Unable to boot into macOS or Ubuntu after dd and partition reduction

Question

I am on an early 2015 MacBook Pro with macOS Sierra, dual boot with Ubuntu 16.04.

In macOS, I did dd if=/dev/disk1s3 of=disk2s2(if i remember correctly). It succeeded and I proceeded to shrink the macOS partition using Disk Utility. That succeeded too. I proceeded to reboot and found myself unable to boot into any systems. Going into recovery mode, I am unable to restore from a backup or reinstall a new macOS.

I see the partitions as they are supposed to be, though their health would be suspect. I have

210mb EFI partition as /dev/sda1 FAT
182GB macOS parition as /dev/sda2 ffffffff-ffff-ffff-ffff-ffffffffffff
30GB free space partition as /dev/sda
30GB Ubuntu PArtition as /dev/sda4 Ext4
4GB Linux Swap as /dev/sda5 Swap

Would anyone know how I could restore things as they are? I am looking to install rEFInd so my MacBook would provide the option without me having to hold the Option key everytime.

diskutil list returns:

/dev/disk0
   #:                   TYPE NAME                SIZE        IDENTIFIER
   0:  GUID_partition_scheme                     *251.0 GB   disk0
   1:                    EFI EFI                 209.7 MB    disk0s1
   2: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF       181.8 GB    disk0s2
   3: 0FC63DAF-8483-4772-8E79-3D69D8477DE4       30.0 GB     disk0s4
   4:                  LINUX SWAP                4.0 GB      disk0s5
/dev/disk1
   #:                   TYPE NAME                SIZE        IDENTIFIER
   0: Apple_partition_scheme                     *1.3 GB     disk0
   1:    Apple_partition_map                     30.7 KB     disk0s1
   2:              Apple_HFS OSX X Base System   1.3 GB      disk0s2
/dev/disk2
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *524.3 KB   disk2
/dev/disk3
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *524.3 KB   disk3
/dev/disk4
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *524.3 KB   disk4 
/dev/disk5
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *524.3 KB   disk5
/dev/disk6
   #:                  TYPE NAME                 SIZE        IDENTIFIER 
   0:                   untitled                 *524.3 KB   disk6
/dev/disk7 
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *6.3 MB     disk7
/dev/disk8
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *2.1 MB     disk8
/dev/disk9
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *1.0 MB     disk9
/dev/disk10
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *524.3 KB   disk10
/dev/disk11
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *524.3 KB   disk11
/dev/disk12  
   #:                  TYPE NAME                 SIZE        IDENTIFIER
   0:                       untitled             *1.0 MB     disk12

Update: removed/destroyed disk0 via gpt. just before I gpt add partitions back.

    /dev/disk0
   #:                   TYPE NAME                SIZE        IDENTIFIER
   0:  FDisk_partition_scheme                    *251.0 GB   disk0
   1:                    0xEE                    209.7 MB    disk0s1
   2:                    0xDA                    181.8 GB    disk0s2
   3:                   Linux                    30.0 GB     disk0s4

Update 2: Adding back the partitions. (I neglected adding back -i 3 and -i 2 respectively)

    start        size        index        contents
        0           1                     PMBR
        1           1                     Pri GPT header
        2          32                     Pri GPT table
       34           6               
       40      409600            1        GPT part - C12A7328.....
   409640   226802864            3        GPT part - 5374GF72.....
227212504     1269536            2        GPT part - 426F6F74.....
228482040   261752679              
490234719          32                     SEC GPT table
490234751           1                     SEC GPT header

Look at this answer it may lead you in the right direction. Cheers! — bjbk, Nov 28 '17 at 14:24
@bjbk Thanks for that link! It's really insightful. I'd need more help before I can customise that solution for my problem. So all my partitions except the macOS partition are intact and healthy. The macOS partition is corrupted somehow? That dosent explain why I wouldnt be able to boot into Ubuntu since my EFI partition is outside the macOS one. — EraserPencil, Nov 28 '17 at 14:51
@David would you be able to give more detailed steps? I don’t see where in gdisk I can change UUID, only GUID. I’m still learning my LPIC-101 exams hence still rough around the edges. Alternatively, an apple-centric solution would be great too. — EraserPencil, Nov 29 '17 at 01:11
This is the better answer: Data Not Backed Up, Partition Type: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF than the one linked in bjbk's comment. Compared to my answer there, you have to remove disk0s2 only and re-add it properly. — klanomath, Nov 29 '17 at 04:13
@klanomath Hahaha. Looks like I have messed up something between posting the two outputs. How would I go about backing up my machine before removing any partitions (If possible at all) — EraserPencil, Nov 29 '17 at 04:48
Removing a partition and re-adding it with the proper type (and previous sizes) with gpt only alters the partition table. The content of the partition won't be deleted. — klanomath, Nov 29 '17 at 04:52
There was an instruction that involves destruction. Could you educate on what that does? Instruction in question: dd if=/dev/disk0s2 count=3 | vis -c — EraserPencil, Nov 29 '17 at 04:54
It's similar to a hexdump (which isn't available in recovery mode). It reads the first 3 blocks of disk0s2 and pipes it to vis. The output is more or less human readable. The purpose is to detect the correct partition type: either CoreStorage or HFS+ Journaled. Depending on the result of dd|vis different commands + options have to be executed to reinstate your macos volume. — klanomath, Nov 29 '17 at 05:01
@klanomath
On gpt remove -i 3 disk0 I had the error: Suspicious MBR at sector0. diskutil umount disk0s0 returned Unmount failed for disk0s0. – EraserPencil 9 hours ago — EraserPencil, Nov 29 '17 at 15:32
There is nothing like a disk0s0 - nowhere in macOS disk management! Please read the answers/instructions more thoroughly! The proper command to unmount a disk is diskutil umountDisk disk0 and to unmount a volume/partition diskutil umount disk0s2. — klanomath, Nov 29 '17 at 16:21
@klanomath Yea! diskutil umountDisk disk0 was sucessful, gpt remove -i 3 disk0 gave: Suspicious MBR at sector 0. Since it was an error not listed in the provided solution, I interpretated it as "if I get an error message, unmount the disk again or unmount stubborn volumes with diskutil umount disk0sX" in a desperate vain attempt. — EraserPencil, Nov 29 '17 at 16:29
The suspicious MBR was installed by Ubuntu/grub or whatever. It shouldn't matter in the first place. It can be fixed in a second step like in this question: How to fix broken GPT, GUID and unmountable, no type volumes? — klanomath, Nov 29 '17 at 16:33
@klanomath I think I'm on my way to sucessfully restore everything. This is a little extra on the top. I've been meaning to install rEFInd instead of GRUB 2 so I wouldnt need to constantly hold the option key to boot into Ubuntu. Do you have any advice on that? — EraserPencil, Nov 29 '17 at 17:17
@klanomath gpt -r show disk0 matches your output on the solution, however diskutil verifyDisk disk0 outputs: Problems were found with the partition map which might prevent booting. Error: -69808: Some information as unavailble during an interval lookup. I proceeded only with you instruction and did not explore rEFInd. Update: I neglected to add "-i 3" and "-i 2" respectively. — EraserPencil, Nov 29 '17 at 17:36
The output of gpt -r show disk0 shouldn't match the output of the answer over there, but your previous gpt -r show disk0 except that the MBR was replaced with a pMBR and the FFFFFF.. partition was replaced with a corestorage or hfs+ partition with the same size as the FFFF partition! — klanomath, Nov 29 '17 at 17:40
@klanomath sounds like I messed up badly. any advice on corrections? — EraserPencil, Nov 29 '17 at 17:50
Yes, install a full macOS and TeamViewer to a thumb drive/external disk and invite me to a remote desktop session. The ffff partition had a size of 181.8 GB (= ~355078125 blocks). Now your mac volume has a size of 226802864 blocks (= ~ 116 GB)! Where did you get those values of your "new" partition? — klanomath, Nov 29 '17 at 17:56
Check the Terminal window(s)/tab(s) by scrolling upwards whether a gpt output of your original disk is still there and post it here! — klanomath, Nov 29 '17 at 17:59
Then the first sentence in my comment 11 minutes ago "... install a full macOS ... thumb drive ..." becomes effective... — klanomath, Nov 29 '17 at 18:08

David Anderson · Answer 1 · 2017-11-29T12:48:18.593

Since you can execute a live version of Ubuntu, you have access to the gdisk command. Once booted to Ubuntu, you will need to open a Terminal window. From the Ubuntu desktop, press the control+option+T keys. A Terminal window should appear, as shown below.

You can confirm partition /dev/sda2 is a possible "Mac OS Extended" (Journaled)" volume by entering the command given below.

sudo  dd  if=/dev/disk1s2  count=3  |  hexdump  -Cv

The output at offset 00000400 should appear similar to what is shown below. What is important find is the characters HFSJ.

00000400  48 2b 00 04 80 00 21 00  48 46 53 4a 00 00 05 4b  |H+....!.HFSJ...K|

The interactive command gdisk can be used to change the type id of a partition. The example below assumes the partition where macOS resides is a single Mac OS Extended (Journaled) volume. The example will change type id for partition 2 to 48465300-0000-11AA-AA11-00306543ECAC. The command to enter is shown below.

sudo  gdisk  /dev/sda

The interactive input/output is shown below.

GPT fdisk (gdisk) version 1.0.0

Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): t
Partition number (1-5): 2
Current type is 'Unknown'
Hex code or GUID (L to show codes, Enter = AF00): af00
Changed type of partition to 'Apple HFS/HFS+'

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/disk1.
Warning: Devices opened with shared lock will not have their
partition table automatically reloaded!
Warning: The kernel may continue to use old or deleted partitions.
You should reboot or remove the drive.
The operation has completed successfully.

Note: You can set the default boot volume by holding down the control key before selecting the icon shown in the Mac Startup Manager.

Hey! Thanks a lot for that solution. However, my live linux can't detect wifi for some reason, but I don't wanna troubleshoot that now. Is there something we could do from the Internet Recovery Mode? I really hate popping by an Apple store cause I know I will lose my laptop for sure. — EraserPencil, Nov 29 '17 at 04:09

Unable to boot into macOS or Ubuntu after dd and partition reduction

1 Answers1