Trying to rebuild my partition map

Question

Mac Mini running High Sierra.
Three partitions on the internal drive: macOS (HFS+ Journaled), Windows (Bootcamp) and a separate NTFS partition for Windows applications.

(I know there's multiple threads on similar topics but they all appeared to be old and I'm tired of being chastised for necrothreading.)

A while back I booted into my Windows 10 Bootcamp partition and allowed it to update things. I only boot to Windows about every month or so, so this can take a while. Once it was done it went to restart but failed to do so. It went into a repair mode, couldn't repair, couldn't recover from the last System Recovery point, nothing.

My son has started a budding business in IT and is far more Windows proficient than I so I asked him to take a look at it. He did and had no more success than I did. He ran a disk scan that found a number of bad sectors but this had no effect so he took it upon himself to delete the Windows partitions. It seems, however, that in doing so, whatever utility he was using told the entire drive it was all Windows partitions and I could no longer boot the device at all, neither to Windows or Mac.

He put Testdisk on a flash drive at my insistance and I've been able to tinker with it some on my own but with limited results. I was able to undelete the macOS Recovery partition so I could boot into Recovery mode though I've been doing most of my work through the net-based Recovery mode (I'll call this net-Recovery) as something I read suggested that would give me the most relevant set of tools for my version of the OS.

I used TeskDisk (and DiskUtil) to compile a map of my drive. If I can get the macOS portion running again, I'll probably remove the Bootcamp partition and rebuild it using the proper tools and reinstall Windows altogether, but I want to save the Mac portion if I can. From what I can tell from information on this and another site I should probably rebuild my partition map using "gpt" (I can't use "gdisk" since I don't have anyplace to install it that I'm aware of; I'm working on the internal drive). I've run into an issue getting Suspicious MBR at sector 0. Even trying to use "gpt -v destroy -r disk0" doesn't work because of this. I get the impression I can use "fdisk" to rebuild this? I think I'm just looking to make sure what I'm planning is right before I mess things up irrevocably.

When I run "diskutil disk0" under net-Recovery, I get this:

0:  FDisk_partition_scheme  500.1GB disk0
1:  0xEE                    209.7MB disk0s1
2:  Apple_HFS               370GB   disk0s2
4:  Windows_NTFS            53.7GB  disk0s4

Testdisk provided the following map:

EFI System      40          409639      409600
Mac HFS         409640      723065887   722656248
Mac HFS         723065888   724335423   1269536
MS Data         724336640   829194239   104857600

I'm pretty sure the 2nd Mac HFS is the Recovery partition. Why it isn't appearing on the DiskUtil list, I'm not sure, but it may have something to do with using net-Recovery? Anyway, what is listed above is what I'm trying to restore.

Running "gpt -v show /dev/disk0" provides:

mediasize=500107862016; sectorsize=512; blocks=976773168
Suspicious MBR at sector 0
Start       Size        Index   Contents
0           1                   MBR
1           1                   Pri GPT header
2           32                  Pri GPT table
34          6
40          409600      1       GPTpart-C12A7328-F81F-11D2-BA4B-00A0C93EC93B
409640      722656248   2       GPTpart-48465300-0000-11AA-AA11-00306543ECAC
723965888   1269536     3       GPTpart-48465300-0000-11AA-AA11-00306543ECAC
724335424   1216
724336640   104857600   4       GPTpart-EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
829194240   147578895
976733135   32                  Sec GPT table
976773167   1                   Sec GPT header

So I could not run "gpt create -f /dev/disk0" because "device already contains a GPT" and as I mentioned I could not destroy the gpt to rebuild it because of the suspicious MBR.

I believe what I want to do next is run
fdisk -i -a hfs /dev/disk0

I'm unsure whether I should use the hfs style or the ufs style, and can't find anything conclusive about why I would pick one over the other. Regardless, I've read that this should remove the previous MBR and the "suspicious" errors.

Then I should be able to rebuild the GPT:
gpt create -f /dev/disk0

And then rebuild the EFI table:
gpt add -b 40 -i 1 -s 409600 -t C12A7328-F81F-11D2-BA4B-00A0C93EC93B disk0

And then rebuild the expected partitions:
gpt add -b 409640 -i 2 -s 722656248 -t 48465300-0000-11AA-AA11-00306543ECAC disk0
gpt add -b 723065888 -i 3 -s 1269536 -t 48465300-0000-11AA-AA11-00306543ECAC disk0
gpt add -b 724336640 -i 4 -s 104857600 -t EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 disk0

Am I on the right track?

Answer 1

The gdisk command is simpler to use that the gpt and/or fdisk commands. This answer explains how to install gdisk, then give examples of how to use gdisk. Since your drive appears to be hybrid partitioned, the first example shows how to remove the hybrid partitioning. The second example rebuilds your GPT from scratch.

Note: Your drive has a macOS Recovery partition. This partition has a nonzero attribute in the GPT. The gpt command can not set attribute bits in the GPT. Therefore, the gpt command can not be used to completely rebuilt your partition map. The gdisk command does not have this limitation.

Install gdisk from macOS Recovery

The following steps can be used to install gdisk to your EFI partition. The gdisk command is part of the "GPT fdisk" project.

1. Boot to macOS Recovery. I booted to version 10.13.6. (The sw_vers command can be used to output the version of macOS Recovery.)

2. From the menu bar, select Utilities→Terminal to open a Terminal window and enter the commands below. This will mount your EFI partition and remove any previous versions of gdisk.

   diskutil mount disk0s1
   cd /Volumes/EFI
   rm -rf gdisk*
   

   When finished, quit the Terminal application.

3. Open Safari by selecting "Get Help Online". Under Safari Preferences, set "File download location:" to the EFI device, as shown below.

   

   Next, goto https://sourceforge.net/projects/gptfdisk/ and select the green Download button, shown below, to download the current version of gdisk. (This was version 1.0.8 when I wrote this and therefore the file gdisk-1.0.8.pkg was downloaded to /Volumes/EFI.)

   

   When finished, quit the Safari application.

4. From the menu bar, open a Terminal window and enter commands below. This will install gdisk to the EFI volume.

   cd /Volumes/EFI
   pkgutil --expand-full gdisk*.pkg gdisk-full
   mv gdisk-full/Payload/usr/local/bin/gdisk .
   rm -rf gdisk-*
   cd ~
   

Remove hybrid Partitioning

Note: The message Suspicious MBR at sector 0 produced by the gpt command is an indication of hybrid partitioning.

Below are the commands. Here, I assume /dev/disk0s1 is already mounted on /Volumes/EFI.

/Volume/EFI/gdisk /dev/disk0
x
n
w
y

Sample output is below.

/Volumes/EFI/gdisk /dev/disk0
GPT fdisk (gdisk) version 1.0.8

Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): x

Expert command (? for help): n

Expert command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/disk0.
Warning: The kernel may continue to use old or deleted partitions.
You should reboot or remove the drive.
The operation has completed successfully.

Rebuild GPT from Scratch

Below are the commands. Here, I assume /dev/disk0s1 is already mounted on /Volumes/EFI.

/Volume/EFI/gdisk /dev/disk0
o
y
x
l
1
m
n
1
40
+409600
ef00
n
2
409640
+722656248
af00
n
3
723065888 
+1269536
ab00
x
a
3
49
64
m
n
4
724336640
+104857600
0700
p
w
y

Sample output is below.

/Volumes/EFI/gdisk /dev/disk0
GPT fdisk (gdisk) version 1.0.8

Partition table scan:
  MBR: hybrid
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with hybrid MBR; using GPT.

Command (? for help): o
This option deletes all partitions and creates a new protective MBR.
Proceed? (Y/N): y

Command (? for help): x

Expert command (? for help): l
Enter the sector alignment value (1-65536, default = 2048): 1

Expert command (? for help): m

Command (? for help): n
Partition number (1-128, default 1): 1
First sector (34-976773134, default = 34) or {+-}size{KMGTP}: 40
Last sector (40-976773134, default = 976773134) or {+-}size{KMGTP}: +409600
Current type is AF00 (Apple HFS/HFS+)
Hex code or GUID (L to show codes, Enter = AF00): ef00
Changed type of partition to 'EFI system partition'

Command (? for help): n
Partition number (2-128, default 2): 2
First sector (34-976773134, default = 409640) or {+-}size{KMGTP}: 409640
Last sector (409640-976773134, default = 976773134) or {+-}size{KMGTP}: +722656248
Current type is AF00 (Apple HFS/HFS+)
Hex code or GUID (L to show codes, Enter = AF00): af00
Changed type of partition to 'Apple HFS/HFS+'

Command (? for help): n
Partition number (3-128, default 3): 3
First sector (34-976773134, default = 723065888) or {+-}size{KMGTP}: 723065888 
Last sector (723065888-976773134, default = 976773134) or {+-}size{KMGTP}: +1269536
Current type is AF00 (Apple HFS/HFS+)
Hex code or GUID (L to show codes, Enter = AF00): ab00
Changed type of partition to 'Recovery HD'

Command (? for help): x

Expert command (? for help): a
Partition number (1-3): 3
Known attributes are:
0: system partition
1: hide from EFI
2: legacy BIOS bootable
60: read-only
62: hidden
63: do not automount

Attribute value is 0000000000000000. Set fields are:
  No fields set

Toggle which attribute field (0-63, 64 or <Enter> to exit): 49
Have enabled the 'Undefined bit #49' attribute.
Attribute value is 0002000000000000. Set fields are:
49 (Undefined bit #49)

Toggle which attribute field (0-63, 64 or <Enter> to exit): 64

Expert command (? for help): m

Command (? for help): n
Partition number (4-128, default 4): 4
First sector (34-976773134, default = 724335424) or {+-}size{KMGTP}: 724336640
Last sector (724336640-976773134, default = 976773134) or {+-}size{KMGTP}: +104857600
Current type is AF00 (Apple HFS/HFS+)
Hex code or GUID (L to show codes, Enter = AF00): 0700
Changed type of partition to 'Microsoft basic data'

Command (? for help): p
Disk /dev/disk0: 976773168 sectors, 465.8 GiB
Sector size (logical): 512 bytes
Disk identifier (GUID): 05365D82-005A-4671-844A-EEF1321088E6
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 976773134
Partitions will be aligned on 1-sector boundaries
Total free space is 147580117 sectors (70.4 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              40          409639   200.0 MiB   EF00  EFI system partition
   2          409640       723065887   344.6 GiB   AF00  Apple HFS/HFS+
   3       723065888       724335423   619.9 MiB   AB00  Recovery HD
   4       724336640       829194239   50.0 GiB    0700  Microsoft basic data

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/disk0.
Warning: The kernel may continue to use old or deleted partitions.
You should reboot or remove the drive.
The operation has completed successfully.

Unmounting /dev/disk0s1

The commands are given below.

cd ~
diskutil unmount disk0s1

References

GPT fdisk Tutorial
GPT fdisk
How to extract contents from 'Payload' file in a apple macOS update package?