Lost the ability to boot to Mac partition
An EFI boot manager utility
Status: Beta
Brought to you by:
srs5694
Menu
▾
▴
I have a 2011 Macbook pro with OS X 10.13 installed I was reading a how to on dual booting the Mac with Ubuntu. I followed the directions to install refind from OS X. I was able to boot to my Ubuntu 20.04 usb stick and install Ubuntu. When the Mac restarts I get an error failed to set MoklistRT: invalid parameter Could not create MoklistRT: invalid parameter. The Mac then boots up to Ubuntu 20.04. I would like to be able to get the OS X partition to show as a boot option. I tried downloading refind from Ubuntu which gave me a refind boot option once but the Mac OS was not an option. Refind is the most current version
My suspicion is that your Ubuntu installation has wiped out your macOS installation. It could be something less dire, but if rEFInd isn't detecting macOS, then the most likely explanation is that macOS is no longer installed. From Ubuntu, try typing:
sudo parted -lPost the results back here (they may be long), and I'll be able to interpret them.
john@John-MacBookPro:~$ sudo parted -l
[sudo] password for john:
Model: ATA SATA SSD (scsi)
Disk /dev/sda: 480GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 20.5kB 210MB 210MB fat32 EFI System Partition boot, esp
2 210MB 240GB 240GB ext4
3 240GB 480GB 240GB hfs+
Enter the Startup Manager (hold Option key at boot). What do you see?
If it shows macOS, select that and boot.
Or, you can hold the Control key while in the Startup Manager (changes the up arrow to a circular arrow) and press Return to set the currently selected item as the default boot (and it starts booting).
It seems that installing Ubuntu may change the default boot. The
gfxutil.shscript at https://gist.github.com/joevt/477fe842d16095c2bfd839e2ab4794ff has a commanddumpallbootvarsthat can be used to examine nvram boot variables in macOS. If you want rEFInd to be the default boot, then you will probably need to usesudo bless --mount pathtoefi --file pathtorefind.efi --setBootYou have a 2011 MacBook Pro. Did you install Ubuntu using legacy BIOS mode or EFI mode? 2011 is new enough to be able to boot Ubuntu using EFI.
If you can boot into macOS, the
dumpvols.shscript at https://gist.github.com/joevt/a99e3af71343d8242e0078ab4af39b6c can get all info for your partitions to help diagnose boot issues (especially with legacy BIOS boot).The
DiskUtil.shscript athttps://gist.github.com/joevt/6d7a0ede45106345a39bdfa0ac10ffd6 has a command
mountEFIpartitionsthat can be used to mount all EFI partitions so you can examine which ones contain booters. It also has commands for creating multi-line disk labels that appear in the Startup Manager, fixing custom icon flags (for when you don't use the Finder to create a .VolumeIcon.icns file), and other commands.Thanks for the help. When I go to startup manager I just see hard disk that says efi boot. I tried the control key and enter key I got the refind menu with 2 options that looked like different paths but they both booted to Ubuntu. The refind I see is looks like the one I installed from inside Ubuntu after the Mac refind disappeared. I turned off the Mac when I was at the refind menu by holding down the power button, I wanted to restart and write exactly what I saw on the 1st screen in the startup manager. Now when I hold down the the option key for startup manager I just get error failed to set MoklistRT: invalid parameter Could not create MoklistRT: invalid parameter. Then it continues to boot into Ubuntu. I didn't do anything to setup bios mode so I believe it's booting in EFI mode. I can see from the script info you posted in your response you skill level is well above mine. What do you recommend I do next.
Your
partedoutput shows you definitely have a Mac partition, but that command doesn't verify what's on the partition. I recommend you first try to verify that the filesystem is HFS+ (aspartedis reporting) by usingblkid:sudo blkid /dev/sda3If it's HFS+, the output will include
TYPE="hfsplus". Recent versions of macOS have migrated from HFS+ to a new filesystem called APFS. This will show up asTYPE="apfs". As I said,partedis reporting it's HFS+, so that's probably what it is; this step is simply meant to double-check that detail, since knowing the filesystem in use is critical to recovering.If the partition is HFS+, you could try mounting it in Ubuntu (with
sudo mount /dev/sda3 /mnt); but that might fail for any of a number of reasons, so if it fails, it's not really diagnostic. (Although an error message might provide some clues.) If it works, you might learn something about what went wrong. For instance, if the filesystem is empty or is obviously a data partition rather than a system partition, then that explains the problem.If the filesystem mounts OK and looks like a system partition, then you can try searching for EFI boot files:
sudo find /mnt -iname "boot*efi"This command is likely to take a few minutes to complete. A bootable macOS installation should include a file called
boot.efisomewhere, probably inSystem/Library/CoreServices; but Apple has changed the location of this file from time to time. This command may also locate some other EFI files, like the unzipped files from the rEFInd package, if you unpacked rEFInd in macOS and didn't delete the original files. If you can't find theboot.efifile, then that explains why rEFInd isn't showing a macOS boot option. If it's present, and where it should be, then it could be that the file is damaged or unreadable.Another possibility is filesystem damage. It's possible to do a filesystem check (and repair) on the HFS+ partition from Linux, and that might help. Before doing this, be sure to unmount the filesystem (with
sudo umount /dev/sda3). The relevant filesystem check command isfsck.hfsplus:fsck.hfsplus /dev/sda3I recommend caution when doing this, though; I don't know what would happen if you were to use that command on an APFS volume, for instance. Also, if the filesystem is badly damaged, then a repair attempt poses a small risk of making matters worse. Thus, I STRONGLY recommend that you back up critical user data before doing anything like this, assuming you can mount the filesystem and read its data.
The
MoklistRTmessages you see when you boot are not a concern. They're probably being produced by Shim, which is used by most Linux distributions to deal with Secure Boot. Your Mac is old enough to not support Secure Boot, so Shim is just a useless (but harmless) step in your boot process.Here is what I got
john@John-MacBookPro:~$ sudo blkid /dev/sda3
[sudo] password for john:
/dev/sda3: UUID="fad40143-455d-3953-9ff8-2504c1d49c65" LABEL="Untitled" TYPE="hfsplus" PARTUUID="85990e70-fdc6-40c8-a6c3-20082a3a8366"
john@John-MacBookPro:~$
john@John-MacBookPro:~$ sudo mount /dev/sda3/mnt
mount: /dev/sda3/mnt: can't find in /etc/fstab.
john@John-MacBookPro:~$ fsck.hfsplus /dev/sda3
Can't open /dev/sda3: Permission denied
You missed a space between
/dev/sda3and/mntinsudo mount /dev/sda3 /mnt.I forgot to specify
sudowithfsck.hfsplus; you need the elevated privileges provided bysudowith that command. That said, as I noted earlier, I recommend you wait to further check out the filesystem before you attempt a filesystem check on it.Here is what I got
john@John-MacBookPro:~$ sudo blkid /dev/sda3
[sudo] password for john:
/dev/sda3: UUID="fad40143-455d-3953-9ff8-2504c1d49c65" LABEL="Untitled" TYPE="hfsplus" PARTUUID="85990e70-fdc6-40c8-a6c3-20082a3a8366"
john@John-MacBookPro:~$
john@John-MacBookPro:~$ sudo mount /dev/sda3/mnt
mount: /dev/sda3/mnt: can't find in /etc/fstab.
I fixed the mount command and the command completed. I don't see any disk mounted from caja. I'm not very handy with the command line.
I'm afraid I'm not very familiar with caja, so I can't provide detailed directions; but if the
mount /dev/sda3 /mntcommand worked, then you should see the contents of/dev/sda3under the/mntdirectory. Typingls /mntat a command-line should get you started; and it should be possible to browse to/mntfrom a GUI file manager.Caja is a graphical file browser for the MATE desktop. Usually when I mount a drive I can see it in the graphical file browser. I don't see anything. When I look under /mnt in terminal or graphically I don't see anything.
Try
df /mnt. It should show output like this:The key point here is that it should show
/mntunder theMounted oncolumn. If instead it shows/, then despite themountcommand appearing to work, it didn't. Usuallymountcomplains when something goes wrong, so you might try again but keep a closer eye out for errors.If
dfdoes show that the partition is properly mounted, and you still can't see any files there withlsor a file manager, then something may be wrong. Check the size (1K-blocks,Used, andAvailable) columns in thedfoutput, and/or theUse%column. If the disk is nearly unused, then it could be the partition has been wiped out; or maybe there's filesystem damage or the Linux HFS+ drivers might just be getting it wrong. If the disk is shown with a use percentage that seems roughly correct based on your memory, then something is hiding the files from view. This could be filesystem damage or just a weird HFS+ variant that the Linux drivers aren't handling correctly. (The latter used to be common, but I thought Linux's HFS+ drivers were well past that. Maybe not, though.)This is what I got
df /mnt
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda3 234126744 304956 233821788 1% /mnt
ls -lA /mntwill show hidden files. An empty HFS+ partition should have stuff like this:If you had a second Mac, you could boot the MacBook Pro 2011 in Target Disk Mode (FireWire or Thunderbolt?), connect to the other Mac,
https://support.apple.com/en-ca/guide/mac-help/mchlp1443/mac
then do diagnostics from there (the
dumpvols.shandDiskUtil.shscripts at least).It seems strange that the disk only has three partitions. Could it be that the OS X partition was at partitition 2 and Ubuntu was installed over it? If partition 3 was OS X, it would usually be followed by a Recovery HD partition.
The gpt fdisk command
gdiskcan show the gpt partition labels - maybe that can give more clues.Last edit: joevt 2021-02-14
Here is the results
ls -lA /mnt
total 24580
drwx------ 1 root 80 17 Feb 1 17:11 .fseventsd
dr-xr-xr-t 1 root root 2 Jan 24 19:19 '.HFS+ Private Directory Data'$'\r'
---------- 1 root root 25165824 Jan 24 19:19 .journal
---------- 1 root root 4096 Jan 24 19:19 .journal_info_block
drwx------ 1 root 80 5 Jan 24 19:45 .Spotlight-V100
d-wx-wx-wt 1 root root 2 Feb 1 17:11 .Trashes
That doesn't look like a macOS root partition to me. Here's mine:
(Note that I specified
/, not/mnt, because it was from a running system.) The macOS root (/) partition should have a bunch of standard Unix directories like/usr,/opt, and/bin, as well as macOS-specific directories like/Systemand/Users. Yours has none of those, which makes me think it's empty, a data partition, or something I don't understand. That last is a very real possibility -- I'm more of a Linux person than a Mac person, so I may be missing something. That said, yourdfoutput also said the partition was only 1% occupied (about 300 MiB, which could be nothing but overhead), which also is not a good sign.That said, the
.HFS+ Private Directory Data'$'\rdirectory might hold something. I know that Apple's LVM configurations put filesystems inside things that look like subdirectories in some cases. I don't think that directory matches the naming conventions, but maybe I'm wrong about that. You might try looking inside that directory. It's got a weird name, so I'd use shell tab completion to enter the name -- that is, typels -lA /mnt/.HFSand then hit the Tab key. The rest of the name should complete (with some characters preceded by a backslash (\) -- don't try to edit those out). Then press Enter and you should see the contents of that directory. I expect it to be empty, but if you see files or directories you recognize, they're worth further investigation.If I'm right, then your macOS installation has been wiped out, although somehow you ended up with an empty HFS+ volume. Your best hope for recovery is to restore your data from a backup. If you don't have a backup, and if you had valuable data on the partition, then you'll have to resort to data recovery tools like PhotoRec. Note, however, that PhotoRec is a cross-platform tool. There's almost certainly a more Mac-specific tool that's better suited to recovering files from an HFS+ volume, but I don't know what it is. (You might try asking for recommendations on a Mac forum.) If you are forced to go this route, you should immediately stop using the disk -- even the Linux partition, since it's occupying space formerly occupied by macOS, and every time you write to it, you run the risk of damaging the remnants of your old files. You'll also need a spare disk onto which to copy recovered files. This will be a tedious and time-consuming process. It will almost certainly not recover macOS to a bootable state, so don't even try that; it's useful only for recovering otherwise irreplaceable files (personal photos, work documents, etc.). It likely won't recover all of those files, either, but with luck you'll be able to recover a lot of them. Once you've recovered files, you can re-install macOS.
I'm sorry it has taken so long to get back to you. I agree the partition
looks wiped out and empty. I will reinstall Mac OS
On 2/16/21 6:52 AM, Roderick W. Smith wrote:
Thank you for all the help you gave me.
On 2/16/21 6:52 AM, Roderick W. Smith wrote:
Some info about the private directory at https://apple.stackexchange.com/questions/31734/hfs-private-directory-data
Apple adds
\rto some invisible files/folders to make it less likely that someone will try to make a file with that name.In macOS, making a directory with that name in the root of a HFS+ volumes gives an error
mkdir '.HFS+ Private Directory Data'$'\r'The only other file I know ending in
\ris the folder custom icon fileIcon$'\r'that you can create using the Finder.Thanks for all you help. The partition is empty I will reinstall Mac OS.
On 2/17/21 6:51 AM, joevt wrote: