2

I used macOS mojave(APFS partition) and Windows10(Bootcamp). And I tried to expand Bootcamp partition with moving Windows OEM partition by EaseUS partition master in windows. After this, I can’t find APFS partition installed macOS.

I use MacBook Pro 2016.

I think “disk0s2” was APFS partition, but now it is “Windows Recovery” partition.

Do you have any ideas to solve this? (I am Japanese, so I'm sorry for my poor English)

I tried “gpt show” and “diskutil list” on macOS Recovery I tried “got show” and “diskutil list” on macOS Recovery

Additional information I tried dd if=/dev/disk0s2 count=1 bs=512 command in a Terminal app of macOS Utility from network boot, and the terminal says,

-bash-3.2# dd if=/dev/disk0s2 count=1 bs=512 | vis -c
1+0 records in
1+0 records out
512 bytes transferred in 0.005472 secs (93568 bytes/sec)
)us??-ҵ?\^A\0\0\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^A\0\0\M^@\0\0\0\0NXSB\0\^P\0\0?\M^B?\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\^B\0\0\0\0\0\0\0"\^R???\M^_@}\M^Bvy57
?(h?8\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^X\^A\0\0 l\0\0?\M^J\0\0\0\0\0\0\^R\r\0\0\0\0\0\0\a\0\0\0004*\0\0\^E\0\0\0\^B\0\0\0\^S*\0\0!\0\0\0\M^Qr8\0\0\0\0\0\M^U?\b\0\0\0\0\0\^A\^D\0\0\0\0\0\0\0\0\0\0d\0\0\0\^C\^D\0\0\0\0\0\0\M^T\M^N\^A\0\0\0\0\0\M^V\M^N\^A\0\0\0\0\0?0\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0-bash-3.2#

.

  • can you boot to Windows? – David Anderson May 15 at 20:05
  • @DavidAnderson, Yes! – Masanobu Aricawa May 15 at 21:35
  • Open compmgmt.msc on Windows, go to "Disk Management" (under "Storage"), locate the very big "Windows Recovery" partition. Does it say "NTFS (healthy)" or RAW or something ? !!!DO NOT FORMAT THE DRIVE!!! – user2531336 May 16 at 8:09
  • I hesitate to post an answer to this question because your Mac appears to have been using Core Storage in some sort of Fusion Drive arrangement, but diskutil list only shows one drive. – David Anderson May 16 at 9:44
  • @user2531336 Yes, Disk manager said it is RAW... – Masanobu Aricawa May 17 at 0:18
1

From Windows, you can open a Command Prompt window as an Administrator. Next, you could enter the commands given below to change disk0s2 to an APFS type.

diskpart
select disk 0
select partition 2
set id=7C3457EF-0000-11AA-AA11-00306543ECAC override
gpt attributes=0x0000000000000000
exit

Update

The output from dd if=/dev/disk0s2 count=1 bs=512 | vis -c contains the character sequence NXSB which gives evidence that disk0s2 is a APFS container. The sequence that follows NXSB is \0\^P\0\0?\M^B?\^B\0\0\0\0\. This sequence indicates the size value of 49283834 in the GPT is wrong for the 2nd entry (disk0s2). This incorrect value would cause the APFS volume to remain unmounted. Unfortunately, because the sequence contains question mark (?) characters, the correct value for the size can not be precisely determined.

Based on this new information, I can only guess at a solution. Below is my best guess.

Enter the following commands while booted to macOS Internet Recovery.

diskutil unmountdisk /dev/disk0
gpt remove -i 2 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt remove -i 3 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt add -i 2 -b 76806 -s 49316602 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0

How to determine the exact size for disk0s2.

  1. While booted to macOS Internet Recovery, copy the first 512 bytes of disk0s2 to a flash drive. Below is an example, where the flash drive volume label is MYFLASHDRV. You will need a flash drive that is MS-DOS (FAT) or ExFAT formatted.

    dd if=/dev/disk0s2 count=1 bs=512 of=/Volumes/MYFLASHDRV/hexdump.bin
    
  2. Print out a hex dump of the saved file. Post the output to your question.

    Upload the hexdump.bin file to the website File to hexadecimal converter.

    Note: Before uploading the file, make sure the box labeled "Use 0x and comma as separator (C-like)" is unchecked and the box labeled "Insert newlines after each 16B" is checked off.

    Or, find another Mac and run the command shown below.

    hexdump -Cv /Volumes/MYFLASHDRV/hexdump.bin
    

    Or, boot to Windows, then download and run the command shown below. Here, I assume the flash drive is assigned the drive letter D:.

    writehex < D:\hexdump.bin
    

    Note: You will need to download the readgpt1.1.0x64.zip file from the readgpt website. You can extract the writehex.exe application from this zip file. This is a website that I created.

  3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). I can do this for you and update my answer. Or, you can read the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

Alternative method to determine the exact size for disk0s2.

  1. While booted to macOS Internet Recovery, enter the commands given below.

    export LC_CTYPE="ASCII"
    dd if=/dev/disk0s2 bs=1 count=16 skip=32 2>/dev/null | vis -wc; echo
    

    If value of 49316602 posted in my above guess is correct, then you should get the following output.

    NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0
    

    If your results are different, then you can post your results and wait for me to update my answer. OR, you can proceed to step 2.

  2. Find another Mac and enter the command shown below. Here you need to replace the string with your results.

    Note: It is important that the string be enclosed by single quotes ('). Do not use double quotes (").

    echo -n 'NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0' | unvis | hexdump -Cv
    

    The above command would produce the following output.

    00000000  4e 58 53 42 00 10 00 00  fa 82 f0 02 00 00 00 00  |NXSB............|
    00000010
    
  3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). The procedure for doing this is posted in the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

  • Funny enough, that was exactly what gonna be what I would have answered provided op confirmed it was NOT formatted in NTFS as ... if it is, he will want testdisk to revocer data. – user2531336 May 16 at 10:34
  • Thank you so much. And I tried this method(because I didn’t format disk0). It seems that I succeed in changing to an APFS type. However, I can’t still open macOS(when I start my MacBook, I used “option” key to select OS, but only I can see is windows). And disk0s3 is still “raw”. disk0s3 may be macOS’s partition... – Masanobu Aricawa May 16 at 11:16
  • My answer was based on your statement that partition was a APFS container. However, as I posted in my comment to your question, I did not think you were right. Trying my answer did not damage your drive because no new volumes mounted. – David Anderson May 16 at 18:12
  • @DavidAnderson. Thank you very much. I don’t know Core Storage and APFS well, so could you tell me the statement of my drive? – Masanobu Aricawa May 17 at 0:12
  • Don't worry, the above commands are non-destructive, somehow, your partition has an incorrect ID but the data is still there ... so, you go ahead and do that and see if it works (as-in you can mount the partition again in macos). – user2531336 May 17 at 6:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .