How to safely recover my High Sierra GUID partition that has become FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF after deleting Kubuntu partition?

Question

I got a 2011 mac mini with High Sierra on it few years ago and installed bootcamp, then 10.7, then linux (kubuntu). After running out of space in high sierra and windows, I decided to delete the linux partition and expanded the 10.7 partition. Now it will only boot into windows or 10.7 by holding option key, HS doesn't show up in boot manager.

My questions are: Can I fix this from where I'm now, booted into 10.7 (Lion)? Or do I have to go into its recovery mode?

It boots into Lion recovery, not high Sierra recovery, and I'm not able to make a HS boot disk because the app store requires me to have 10.8 to download it, but I don't want to upgrade due to several audio unit plugins that will become incompatible and I've just read a lot of bad things about mountain lion.

If it can be fixed using ubuntu, I would assume it could be done from 10.7, I just was afraid it would screw up because 10.7 doesn't know what APFS is.

My other option is to follow instructions on how to fix it via the Ubuntu live environment,

This is my partition layout:

$ diskutil list
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.1 GB   disk0
   1:                        EFI                         209.7 MB   disk0s1
   2: FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF               150.0 GB   disk0s2
   3:       Microsoft Basic Data BOOTCAMP                100.3 GB   disk0s3
   4:                  Apple_HFS Legacy                  249.4 GB   disk0s4

$ sudo gpt -r show disk0
Password:
gpt show: disk0: Suspicious MBR at sector 0
      start       size  index  contents
          0          1         MBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6         
         40     409600      1  GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640  292968736      2  GPT part - FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
  293378376       1720         
  293380096  195991552      3  GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
  489371648       1696         
  489373344  487137640      4  GPT part - 48465300-0000-11AA-AA11-00306543ECAC
  976510984     262151         
  976773135         32         Sec GPT table
  976773167          1         Sec GPT header

Why does it say "Suspicious MBR at sector 0"??

Also:

$ sudo fdisk  /dev/disk0
Password:
Disk: /dev/disk0    geometry: 60801/255/63 [976773168 sectors]
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE 1023 254  63 - 1023 254  63 [         1 -     409639] <Unknown ID>
 2: DA 1023 254  63 - 1023 254  63 [    409640 -  292968736] <Unknown ID>
*3: 0C 1023 254  63 - 1023 254  63 [ 293380096 -  195991552] Win95 FAT32L
 4: AF 1023 254  63 - 1023 254  63 [ 489373344 -  487137640] HFS+

I understand this may be perceived as a duplicate but I am unsure of some instructions on other posts, as my mac OS High Sierra is on disk0s2, and I don't want to mess it up.

I believe this is a duplicate of Unable to boot into Mac OSX after updating dual-boot Ubuntu, Partition Type FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, except here Kubuntu was employed instead of Ubuntu. Since the OP disclosed the existence of a Live Ubuntu in a comment to a now deleted answer, this answer can be used. — David Anderson, Jul 28 '21 at 19:33
Skynetaroo: I was unaware that the OP can not see deleted answers to their own questions. (FYI, users above a reputation of 10,000 can see all deleted answers.) I did post that I deleted the answer so you would know who did it. I see you want to see the answer so I will undelete. — David Anderson, Jul 28 '21 at 20:06

David Anderson · Answer 1 · 2021-07-29T01:03:14.200

Your questions and my answers are below.

Can I fix this from where I'm now, booted into 10.7 (Lion)?

I believe this is possible using a third party tool call GPTfdisk (gdisk). You probably would have to download an older version of this command.

Note: I do not have a machine which is running Lion. I did verify that the gdisk-0.8.0.pkg file can be downloaded from here and be used to install a working gdisk in Snow Leopard (OS X 10.6.8). However, for Mavericks (OS X 10.9.5) version 0.8.0 of gdisk did not work. Instead, I used version 1.0.0.

Once installed, the following can be entered in a Terminal application window to change the partition type in the GPT. Here, I assume High Sierra is installed in an APFS container partition.

    sudo gdisk /dev/disk0
    t
    2
    7C3457EF-0000-11AA-AA11-00306543ECAC
    w
    y
If High Sierra was installed in a legacy formatted JHFS+ partition, then you should enter the following.
sudo gdisk64 /dev/disk0
t
2
af00
w
y


If you are unsure which to use, then try both.

Or, do I have to go into its recovery mode?

Early forms of OS X Recovery were USB flash drive based. This was eventually replaced by either USB flash drive OS X Installers or Internet Recovery. If you can boot to one of these forms and open a Terminal application window, then the following commands can be used to change the partition type in the GPT. Here, I assume High Sierra is installed in an APFS container partition.
```
 diskutil unmountdisk disk0
 gpt remove -i 2 /dev/disk0
 diskutil unmountdisk disk0
 gpt add -i 2 -b 409640 -s 292968736 -t 7C3457EF-0000-11AA-AA11-00306543ECAC /dev/disk0
```
If High Sierra was installed in a legacy formatted JHFS+ partition, then you should enter the following.
```
 diskutil unmountdisk disk0
 gpt remove -i 2 /dev/disk0
 diskutil unmountdisk disk0
 gpt add -i 2 -b 409640 -s 292968736 -t 48465300-0000-11AA-AA11-00306543ECAC /dev/disk0
```
If you are unsure which to use, then try both.
Why does it say "Suspicious MBR at sector 0"?

The output from fdisk shows the drive to be hybrid partitioned. The message "Suspicious MBR at sector 0" is normal output from gpt when a drive is hybrid partitioned.

Below are instructions for fixing the problem from Windows.

Boot to Windows.
Use your web browser to download GPTfdisk to your Downloads folder. The file name should be gdisk-windows-1.0.8.zip.
Extract the contents of gdisk-windows-1.0.8.zip to the folder gdisk-windows-1.0.8.zip in your Downloads folder.
Open a "Administrator: Command Prompt" window. In other words, open "Command Prompt" using "Run as Administrator".
Enter the following command to change to the directory containing gdisk64.exe.
```
cd /d "%homepath%\Downloads\gdisk-windows-1.0.8
```
Enter the following to change the partition type in the GPT. Here, I assume High Sierra is installed in an APFS container partition.
```
gdisk64 0:
t
2
af0a
w
y
```
If High Sierra was installed in a legacy formatted JHFS+ partition, then you should enter the following.
```
gdisk64 0:
t
2
af00
w
y
```
If you are unsure which to use, then try both.

Ok, thanks, but I'm wondering if I should specify in the commands that it is disk0s2 , the sierra partition? Look at the output I listed, the result of diskutil list.
The computer came with just High Sierra. I had added windows via bootbamp, then mac 10.7, then Kubuntu. All was working until I deleted the Linux partition — Skynetaroo, Jul 28 '21 at 17:23
The 0 in disk0s2 indicates the the drive has been assigned the identifier disk0. Since there is only one drive, this is not surprising. Both macOS and Windows assign drive numbers starting with 0. Normally, macOS stores partitions in the GUID Partition Table (GPT) in ascending order. The 2 in disk0s2 indicates the partition with the problem is the second partition stored in the GPT. The entries in the GPT are numbered starting with 1, where as the drives are numbered starting with 0. — David Anderson, Jul 28 '21 at 17:50
In my answer, the drive is specified either as disk0, /dev/disk0 or 0:. The partition is specified by the number 2. None of the commands will accept the drive and partition being specified as the singe identifier disk0s2. — David Anderson, Jul 28 '21 at 17:54
Oh, okay, great, so I will proceed by using the method or restarting in recovery mode by holding down command R. I trust mac to fix mac, although I guess it should be fine to do it using a ubuntu live disk, but I don't think I'd be able to do it via my 10.7 installation as it's on the disk that will need to be unmouted, according to the commands, as well as would not be able to do it via windows, as the disk is mounted, running windows via bootcamp. — Skynetaroo, Jul 28 '21 at 18:02
The gdisk command has the ability to use a shared lock. In my answer, I assume when gdisk is used with Lion or Windows a shared lock will be employed. When testing with Snow Leopard, Mavericks and Windows 7, a shared lock was successful. This means the drive does not have to be unmounted. Your thought that the drive must be unmount for use with Lion and Windows is not true. — David Anderson, Jul 29 '21 at 00:56

How to safely recover my High Sierra GUID partition that has become FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF after deleting Kubuntu partition?

1 Answers1