Can't recover Bootcamp partition Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
fkseki
Posts: 5
Joined: 29 Apr 2012, 03:22

Can't recover Bootcamp partition

#1 Post by fkseki »

Hi,

I'm on a Mac OS X 10.7.3, using testdisk 6.14-WIP-Intel and I'm unable to recover a Bootcamp partition which I can't boot, I can't see it in Finder but testdisk has it listed and all the files appears to be there.
I'm receiving the message "Partition: write error".

In the beggining it's shown "Write access for this media is not available.
TestDisk won't be able to modify it."

I've tried tried disabling iAntiVirus with no different result.
I've got a few screenshots, testdisk log and rEfit PartitionInspector results:
Screen Shot 2012-04-29 at 00.34.32.png
Screen Shot 2012-04-29 at 00.34.32.png (31.94 KiB) Viewed 14499 times
Screen Shot 2012-04-29 at 00.58.48.png
Screen Shot 2012-04-29 at 00.58.48.png (31.89 KiB) Viewed 14499 times
Screen Shot 2012-04-29 at 00.59.02.png
Screen Shot 2012-04-29 at 00.59.02.png (38.27 KiB) Viewed 14499 times
Testdist log:

Code: Select all

Sat Apr 28 22:00:19 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 11.3.0 (Darwin Kernel Version 11.3.0: Thu Jan 12 18:47:41 PST 2012; root:xnu-1699.2
Compiler: GCC 4.0
Compilation date: Apr 21 201215:07:24
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
Hard disk list
Disk /dev/disk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO), sector size=512
Disk /dev/rdisk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO), sector size=512

Partition table type (auto): EFI GPT
Media is opened in read-only.
Disk /dev/rdisk0 - 160 GB / 149 GiB (RO)
Partition table type: EFI GPT

Analyse Disk /dev/rdisk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=312581807 (expected 312581807)
hdr_lba_start=34
hdr_lba_end=312581774
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                    40     409639     409600
 2 P Mac HFS                   409640  252362759  251953120
 3 P Mac HFS                252362760  253632295    1269536

search_part()
Disk /dev/rdisk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 40/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1
part_size 251953120
     Mac HFS                   409640  252362759  251953120
     HFS+, 128 GB / 120 GiB

HFS+ magic value at 252362760/0/1
part_size 1269536
     Mac HFS                252362760  253632295    1269536
     HFS+, 650 MB / 619 MiB

HFS+ magic value at 271894024/0/1
part_size 1269536
     Mac HFS                271894024  273163559    1269536
     HFS+, 650 MB / 619 MiB
NTFS at 273164288/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size           39415808
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                273164288  312580095   39415808 [BOOTCAMP]
     NTFS, blocksize=4096, 20 GB / 18 GiB

HFS+ magic value at 312581764/0/1
part_size 1269536
     Mac HFS                312581764  313851299    1269536
     HFS+, 650 MB / 619 MiB
This partition ends after the disk limits. (start=312581764, size=1269536, end=313851299, disk end=312581808)
Disk /dev/rdisk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO)
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (160 GB / 149 GiB) seems too small! (< 160 GB / 149 GiB)
The following partition can't be recovered:
     Mac HFS                312581764  313851299    1269536
     HFS+, 650 MB / 619 MiB

Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   409640  252362759  251953120
     HFS+, 128 GB / 120 GiB
   P Mac HFS                252362760  253632295    1269536
     HFS+, 650 MB / 619 MiB
   P Mac HFS                271894024  273163559    1269536
     HFS+, 650 MB / 619 MiB
   P MS Data                273164288  312580095   39415808 [BOOTCAMP]
     NTFS, blocksize=4096, 20 GB / 18 GiB


dir_partition inode=5
   P MS Data                273164288  312580095   39415808 [BOOTCAMP]
     NTFS, blocksize=4096, 20 GB / 18 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 27-Apr-2012 23:23 .
       5 dr-xr-xr-x     0      0         0 27-Apr-2012 23:23 ..
      58 dr-xr-xr-x     0      0         0 13-Jul-2009 23:37 PerfLogs
      57 dr-xr-xr-x     0      0         0 14-Mar-2012 22:33 $Recycle.Bin
    9414 -r--r--r--     0      0        24 10-Jun-2009 18:42 autoexec.bat
   41340 dr-xr-xr-x     0      0         0 15-Mar-2012 06:21 Boot
   41391 -r--r--r--     0      0    383562 13-Jul-2009 22:38 bootmgr
   41402 -r--r--r--     0      0      8192 15-Mar-2012 06:21 BOOTSECT.BAK
    9417 -r--r--r--     0      0        10 10-Jun-2009 18:42 config.sys
    9420 dr-xr-xr-x     0      0         0 14-Jul-2009 01:53 Documents and Settings
   41415 -r--r--r--     0      0 2195501056 27-Apr-2012 23:23 hiberfil.sys
   42659 dr-xr-xr-x     0      0         0 14-Mar-2012 22:44 Intel
   43801 dr-xr-xr-x     0      0         0 14-Mar-2012 23:01 MSOCache
    1039 -r--r--r--     0      0 1153216512 27-Apr-2012 23:23 pagefile.sys
      60 dr-xr-xr-x     0      0         0 27-Apr-2012 21:06 Program Files
     252 dr-xr-xr-x     0      0         0 24-Apr-2012 18:21 ProgramData
   41761 dr-xr-xr-x     0      0         0 14-Mar-2012 22:33 Recovery
   43391 -r--r--r--     0      0      1809 14-Mar-2012 22:47 RHDSetup.log
   10849 dr-xr-xr-x     0      0         0 27-Apr-2012 19:13 System Volume Information
     346 dr-xr-xr-x     0      0         0 14-Mar-2012 22:33 Users
     499 dr-xr-xr-x     0      0         0 16-Apr-2012 18:31 Windows
Can't open backup.log file: No such file or directory
interface_load

interface_write()
 1 P EFI System                    40     409639     409600 [EFI]
 2 P Mac HFS                   409640  252362759  251953120
 3 P Mac HFS                252362760  253632295    1269536
 4 P Mac HFS                271894024  273163559    1269536
 5 P MS Data                273164288  312580095   39415808 [BOOTCAMP]
write!
file_nopwrite(5,32,buffer,2(2/0/1)) write refused

Partition: Write error

Analyse Disk /dev/rdisk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO)
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=312581807 (expected 312581807)
hdr_lba_start=34
hdr_lba_end=312581774
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
 1 P EFI System                    40     409639     409600
 2 P Mac HFS                   409640  252362759  251953120
 3 P Mac HFS                252362760  253632295    1269536

search_part()
Disk /dev/rdisk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT32 at 40/0/1
FAT1 : 32-3182
FAT2 : 3183-6333
start_rootdir : 6334 root cluster : 2
Data : 6334-409599
sectors : 409600
cluster_size : 1
no_of_cluster : 403266 (2 - 403267)
fat_length 3151 calculated 3151
heads/cylinder 16 (FAT) != 1 (HD)
sect/track 32 (FAT) != 1 (HD)

FAT32 at 40/0/1
     EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB

HFS+ magic value at 409640/0/1
part_size 251953120
     Mac HFS                   409640  252362759  251953120
     HFS+, 128 GB / 120 GiB

HFS+ magic value at 252362760/0/1
part_size 1269536
     Mac HFS                252362760  253632295    1269536
     HFS+, 650 MB / 619 MiB

HFS+ magic value at 271894024/0/1
part_size 1269536
     Mac HFS                271894024  273163559    1269536
     HFS+, 650 MB / 619 MiB
NTFS at 273164288/0/1
heads/cylinder 255 (NTFS) != 1 (HD)
sect/track 63 (NTFS) != 1 (HD)
filesystem size           39415808
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                273164288  312580095   39415808 [BOOTCAMP]
     NTFS, blocksize=4096, 20 GB / 18 GiB

HFS+ magic value at 312581764/0/1
part_size 1269536
     Mac HFS                312581764  313851299    1269536
     HFS+, 650 MB / 619 MiB
This partition ends after the disk limits. (start=312581764, size=1269536, end=313851299, disk end=312581808)
Disk /dev/rdisk0 - 160 GB / 149 GiB - CHS 312581808 1 1 (RO)
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (160 GB / 149 GiB) seems too small! (< 160 GB / 149 GiB)
The following partition can't be recovered:
     Mac HFS                312581764  313851299    1269536
     HFS+, 650 MB / 619 MiB

Results
   P EFI System                    40     409639     409600 [EFI]
     FAT32, blocksize=512, 209 MB / 200 MiB
   P Mac HFS                   409640  252362759  251953120
     HFS+, 128 GB / 120 GiB
   P Mac HFS                252362760  253632295    1269536
     HFS+, 650 MB / 619 MiB
   P Mac HFS                271894024  273163559    1269536
     HFS+, 650 MB / 619 MiB
   P MS Data                273164288  312580095   39415808 [BOOTCAMP]
     NTFS, blocksize=4096, 20 GB / 18 GiB
gpt_change_part_type
Change partition type:
   P MS Data                273164288  312580095   39415808 [BOOTCAMP]
     NTFS, blocksize=4096, 20 GB / 18 GiB
Change partition type:
   P NTFS                   273164288  312580095   39415808 [BOOTCAMP]
     NTFS, blocksize=4096, 20 GB / 18 GiB

interface_write()
 1 P EFI System                    40     409639     409600 [EFI]
 2 P Mac HFS                   409640  252362759  251953120
 3 P Mac HFS                252362760  253632295    1269536
 4 P Mac HFS                271894024  273163559    1269536
 5 P MS Data                273164288  312580095   39415808 [BOOTCAMP]
write!
file_nopwrite(5,32,buffer,2(2/0/1)) write refused

Partition: Write error
 
rEfit Partition Inspector results:

Code: Select all

*** Report for internal hard disk ***

Current GPT partition table:
 #      Start LBA      End LBA  Type
 1             40       409639  EFI System (FAT)
 2         409640    252100615  Mac OS X HFS+
 3      252362760    253632295  Mac OS X HFS+

Current MBR partition table:
 # A    Start LBA      End LBA  Type
 1              1    312581807  ee  EFI Protective

MBR contents:
 Boot Code: Unknown, but bootable

Partition at LBA 40:
 Boot Code: None (Non-system disk message)
 File System: FAT32
 Listed in GPT as partition 1, type EFI System (FAT)

Partition at LBA 409640:
 Boot Code: None
 File System: HFS Extended (HFS+)
 Listed in GPT as partition 2, type Mac OS X HFS+

Partition at LBA 252362760:
 Boot Code: None
 File System: HFS Extended (HFS+)
 Listed in GPT as partition 3, type Mac OS X HFS+
Thanks for your time and attention

--
Fabiano

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Can't recover Bootcamp partition

#2 Post by Fiona »

Did you run TestDisk as root, like

Code: Select all

sudo ./testdisk
from its path

Code: Select all

cd ~/Desktop/testdisk-6.14
?
If you have an Intel-Mac you should use partition table type EFI GPT.
Also Info;
http://www.cgsecurity.org/wiki/OS_Notes ... 28Intel.29
Have a retry to see ift it works for you?

Fiona

fkseki
Posts: 5
Joined: 29 Apr 2012, 03:22

Re: Can't recover Bootcamp partition

#3 Post by fkseki »

I tried doing sudo ./testdisk but it still gives me the "Write access for this media is not available"

I'm choosing partition table type EFI GPT, the only problem seems to be the writing process

thanks

fkseki
Posts: 5
Joined: 29 Apr 2012, 03:22

Re: Can't recover Bootcamp partition

#4 Post by fkseki »

When I tried pdisk, this is what I got...

Code: Select all

sudo pdisk /dev/disk0
pdisk: No valid block 1 on '/dev/disk0'
Edit /dev/disk0 -
Command (? for help): c
No partition map exists
Command (? for help): i
pdisk: can't open file '/dev/disk0' for writing  (Resource busy)
I'm thinking I have to be using a Ubuntu from USB or something like that?

Which one should I try to fix? /dev/disk0 or /dev/rdisk0 ?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Can't recover Bootcamp partition

#5 Post by Fiona »

Have a try to use rdisk!

Fiona

fkseki
Posts: 5
Joined: 29 Apr 2012, 03:22

Re: Can't recover Bootcamp partition

#6 Post by fkseki »

Got the same error message.

pdisk: can't open file '/dev/rdisk0' for writing (Resource busy)

fkseki
Posts: 5
Joined: 29 Apr 2012, 03:22

Re: Can't recover Bootcamp partition

#7 Post by fkseki »

Great news!
I've downloaded Ubuntu, put it in a USB drive and used it to restart in it.
In it's terminal I've used parted to write the start and end of the partition I wanted to restore (the numbers I previously got from using TestDisk) and it could write normally! Everything is fine now!

Many thanks, Fiona!

Cheers
--
Fabiano

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Can't recover Bootcamp partition

#8 Post by Fiona »

Pdisk souldn't be used on an Intel MAC.
Infos from TestDisk Wiki;
Note: pdisk is for the Mac PowerPC partition table, not for the Mac Intel partition table.
Last sentence on this page;
http://www.cgsecurity.org/wiki/OS_Notes ... tition_Map
Thanks for your infos that you were able to solve your problem using Ubuntu! :)
I'll set your topic as solved.

Locked