cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Testdisk "Unable to open file or device ...: Permission deni

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=3765

Page 1 of 1

Testdisk "Unable to open file or device ...: Permission deni

Posted: 14 May 2014, 15:26
by Alfredo
Hi,

I would like to thank the author for making these awesome tools available. I have used them at one point or another, most often to recover photos from unsavvy users who learn to make backups the hard way (well some don't, but that's another story)

Today I am trying to recover files from a broken small Windows server, but I get the following error:

Code: Select all

alfredo$ testdisk /Volumes/Things/server.img
TestDisk 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device /Volumes/Things/server.img: Permission denied
A simple permissions problem, I hear you say. However, permissions are enough on the file:

Code: Select all

-r--------  1 alfredo  staff  36762501901  6 mar 20:30 /Volumes/Things/server.img
As is easily tested by reading some of the file with another command:

Code: Select all

alfredo$ strings /Volumes/Things/server.img | head -1
header2
I have tried to:
  • Change file permissions to 666
  • Move the file to another volume
  • Remove extended attributes from the file
  • Use Photorec instead of TestDisk
  • Use another TestDisk/PhotoRec version, v6.40 instead of 7.0
And I'm out of ideas.

To add to my confusion, another image from the same source has been processed just fine.

This is on a Macbook Pro with the latest OS:
Darwin MacBook-Pro-de-Alfredo.local 13.1.0 Darwin Kernel Version 13.1.0: Wed Apr 2 23:52:02 PDT 2014; root:xnu-2422.92.1~2/RELEASE_X86_64 x86_64

Any ideas welcome!

Re: Testdisk "Unable to open file or device ...: Permission

Posted: 14 May 2014, 17:26
by cgrenier
Can you strace testdisk 7.0-WIP on this file and post the output ?

Re: Testdisk "Unable to open file or device ...: Permission

Posted: 14 May 2014, 17:45
by Alfredo
Darwin has dtruss, is this useful?

Code: Select all

MacBook-Pro-de-Alfredo:Things alfredo$ sudo dtruss photorec server.img
Password:
PhotoRec 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device server.img: No such file or directory
SYSCALL(args) 		 = return
thread_selfid(0x0, 0x0, 0x0)		 = 10186812 0
csops(0x0, 0x0, 0xBFFFF384)		 = 0 0
issetugid(0x0, 0x0, 0xBFFFF384)		 = 0 0
shared_region_check_np(0xBFFFD310, 0x0, 0xBFFFF384)		 = 0 0
stat64("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0xBFFFE558, 0xBFFFF384)		 = 0 0
open("/dev/dtracehelper\0", 0x2, 0xBFFFF2E0)		 = 3 0
ioctl(0x3, 0x80086804, 0xBFFFF270)		 = 0 0
close(0x3)		 = 0 0
issetugid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
geteuid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
__sysctl(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
issetugid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
getuid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0x20)		 = 3 0
__sysctl(0xBFFFD5E4, 0x2, 0xA0B0C434)		 = 0 0
fstatfs64(0x3, 0xBFFFD638, 0xA0B0C434)		 = 0 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 2000 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/Contents\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Resources\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Support Files\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin\0", 0xBFFFE390, 0x1000)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0xBFFFD608)		 = 3 0
fstatfs64(0x3, 0xBFFFD628, 0xBFFFD608)		 = 0 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 2000 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/photorec\0", 0xBFFFE1F8, 0x1000)		 = 0 0
open("/usr/local/bin/photorec\0", 0x0, 0x1FF)		 = 3 0
read(0x3, "\316\372\355\376\a\0", 0x200)		 = 512 0
close(0x3)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Heimdal\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/GSS\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/Versions/A/GSS\0", 0xBFFFDE80, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/liblangid.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/libCRFSuite.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/usr/lib/system/libkxld.dylib\0", 0xBFFFD6D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth\0", 0xBFFFD6C8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement\0", 0xBFFFD658, 0x200)		 = 0 0
stat64("/usr/lib/libxslt.1.dylib\0", 0xBFFFD798, 0x200)		 = 0 0
open("/dev/dtracehelper\0", 0x2, 0x9000894F)		 = 3 0
ioctl(0x3, 0x80086804, 0xBFFFECC0)		 = 0 0
close(0x3)		 = 0 0
sigaction(0x2, 0xBFFFFAD0, 0x0)		 = 0 0
sigaction(0x1, 0xBFFFFAD0, 0x0)		 = 0 0
getrlimit(0x1008, 0xBFFFF3E8, 0x0)		 = 0 0
fstat64(0x1, 0xBFFFF3B0, 0x0)		 = 0 0
ioctl(0x1, 0x4004667A, 0xBFFFF418)		 = 0 0
write_nocancel(0x1, "PhotoRec 7.0-WIP, Data Recovery Utility, April 2014\n\0", 0x34)		 = 52 0
write_nocancel(0x1, "Christophe GRENIER <grenier@cgsecurity.org>\n\0", 0x2C)		 = 44 0
write_nocancel(0x1, "http://www.cgsecurity.org\n\0", 0x1A)		 = 26 0
open_nocancel("server.img\0", 0x20800, 0x0)		 = 3 0
fstat(0x3, 0xBFFFFA68, 0x0)		 = 0 0
read_nocancel(0x3, "EVF\t\r\n\377\0", 0x200)		 = 512 0
close_nocancel(0x3)		 = 0 0
write_nocancel(0x1, "\n\0", 0x1)		 = 1 0
write_nocancel(0x1, "Unable to open file or device server.img: No such file or directory\n\0", 0x44)		 = 68 0
__sysctl(0xBFFFED38, 0x2, 0xBFFFED44)		 = 0 0
thread_selfid(0xBFFFED38, 0x2, 0xBFFFED44)		 = 10186812 0
bsdthread_register(0x90275CD0, 0x90275CB0, 0x1000)		 = 0 0
mprotect(0x23C000, 0x44, 0x1)		 = 0 0
mprotect(0x23E000, 0x1000, 0x0)		 = 0 0
mprotect(0x24A000, 0x1000, 0x0)		 = 0 0
mprotect(0x24B000, 0x1000, 0x0)		 = 0 0
mprotect(0x257000, 0x1000, 0x0)		 = 0 0
mprotect(0x258000, 0x1000, 0x1)		 = 0 0
mprotect(0x23C000, 0x44, 0x3)		 = 0 0
mprotect(0x23C000, 0x44, 0x1)		 = 0 0
getpid(0x23C000, 0x44, 0x1)		 = 93662 0
__mac_syscall(0x99AF3EE7, 0x2, 0xBFFFEBF8)		 = 0 0
stat64("/AppleInternal\0", 0xBFFFEC78, 0xBFFFEBF8)		 = -1 Err#2
audit_session_self(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 4099 0
geteuid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getegid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getaudit_addr(0xBFFFEBE0, 0x30, 0xBFFFEBF8)		 = 0 0
csops(0x16DDE, 0x7, 0xBFFFE7F4)		 = -1 Err#22
open("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x0, 0x0)		 = 3 0
pread(0x3, "\312\376\272\276\0", 0x1000, 0x0)		 = 4096 0
pread(0x3, "\316\372\355\376\a\0", 0x1000, 0x7000)		 = 4096 0
fcntl(0x3, 0x3D, 0xFFFFFFFFBFFFCA40)		 = 0 0
mmap(0x235000, 0x2000, 0x1, 0x12, 0x3, 0x7000)		 = 0x235000 0
mmap(0x237000, 0x1000, 0x3, 0x12, 0x3, 0x9000)		 = 0x237000 0
mmap(0x238000, 0x2030, 0x1, 0x12, 0x3, 0xA000)		 = 0x238000 0
close(0x3)		 = 0 0
stat64("/usr/lib/libncurses.5.4.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libz.1.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libiconv.2.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libSystem.B.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/system/libcache.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcommonCrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcompiler_rt.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcopyfile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcorecrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdispatch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdyld.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libkeymgr.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/liblaunch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libmacho.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libquarantine.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libremovefile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_asl.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_blocks.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_c.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_configuration.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_dnssd.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_info.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_kernel.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_m.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_malloc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_network.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_notify.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_platform.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_pthread.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_sandbox.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunwind.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libxpc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Security.framework/Versions/A/Security\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libheimdal-asn1.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libsqlite3.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libresolv.9.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libicucore.A.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libbsm.0.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libobjc.A.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libauto.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libxar.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libpam.2.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libOpenScriptingUtil.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++abi.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libDiagnosticMessagesClient.dylib\0", 0xBFFFDE28, 0x1)		 = 0 0
stat64("/usr/lib/libbz2.1.0.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libxml2.2.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration\0", 0xBFFFDFD8, 0x1)		 = 0 0
getpid(0x97A70B44, 0xBFFFDFD8, 0x1)		 = 93662 0

Re: Testdisk "Unable to open file or device ...: Permission

Posted: 14 May 2014, 17:51
by Alfredo
Oops, I noticed you said testdisk, not photorec. Sorry. Here's a dtruss of testdisk, just in case:

Code: Select all

MacBook-Pro-de-Alfredo:Things alfredo$ sudo dtruss testdisk server.img
TestDisk 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device server.img: No such file or directory
SYSCALL(args) 		 = return
thread_selfid(0x0, 0x0, 0x0)		 = 10201923 0
csops(0x0, 0x0, 0xBFFFF384)		 = 0 0
issetugid(0x0, 0x0, 0xBFFFF384)		 = 0 0
shared_region_check_np(0xBFFFD310, 0x0, 0xBFFFF384)		 = 0 0
stat64("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0xBFFFE558, 0xBFFFF384)		 = 0 0
open("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x0, 0x0)		 = 3 0
pread(0x3, "\312\376\272\276\0", 0x1000, 0x0)		 = 4096 0
pread(0x3, "\316\372\355\376\a\0", 0x1000, 0x7000)		 = 4096 0
fcntl(0x3, 0x3D, 0xFFFFFFFFBFFFCA40)		 = 0 0
mmap(0x1E7000, 0x2000, 0x1, 0x12, 0x3, 0x7000)		 = 0x1E7000 0
mmap(0x1E9000, 0x1000, 0x3, 0x12, 0x3, 0x9000)		 = 0x1E9000 0
mmap(0x1EA000, 0x2030, 0x1, 0x12, 0x3, 0xA000)		 = 0x1EA000 0
close(0x3)		 = 0 0
stat64("/usr/lib/libncurses.5.4.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libz.1.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libiconv.2.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libSystem.B.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/system/libcache.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcommonCrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcompiler_rt.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcopyfile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcorecrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdispatch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdyld.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libkeymgr.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/liblaunch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libmacho.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libquarantine.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libremovefile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_asl.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_blocks.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_c.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_configuration.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_dnssd.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_info.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_kernel.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_m.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_malloc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_network.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_notify.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_platform.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_pthread.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_sandbox.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunwind.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libxpc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Security.framework/Versions/A/Security\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libheimdal-asn1.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libsqlite3.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libresolv.9.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libicucore.A.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libbsm.0.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libobjc.A.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libauto.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libxar.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libpam.2.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libOpenScriptingUtil.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++abi.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libDiagnosticMessagesClient.dylib\0", 0xBFFFDE28, 0x1)		 = 0 0
stat64("/usr/lib/libbz2.1.0.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libxml2.2.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration\0", 0xBFFFDFD8, 0x1)		 = 0 0
getpid(0x97A70B44, 0xBFFFDFD8, 0x1)		 = 93694 0
close(0x3)		 = 0 0
issetugid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
geteuid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
__sysctl(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
issetugid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
getuid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0x20)		 = 3 0
__sysctl(0xBFFFD5E4, 0x2, 0xA0B0C434)		 = 0 0
fstatfs64(0x3, 0xBFFFD638, 0xA0B0C434)		 = 0 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 2000 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/Contents\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Resources\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Support Files\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin\0", 0xBFFFE390, 0x1000)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0xBFFFD608)		 = 3 0
fstatfs64(0x3, 0xBFFFD628, 0xBFFFD608)		 = 0 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 2000 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/testdisk\0", 0xBFFFE1F8, 0x1000)		 = 0 0
open("/usr/local/bin/testdisk\0", 0x0, 0x1FF)		 = 3 0
read(0x3, "\316\372\355\376\a\0", 0x200)		 = 512 0
close(0x3)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Heimdal\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/GSS\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/Versions/A/GSS\0", 0xBFFFDE80, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/liblangid.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/libCRFSuite.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/usr/lib/system/libkxld.dylib\0", 0xBFFFD6D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth\0", 0xBFFFD6C8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement\0", 0xBFFFD658, 0x200)		 = 0 0
stat64("/usr/lib/libxslt.1.dylib\0", 0xBFFFD798, 0x200)		 = 0 0
sigaction(0x2, 0xBFFFFAD0, 0x0)		 = 0 0
sigaction(0x1, 0xBFFFFAD0, 0x0)		 = 0 0
getrlimit(0x1008, 0xBFFFF3E8, 0x0)		 = 0 0
fstat64(0x1, 0xBFFFF3B0, 0x0)		 = 0 0
ioctl(0x1, 0x4004667A, 0xBFFFF418)		 = 0 0
write_nocancel(0x1, "TestDisk 7.0-WIP, Data Recovery Utility, April 2014\n\0", 0x34)		 = 52 0
write_nocancel(0x1, "Christophe GRENIER <grenier@cgsecurity.org>\n\0", 0x2C)		 = 44 0
write_nocancel(0x1, "http://www.cgsecurity.org\n\0", 0x1A)		 = 26 0
open_nocancel("server.img\0", 0x20802, 0x0)		 = 3 0
fstat(0x3, 0xBFFFFA68, 0x0)		 = 0 0
read_nocancel(0x3, "EVF\t\r\n\377\0", 0x200)		 = 512 0
close_nocancel(0x3)		 = 0 0
write_nocancel(0x1, "\n\0", 0x1)		 = 1 0
write_nocancel(0x1, "Unable to open file or device server.img: No such file or directory\n\0", 0x44)		 = 68 0
open("/dev/dtracehelper\0", 0x2, 0xBFFFF2E0)		 = 3 0
__sysctl(0xBFFFED38, 0x2, 0xBFFFED44)		 = 0 0
thread_selfid(0xBFFFED38, 0x2, 0xBFFFED44)		 = 10201923 0
bsdthread_register(0x90275CD0, 0x90275CB0, 0x1000)		 = 0 0
mprotect(0x1EE000, 0x44, 0x1)		 = 0 0
mprotect(0x1F0000, 0x1000, 0x0)		 = 0 0
mprotect(0x1FC000, 0x1000, 0x0)		 = 0 0
mprotect(0x1FD000, 0x1000, 0x0)		 = 0 0
mprotect(0x209000, 0x1000, 0x0)		 = 0 0
mprotect(0x20A000, 0x1000, 0x1)		 = 0 0
mprotect(0x1EE000, 0x44, 0x3)		 = 0 0
mprotect(0x1EE000, 0x44, 0x1)		 = 0 0
getpid(0x1EE000, 0x44, 0x1)		 = 93694 0
__mac_syscall(0x99AF3EE7, 0x2, 0xBFFFEBF8)		 = 0 0
stat64("/AppleInternal\0", 0xBFFFEC78, 0xBFFFEBF8)		 = -1 Err#2
audit_session_self(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 4099 0
geteuid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getegid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getaudit_addr(0xBFFFEBE0, 0x30, 0xBFFFEBF8)		 = 0 0
csops(0x16DFE, 0x7, 0xBFFFE7F4)		 = -1 Err#22
open("/dev/dtracehelper\0", 0x2, 0x9000894F)		 = 3 0
ioctl(0x3, 0x80086804, 0xBFFFECC0)		 = 0 0
ioctl(0x3, 0x80086804, 0xBFFFF270)		 = 0 0
close(0x3)		 = 0 0

Re: Testdisk "Unable to open file or device ...: Permission

Posted: 26 May 2014, 15:03
by Alfredo
I ran the same image using testdisk 6.14 on Debian Jessie (using the Debian-packaged version), and I get the same error message. It must be something triggered by that particular image.
The image is known to have been through rough times. However, I think this should not stop Photorec from trying to run through it looking for file headers, but for some reason it does.

Re: Testdisk "Unable to open file or device ...: Permission

Posted: 28 May 2014, 07:20
by cgrenier
The file is not a raw disk image but a file generated using EWF format. Rename the file to image.E01.
Run "photorec -version"

Code: Select all

photorec -version
PhotoRec 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Version: 6.14
Compiler: GCC 4.8
Compilation date: 2013-11-06T21:52:12
ext2fs lib: 1.42.7, ntfs lib: libntfs-3g, ewf lib: 20130416, libjpeg: libjpeg-turbo-1.2.90
OS: Linux, kernel 3.13.11-100.fc19.x86_64 (#1 SMP Wed Apr 23 20:10:57 UTC 2014) x86_64
If a version is listed for "ewf lib", you should be able to open the image with your version of PhotoRec.
Otherwise download the latest version from http://www.cgsecurity.org/wiki/TestDisk_Download

Re: Testdisk "Unable to open file or device ...: Permission

Posted: 28 May 2014, 09:14
by Alfredo
Thanks a lot, that did it.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited