Testdisk "Unable to open file or device ...: Permission deni Topic is solved

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Alfredo
Posts: 5
Joined: 08 May 2014, 18:13

Testdisk "Unable to open file or device ...: Permission deni

#1 Post by Alfredo »

Hi,

I would like to thank the author for making these awesome tools available. I have used them at one point or another, most often to recover photos from unsavvy users who learn to make backups the hard way (well some don't, but that's another story)

Today I am trying to recover files from a broken small Windows server, but I get the following error:

Code: Select all

alfredo$ testdisk /Volumes/Things/server.img
TestDisk 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device /Volumes/Things/server.img: Permission denied
A simple permissions problem, I hear you say. However, permissions are enough on the file:

Code: Select all

-r--------  1 alfredo  staff  36762501901  6 mar 20:30 /Volumes/Things/server.img
As is easily tested by reading some of the file with another command:

Code: Select all

alfredo$ strings /Volumes/Things/server.img | head -1
header2
I have tried to:
  • Change file permissions to 666
  • Move the file to another volume
  • Remove extended attributes from the file
  • Use Photorec instead of TestDisk
  • Use another TestDisk/PhotoRec version, v6.40 instead of 7.0
And I'm out of ideas.

To add to my confusion, another image from the same source has been processed just fine.

This is on a Macbook Pro with the latest OS:
Darwin MacBook-Pro-de-Alfredo.local 13.1.0 Darwin Kernel Version 13.1.0: Wed Apr 2 23:52:02 PDT 2014; root:xnu-2422.92.1~2/RELEASE_X86_64 x86_64

Any ideas welcome!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk "Unable to open file or device ...: Permission

#2 Post by cgrenier »

Can you strace testdisk 7.0-WIP on this file and post the output ?

Alfredo
Posts: 5
Joined: 08 May 2014, 18:13

Re: Testdisk "Unable to open file or device ...: Permission

#3 Post by Alfredo »

Darwin has dtruss, is this useful?

Code: Select all

MacBook-Pro-de-Alfredo:Things alfredo$ sudo dtruss photorec server.img
Password:
PhotoRec 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device server.img: No such file or directory
SYSCALL(args) 		 = return
thread_selfid(0x0, 0x0, 0x0)		 = 10186812 0
csops(0x0, 0x0, 0xBFFFF384)		 = 0 0
issetugid(0x0, 0x0, 0xBFFFF384)		 = 0 0
shared_region_check_np(0xBFFFD310, 0x0, 0xBFFFF384)		 = 0 0
stat64("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0xBFFFE558, 0xBFFFF384)		 = 0 0
open("/dev/dtracehelper\0", 0x2, 0xBFFFF2E0)		 = 3 0
ioctl(0x3, 0x80086804, 0xBFFFF270)		 = 0 0
close(0x3)		 = 0 0
issetugid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
geteuid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DDE, 0x7, 0xBFFFE7F4)		 = 0 0
__sysctl(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
issetugid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
getuid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0x20)		 = 3 0
__sysctl(0xBFFFD5E4, 0x2, 0xA0B0C434)		 = 0 0
fstatfs64(0x3, 0xBFFFD638, 0xA0B0C434)		 = 0 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 2000 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/Contents\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Resources\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Support Files\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin\0", 0xBFFFE390, 0x1000)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0xBFFFD608)		 = 3 0
fstatfs64(0x3, 0xBFFFD628, 0xBFFFD608)		 = 0 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 2000 0
getdirentries64(0x3, 0x873A00, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/photorec\0", 0xBFFFE1F8, 0x1000)		 = 0 0
open("/usr/local/bin/photorec\0", 0x0, 0x1FF)		 = 3 0
read(0x3, "\316\372\355\376\a\0", 0x200)		 = 512 0
close(0x3)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Heimdal\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/GSS\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/Versions/A/GSS\0", 0xBFFFDE80, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/liblangid.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/libCRFSuite.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/usr/lib/system/libkxld.dylib\0", 0xBFFFD6D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth\0", 0xBFFFD6C8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement\0", 0xBFFFD658, 0x200)		 = 0 0
stat64("/usr/lib/libxslt.1.dylib\0", 0xBFFFD798, 0x200)		 = 0 0
open("/dev/dtracehelper\0", 0x2, 0x9000894F)		 = 3 0
ioctl(0x3, 0x80086804, 0xBFFFECC0)		 = 0 0
close(0x3)		 = 0 0
sigaction(0x2, 0xBFFFFAD0, 0x0)		 = 0 0
sigaction(0x1, 0xBFFFFAD0, 0x0)		 = 0 0
getrlimit(0x1008, 0xBFFFF3E8, 0x0)		 = 0 0
fstat64(0x1, 0xBFFFF3B0, 0x0)		 = 0 0
ioctl(0x1, 0x4004667A, 0xBFFFF418)		 = 0 0
write_nocancel(0x1, "PhotoRec 7.0-WIP, Data Recovery Utility, April 2014\n\0", 0x34)		 = 52 0
write_nocancel(0x1, "Christophe GRENIER <grenier@cgsecurity.org>\n\0", 0x2C)		 = 44 0
write_nocancel(0x1, "http://www.cgsecurity.org\n\0", 0x1A)		 = 26 0
open_nocancel("server.img\0", 0x20800, 0x0)		 = 3 0
fstat(0x3, 0xBFFFFA68, 0x0)		 = 0 0
read_nocancel(0x3, "EVF\t\r\n\377\0", 0x200)		 = 512 0
close_nocancel(0x3)		 = 0 0
write_nocancel(0x1, "\n\0", 0x1)		 = 1 0
write_nocancel(0x1, "Unable to open file or device server.img: No such file or directory\n\0", 0x44)		 = 68 0
__sysctl(0xBFFFED38, 0x2, 0xBFFFED44)		 = 0 0
thread_selfid(0xBFFFED38, 0x2, 0xBFFFED44)		 = 10186812 0
bsdthread_register(0x90275CD0, 0x90275CB0, 0x1000)		 = 0 0
mprotect(0x23C000, 0x44, 0x1)		 = 0 0
mprotect(0x23E000, 0x1000, 0x0)		 = 0 0
mprotect(0x24A000, 0x1000, 0x0)		 = 0 0
mprotect(0x24B000, 0x1000, 0x0)		 = 0 0
mprotect(0x257000, 0x1000, 0x0)		 = 0 0
mprotect(0x258000, 0x1000, 0x1)		 = 0 0
mprotect(0x23C000, 0x44, 0x3)		 = 0 0
mprotect(0x23C000, 0x44, 0x1)		 = 0 0
getpid(0x23C000, 0x44, 0x1)		 = 93662 0
__mac_syscall(0x99AF3EE7, 0x2, 0xBFFFEBF8)		 = 0 0
stat64("/AppleInternal\0", 0xBFFFEC78, 0xBFFFEBF8)		 = -1 Err#2
audit_session_self(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 4099 0
geteuid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getegid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getaudit_addr(0xBFFFEBE0, 0x30, 0xBFFFEBF8)		 = 0 0
csops(0x16DDE, 0x7, 0xBFFFE7F4)		 = -1 Err#22
open("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x0, 0x0)		 = 3 0
pread(0x3, "\312\376\272\276\0", 0x1000, 0x0)		 = 4096 0
pread(0x3, "\316\372\355\376\a\0", 0x1000, 0x7000)		 = 4096 0
fcntl(0x3, 0x3D, 0xFFFFFFFFBFFFCA40)		 = 0 0
mmap(0x235000, 0x2000, 0x1, 0x12, 0x3, 0x7000)		 = 0x235000 0
mmap(0x237000, 0x1000, 0x3, 0x12, 0x3, 0x9000)		 = 0x237000 0
mmap(0x238000, 0x2030, 0x1, 0x12, 0x3, 0xA000)		 = 0x238000 0
close(0x3)		 = 0 0
stat64("/usr/lib/libncurses.5.4.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libz.1.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libiconv.2.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libSystem.B.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/system/libcache.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcommonCrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcompiler_rt.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcopyfile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcorecrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdispatch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdyld.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libkeymgr.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/liblaunch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libmacho.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libquarantine.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libremovefile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_asl.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_blocks.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_c.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_configuration.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_dnssd.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_info.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_kernel.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_m.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_malloc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_network.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_notify.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_platform.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_pthread.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_sandbox.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunwind.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libxpc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Security.framework/Versions/A/Security\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libheimdal-asn1.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libsqlite3.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libresolv.9.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libicucore.A.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libbsm.0.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libobjc.A.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libauto.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libxar.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libpam.2.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libOpenScriptingUtil.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++abi.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libDiagnosticMessagesClient.dylib\0", 0xBFFFDE28, 0x1)		 = 0 0
stat64("/usr/lib/libbz2.1.0.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libxml2.2.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration\0", 0xBFFFDFD8, 0x1)		 = 0 0
getpid(0x97A70B44, 0xBFFFDFD8, 0x1)		 = 93662 0

Alfredo
Posts: 5
Joined: 08 May 2014, 18:13

Re: Testdisk "Unable to open file or device ...: Permission

#4 Post by Alfredo »

Oops, I noticed you said testdisk, not photorec. Sorry. Here's a dtruss of testdisk, just in case:

Code: Select all

MacBook-Pro-de-Alfredo:Things alfredo$ sudo dtruss testdisk server.img
TestDisk 7.0-WIP, Data Recovery Utility, April 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Unable to open file or device server.img: No such file or directory
SYSCALL(args) 		 = return
thread_selfid(0x0, 0x0, 0x0)		 = 10201923 0
csops(0x0, 0x0, 0xBFFFF384)		 = 0 0
issetugid(0x0, 0x0, 0xBFFFF384)		 = 0 0
shared_region_check_np(0xBFFFD310, 0x0, 0xBFFFF384)		 = 0 0
stat64("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0xBFFFE558, 0xBFFFF384)		 = 0 0
open("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x0, 0x0)		 = 3 0
pread(0x3, "\312\376\272\276\0", 0x1000, 0x0)		 = 4096 0
pread(0x3, "\316\372\355\376\a\0", 0x1000, 0x7000)		 = 4096 0
fcntl(0x3, 0x3D, 0xFFFFFFFFBFFFCA40)		 = 0 0
mmap(0x1E7000, 0x2000, 0x1, 0x12, 0x3, 0x7000)		 = 0x1E7000 0
mmap(0x1E9000, 0x1000, 0x3, 0x12, 0x3, 0x9000)		 = 0x1E9000 0
mmap(0x1EA000, 0x2030, 0x1, 0x12, 0x3, 0xA000)		 = 0x1EA000 0
close(0x3)		 = 0 0
stat64("/usr/lib/libncurses.5.4.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libz.1.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libiconv.2.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/libSystem.B.dylib\0", 0xBFFFE388, 0x1)		 = 0 0
stat64("/usr/lib/system/libcache.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcommonCrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcompiler_rt.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcopyfile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libcorecrypto.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdispatch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libdyld.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libkeymgr.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/liblaunch.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libmacho.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libquarantine.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libremovefile.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_asl.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_blocks.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_c.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_configuration.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_dnssd.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_info.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_kernel.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_m.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_malloc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_network.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_notify.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_platform.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_pthread.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libsystem_sandbox.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libunwind.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/usr/lib/system/libxpc.dylib\0", 0xBFFFDFF8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/Security.framework/Versions/A/Security\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\0", 0xBFFFE2A8, 0x1)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libheimdal-asn1.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libsqlite3.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libresolv.9.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libicucore.A.dylib\0", 0xBFFFE158, 0x1)		 = 0 0
stat64("/usr/lib/libbsm.0.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libobjc.A.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libauto.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libxar.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libpam.2.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libOpenScriptingUtil.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++.1.dylib\0", 0xBFFFDFD8, 0x1)		 = 0 0
stat64("/usr/lib/libc++abi.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libDiagnosticMessagesClient.dylib\0", 0xBFFFDE28, 0x1)		 = 0 0
stat64("/usr/lib/libbz2.1.0.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/usr/lib/libxml2.2.dylib\0", 0xBFFFDEF8, 0x1)		 = 0 0
stat64("/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration\0", 0xBFFFDFD8, 0x1)		 = 0 0
getpid(0x97A70B44, 0xBFFFDFD8, 0x1)		 = 93694 0
close(0x3)		 = 0 0
issetugid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
geteuid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
getuid(0x16DFE, 0x7, 0xBFFFE7F4)		 = 0 0
__sysctl(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
issetugid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
getuid(0xBFFFE6C4, 0x4, 0xBFFFE6D8)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0x20)		 = 3 0
__sysctl(0xBFFFD5E4, 0x2, 0xA0B0C434)		 = 0 0
fstatfs64(0x3, 0xBFFFD638, 0xA0B0C434)		 = 0 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 2000 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/Contents\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Resources\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin/Support Files\0", 0xBFFFDE70, 0x1000)		 = -1 Err#2
stat64("/usr/local/bin\0", 0xBFFFE390, 0x1000)		 = 0 0
open_nocancel("/usr/local/bin\0", 0x1100004, 0xBFFFD608)		 = 3 0
fstatfs64(0x3, 0xBFFFD628, 0xBFFFD608)		 = 0 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 2000 0
getdirentries64(0x3, 0xAC9400, 0x1000)		 = 0 0
close_nocancel(0x3)		 = 0 0
stat64("/usr/local/bin/testdisk\0", 0xBFFFE1F8, 0x1000)		 = 0 0
open("/usr/local/bin/testdisk\0", 0x0, 0x1FF)		 = 3 0
read(0x3, "\316\372\355\376\a\0", 0x200)		 = 512 0
close(0x3)		 = 0 0
stat64("/System/Library/PrivateFrameworks/Heimdal.framework/Heimdal\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/GSS\0", 0xBFFFDFA8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/GSS.framework/Versions/A/GSS\0", 0xBFFFDE80, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth\0", 0xBFFFDD88, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation\0", 0xBFFFDC58, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/liblangid.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/usr/lib/libCRFSuite.dylib\0", 0xBFFFDA98, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices\0", 0xBFFFD938, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/NetFS.framework/Versions/A/NetFS\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/usr/lib/system/libkxld.dylib\0", 0xBFFFD6D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth\0", 0xBFFFD6C8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC\0", 0xBFFFD7D8, 0x200)		 = 0 0
stat64("/System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement\0", 0xBFFFD658, 0x200)		 = 0 0
stat64("/usr/lib/libxslt.1.dylib\0", 0xBFFFD798, 0x200)		 = 0 0
sigaction(0x2, 0xBFFFFAD0, 0x0)		 = 0 0
sigaction(0x1, 0xBFFFFAD0, 0x0)		 = 0 0
getrlimit(0x1008, 0xBFFFF3E8, 0x0)		 = 0 0
fstat64(0x1, 0xBFFFF3B0, 0x0)		 = 0 0
ioctl(0x1, 0x4004667A, 0xBFFFF418)		 = 0 0
write_nocancel(0x1, "TestDisk 7.0-WIP, Data Recovery Utility, April 2014\n\0", 0x34)		 = 52 0
write_nocancel(0x1, "Christophe GRENIER <grenier@cgsecurity.org>\n\0", 0x2C)		 = 44 0
write_nocancel(0x1, "http://www.cgsecurity.org\n\0", 0x1A)		 = 26 0
open_nocancel("server.img\0", 0x20802, 0x0)		 = 3 0
fstat(0x3, 0xBFFFFA68, 0x0)		 = 0 0
read_nocancel(0x3, "EVF\t\r\n\377\0", 0x200)		 = 512 0
close_nocancel(0x3)		 = 0 0
write_nocancel(0x1, "\n\0", 0x1)		 = 1 0
write_nocancel(0x1, "Unable to open file or device server.img: No such file or directory\n\0", 0x44)		 = 68 0
open("/dev/dtracehelper\0", 0x2, 0xBFFFF2E0)		 = 3 0
__sysctl(0xBFFFED38, 0x2, 0xBFFFED44)		 = 0 0
thread_selfid(0xBFFFED38, 0x2, 0xBFFFED44)		 = 10201923 0
bsdthread_register(0x90275CD0, 0x90275CB0, 0x1000)		 = 0 0
mprotect(0x1EE000, 0x44, 0x1)		 = 0 0
mprotect(0x1F0000, 0x1000, 0x0)		 = 0 0
mprotect(0x1FC000, 0x1000, 0x0)		 = 0 0
mprotect(0x1FD000, 0x1000, 0x0)		 = 0 0
mprotect(0x209000, 0x1000, 0x0)		 = 0 0
mprotect(0x20A000, 0x1000, 0x1)		 = 0 0
mprotect(0x1EE000, 0x44, 0x3)		 = 0 0
mprotect(0x1EE000, 0x44, 0x1)		 = 0 0
getpid(0x1EE000, 0x44, 0x1)		 = 93694 0
__mac_syscall(0x99AF3EE7, 0x2, 0xBFFFEBF8)		 = 0 0
stat64("/AppleInternal\0", 0xBFFFEC78, 0xBFFFEBF8)		 = -1 Err#2
audit_session_self(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 4099 0
geteuid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getegid(0x934913E6, 0xBFFFEC78, 0xBFFFEBF8)		 = 0 0
getaudit_addr(0xBFFFEBE0, 0x30, 0xBFFFEBF8)		 = 0 0
csops(0x16DFE, 0x7, 0xBFFFE7F4)		 = -1 Err#22
open("/dev/dtracehelper\0", 0x2, 0x9000894F)		 = 3 0
ioctl(0x3, 0x80086804, 0xBFFFECC0)		 = 0 0
ioctl(0x3, 0x80086804, 0xBFFFF270)		 = 0 0
close(0x3)		 = 0 0

Alfredo
Posts: 5
Joined: 08 May 2014, 18:13

Re: Testdisk "Unable to open file or device ...: Permission

#5 Post by Alfredo »

I ran the same image using testdisk 6.14 on Debian Jessie (using the Debian-packaged version), and I get the same error message. It must be something triggered by that particular image.
The image is known to have been through rough times. However, I think this should not stop Photorec from trying to run through it looking for file headers, but for some reason it does.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk "Unable to open file or device ...: Permission

#6 Post by cgrenier »

The file is not a raw disk image but a file generated using EWF format. Rename the file to image.E01.
Run "photorec -version"

Code: Select all

photorec -version
PhotoRec 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Version: 6.14
Compiler: GCC 4.8
Compilation date: 2013-11-06T21:52:12
ext2fs lib: 1.42.7, ntfs lib: libntfs-3g, ewf lib: 20130416, libjpeg: libjpeg-turbo-1.2.90
OS: Linux, kernel 3.13.11-100.fc19.x86_64 (#1 SMP Wed Apr 23 20:10:57 UTC 2014) x86_64
If a version is listed for "ewf lib", you should be able to open the image with your version of PhotoRec.
Otherwise download the latest version from http://www.cgsecurity.org/wiki/TestDisk_Download

Alfredo
Posts: 5
Joined: 08 May 2014, 18:13

Re: Testdisk "Unable to open file or device ...: Permission

#7 Post by Alfredo »

Thanks a lot, that did it.

Locked