFS type.

diskpart
select disk 0
select partition 2
set id=7C3457EF-0000-11AA-AA11-00306543ECAC override
gpt attributes=0x0000000000000000
exit

Update

The output from dd if=/dev/disk0s2 count=1 bs=512 | vis -c contains the character sequence NXSB which gives evidence that disk0s2 is a APFS container. The sequence that follows NXSB is \0\^P\0\0?\M^B?\^B\0\0\0\0\. This sequence indicates the size value of 49283834 in the GPT is wrong for the 2nd entry (disk0s2). This incorrect value would cause the APFS volume to remain unmounted. Unfortunately, because the sequence contains question mark (?) characters, the correct value for the size can not be precisely determined.

Based on this new information, I can only guess at a solution. Below is my best guess.

Enter the following commands while booted to macOS Internet Recovery.

diskutil unmountdisk /dev/disk0
gpt remove -i 2 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt remove -i 3 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt add -i 2 -b 76806 -s 49316602 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0

How to determine the exact size for disk0s2.

1. While booted to macOS Internet Recovery, copy the first 512 bytes of disk0s2 to a flash drive. Below is an example, where the flash drive volume label is MYFLASHDRV. You will need a flash drive that is MS-DOS (FAT) or ExFAT formatted.

   dd if=/dev/disk0s2 count=1 bs=512 of=/Volumes/MYFLASHDRV/hexdump.bin
   

2. Print out a hex dump of the saved file. Post the output to your question.

   Upload the hexdump.bin file to the website File to hexadecimal converter.

   Note: Before uploading the file, make sure the box labeled "Use 0x and comma as separator (C-like)" is unchecked and the box labeled "Insert newlines after each 16B" is checked off.

   Or, find another Mac and run the command shown below.

   hexdump -Cv /Volumes/MYFLASHDRV/hexdump.bin
   

   Or, boot to Windows, then download and run the command shown below. Here, I assume the flash drive is assigned the drive letter D:.

   writehex < D:\hexdump.bin
   

   Note: You will need to download the readgpt1.1.0x64.zip file from the readgpt website. You can extract the writehex.exe application from this zip file. This is a website that I created.

3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). I can do this for you and update my answer. Or, you can read the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

Alternative method to determine the exact size for disk0s2.

1. While booted to macOS Internet Recovery, enter the commands given below.

   dd if=/dev/disk0s2 bs=1 count=16 skip=32 2>/dev/null | LC_CTYPE=C vis -wc; echo
   

   If value of 49316602 posted in my above guess is correct, then you should get the following output.

   NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0
   

   If your results are different, then you can post your results and wait for me to update my answer. OR, you can proceed to step 2.

2. Find another Mac and enter the command shown below. Here you need to replace the string with your results.

   Note: It is important that the string be enclosed by single quotes ('). Do not use double quotes (").

   echo -n -E 'NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0' | unvis | hexdump -Cv
   

   The above command would produce the following output.

   00000000  4e 58 53 42 00 10 00 00  fa 82 f0 02 00 00 00 00  |NXSB............|
   00000010
   

3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). The procedure for doing this is posted in the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

Answer 2

I had the same problem with Easeus and solved it using gdisk.
https://sourceforge.net/projects/gptfdisk/
I donated $25 because it saved me from doing something stupid.

Overview ( Print out A gdisk Walkthrough by Rod Smith )

Download the windows version and unzip.
Command Prompt - must Run as Administrator ( or create Command Prompt shortcut and change Advanced Properties to Run as Administrator )

cd to gdisk folder

gdisk64 0: ( this opens root level, there is a gdisk32.exe also)

Command (? for help): p ( this lists partition numbers, my mac was 2 )

Command (? for help): i ( information on partition number )
Partition number (1-3): 2 ( in my case the APFS was now Windows RE )

Command (? for help): l ( list/search partition codes af0a is the code for Apple APFS)

Command (? for help): t ( t changes the partition code )
Partition number (1-3): 2
Current type is 2700 (Windows RE)
Hex code or GUID (L to show codes, Enter = 2700): af0a
Changed type of partition to 'Apple APFS'

Command (? for help): w
Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!
Do you want to proceed? (Y/N): y

Here is the command prompt text:

C:\Users\xxxxxxx\Downloads\@ GDISK>gdisk64 0:

GPT fdisk (gdisk) version 1.0.5
Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): p

Disk 0:: 61279344 sectors, 233.8 GiB
Sector size (logical): 4096 bytes
Disk identifier (GUID): 91BA5126-A853-4FDF-85C5-A15CB06EE24D
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 5
First usable sector is 6, last usable sector is 61279338
Partitions will be aligned on 2-sector boundaries
Total free space is 129 sectors (516.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1               6           76805   300.0 MiB   EF00
   2           76806        39139305   149.0 GiB   2700  Ma
   3        39139312        61279215   84.5 GiB    0700

Command (? for help): i
Partition number (1-3): 2

Partition GUID code: DE94BBA4-06D1-4D40-A16A-BFD50179D6AC (Windows RE)
Partition unique GUID: AE6B38B0-D322-4A09-B871-0F92B87082CA
First sector: 76806 (at 300.0 MiB)
Last sector: 39139305 (at 149.3 GiB)
Partition size: 39062500 sectors (149.0 GiB)
Attribute flags: 0000000000000000
Partition name: 'Ma'

Command (? for help): l

Type search string, or <Enter> to show all codes: apfs
af0a Apple APFS

Command (? for help): t
Partition number (1-3): 2

Current type is 2700 (Windows RE)
Hex code or GUID (L to show codes, Enter = 2700): af0a
Changed type of partition to 'Apple APFS'

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to \\.\physicaldrive0.
Disk synchronization succeeded! The computer should now use the new
partition table.
The operation has completed successfully.