3

I used macOS mojave(APFS partition) and Windows10(Bootcamp). And I tried to expand Bootcamp partition with moving Windows OEM partition by EaseUS partition master in windows. After this, I can’t find APFS partition installed macOS.

I use MacBook Pro 2016.

I think “disk0s2” was APFS partition, but now it is “Windows Recovery” partition.

Do you have any ideas to solve this? (I am Japanese, so I'm sorry for my poor English)

I tried “gpt show” and “diskutil list” on macOS Recovery I tried “got show” and “diskutil list” on macOS Recovery

Additional information I tried dd if=/dev/disk0s2 count=1 bs=512 command in a Terminal app of macOS Utility from network boot, and the terminal says,

-bash-3.2# dd if=/dev/disk0s2 count=1 bs=512 | vis -c
1+0 records in
1+0 records out
512 bytes transferred in 0.005472 secs (93568 bytes/sec)
)us??-ҵ?\^A\0\0\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^A\0\0\M^@\0\0\0\0NXSB\0\^P\0\0?\M^B?\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\^B\0\0\0\0\0\0\0"\^R???\M^_@}\M^Bvy57
?(h?8\0\0\0\0\0?\M^F\^Z\0\0\0\0\0\^X\^A\0\0 l\0\0?\M^J\0\0\0\0\0\0\^R\r\0\0\0\0\0\0\a\0\0\0004*\0\0\^E\0\0\0\^B\0\0\0\^S*\0\0!\0\0\0\M^Qr8\0\0\0\0\0\M^U?\b\0\0\0\0\0\^A\^D\0\0\0\0\0\0\0\0\0\0d\0\0\0\^C\^D\0\0\0\0\0\0\M^T\M^N\^A\0\0\0\0\0\M^V\M^N\^A\0\0\0\0\0?0\^B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0-bash-3.2#

.

  • can you boot to Windows? – David Anderson May 15 '19 at 20:05
  • @DavidAnderson, Yes! – Masanobu Aricawa May 15 '19 at 21:35
  • Open compmgmt.msc on Windows, go to "Disk Management" (under "Storage"), locate the very big "Windows Recovery" partition. Does it say "NTFS (healthy)" or RAW or something ? !!!DO NOT FORMAT THE DRIVE!!! – user2531336 May 16 '19 at 8:09
  • I hesitate to post an answer to this question because your Mac appears to have been using Core Storage in some sort of Fusion Drive arrangement, but diskutil list only shows one drive. – David Anderson May 16 '19 at 9:44
  • @user2531336 Yes, Disk manager said it is RAW... – Masanobu Aricawa May 17 '19 at 0:18
3

From Windows, you can open a Command Prompt window as an Administrator. Next, you could enter the commands given below to change disk0s2 to an APFS type.

diskpart
select disk 0
select partition 2
set id=7C3457EF-0000-11AA-AA11-00306543ECAC override
gpt attributes=0x0000000000000000
exit

Update

The output from dd if=/dev/disk0s2 count=1 bs=512 | vis -c contains the character sequence NXSB which gives evidence that disk0s2 is a APFS container. The sequence that follows NXSB is \0\^P\0\0?\M^B?\^B\0\0\0\0\. This sequence indicates the size value of 49283834 in the GPT is wrong for the 2nd entry (disk0s2). This incorrect value would cause the APFS volume to remain unmounted. Unfortunately, because the sequence contains question mark (?) characters, the correct value for the size can not be precisely determined.

Based on this new information, I can only guess at a solution. Below is my best guess.

Enter the following commands while booted to macOS Internet Recovery.

diskutil unmountdisk /dev/disk0
gpt remove -i 2 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt remove -i 3 /dev/disk0
diskutil unmountdisk /dev/disk0
gpt add -i 2 -b 76806 -s 49316602 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0

How to determine the exact size for disk0s2.

  1. While booted to macOS Internet Recovery, copy the first 512 bytes of disk0s2 to a flash drive. Below is an example, where the flash drive volume label is MYFLASHDRV. You will need a flash drive that is MS-DOS (FAT) or ExFAT formatted.

    dd if=/dev/disk0s2 count=1 bs=512 of=/Volumes/MYFLASHDRV/hexdump.bin
    
  2. Print out a hex dump of the saved file. Post the output to your question.

    Upload the hexdump.bin file to the website File to hexadecimal converter.

    Note: Before uploading the file, make sure the box labeled "Use 0x and comma as separator (C-like)" is unchecked and the box labeled "Insert newlines after each 16B" is checked off.

    Or, find another Mac and run the command shown below.

    hexdump -Cv /Volumes/MYFLASHDRV/hexdump.bin
    

    Or, boot to Windows, then download and run the command shown below. Here, I assume the flash drive is assigned the drive letter D:.

    writehex < D:\hexdump.bin
    

    Note: You will need to download the readgpt1.1.0x64.zip file from the readgpt website. You can extract the writehex.exe application from this zip file. This is a website that I created.

  3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). I can do this for you and update my answer. Or, you can read the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

Alternative method to determine the exact size for disk0s2.

  1. While booted to macOS Internet Recovery, enter the commands given below.

    export LC_CTYPE="ASCII"
    dd if=/dev/disk0s2 bs=1 count=16 skip=32 2>/dev/null | vis -wc; echo
    

    If value of 49316602 posted in my above guess is correct, then you should get the following output.

    NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0
    

    If your results are different, then you can post your results and wait for me to update my answer. OR, you can proceed to step 2.

  2. Find another Mac and enter the command shown below. Here you need to replace the string with your results.

    Note: It is important that the string be enclosed by single quotes ('). Do not use double quotes (").

    echo -n 'NXSB\0\^P\0\0\M-z\M^B\M-p\^B\0\0\0\0' | unvis | hexdump -Cv
    

    The above command would produce the following output.

    00000000  4e 58 53 42 00 10 00 00  fa 82 f0 02 00 00 00 00  |NXSB............|
    00000010
    
  3. Determine the size in 4096 bytes sectors of the APFS container partition (disk0s2). The procedure for doing this is posted in the accepted answer to the question: Tried to fix filesystem type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF and probably made it worse.

| improve this answer | |
  • Funny enough, that was exactly what gonna be what I would have answered provided op confirmed it was NOT formatted in NTFS as ... if it is, he will want testdisk to revocer data. – user2531336 May 16 '19 at 10:34
  • Thank you so much. And I tried this method(because I didn’t format disk0). It seems that I succeed in changing to an APFS type. However, I can’t still open macOS(when I start my MacBook, I used “option” key to select OS, but only I can see is windows). And disk0s3 is still “raw”. disk0s3 may be macOS’s partition... – Masanobu Aricawa May 16 '19 at 11:16
  • My answer was based on your statement that partition was a APFS container. However, as I posted in my comment to your question, I did not think you were right. Trying my answer did not damage your drive because no new volumes mounted. – David Anderson May 16 '19 at 18:12
  • @DavidAnderson. Thank you very much. I don’t know Core Storage and APFS well, so could you tell me the statement of my drive? – Masanobu Aricawa May 17 '19 at 0:12
  • Don't worry, the above commands are non-destructive, somehow, your partition has an incorrect ID but the data is still there ... so, you go ahead and do that and see if it works (as-in you can mount the partition again in macos). – user2531336 May 17 '19 at 6:15
0

I had the same problem with Easeus and solved it using gdisk. https://sourceforge.net/projects/gptfdisk/ I donated $25 because it saved me from doing something stupid.

Overview ( Print out A gdisk Walkthrough by Rod Smith )

Download the windows version and unzip. Command Prompt - must Run as Administrator ( or create Command Prompt shortcut and change Advanced Properties to Run as Administrator )

cd to gdisk folder

gdisk64 0: ( this opens root level, there is a gdisk32.exe also)

Command (? for help): p ( this lists partition numbers, my mac was 2 )

Command (? for help): i ( information on partition number ) Partition number (1-3): 2 ( in my case the APFS was now Windows RE )

Command (? for help): l ( list/search partition codes af0a is the code for Apple APFS)

Command (? for help): t ( t changes the partition code ) Partition number (1-3): 2 Current type is 2700 (Windows RE) Hex code or GUID (L to show codes, Enter = 2700): af0a Changed type of partition to 'Apple APFS'

Command (? for help): w Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING PARTITIONS!! Do you want to proceed? (Y/N): y

here is the command prompt text: C:\Users\xxxxxxx\Downloads@ GDISK>gdisk64 0:

GPT fdisk (gdisk) version 1.0.5 Partition table scan: MBR: protective BSD: not present APM: not present GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): p

Disk 0:: 61279344 sectors, 233.8 GiB Sector size (logical): 4096 bytes Disk identifier (GUID): 91BA5126-A853-4FDF-85C5-A15CB06EE24D Partition table holds up to 128 entries Main partition table begins at sector 2 and ends at sector 5 First usable sector is 6, last usable sector is 61279338 Partitions will be aligned on 2-sector boundaries Total free space is 129 sectors (516.0 KiB)

Number Start (sector) End (sector) Size Code Name 1 6 76805 300.0 MiB EF00 2 76806 39139305 149.0 GiB 2700 Ma 3 39139312 61279215 84.5 GiB 0700

Command (? for help): i Partition number (1-3): 2

Partition GUID code: DE94BBA4-06D1-4D40-A16A-BFD50179D6AC (Windows RE) Partition unique GUID: AE6B38B0-D322-4A09-B871-0F92B87082CA First sector: 76806 (at 300.0 MiB) Last sector: 39139305 (at 149.3 GiB) Partition size: 39062500 sectors (149.0 GiB) Attribute flags: 0000000000000000 Partition name: 'Ma'

Command (? for help): l

Type search string, or to show all codes: apfs af0a Apple APFS

Command (? for help): t Partition number (1-3): 2

Current type is 2700 (Windows RE) Hex code or GUID (L to show codes, Enter = 2700): af0a Changed type of partition to 'Apple APFS'

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING PARTITIONS!!

Do you want to proceed? (Y/N): y OK; writing new GUID partition table (GPT) to \.\physicaldrive0. Disk synchronization succeeded! The computer should now use the new partition table. The operation has completed successfully.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .