search

cugu / afro

File recovery for APFS
157 stars 16 forks source link

AttributeError: 'Obj' object has no attribute 'body' #19

Open MendelKazen opened 3 years ago

MendelKazen commented 3 years ago

Do you know what is going wrong here? I had an apfs volume where I messed around with the gpt and ended up deleting it, thereby losing my whole mac os filesystem and the data on it. I followed the readme and cloned my ssd into a .dmg file and ran mmls with the following results:

GUID Partition Table (EFI)
Offset Sector: 0
Units are in 4096-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Safety Table
001:  -------   0000000000   0000000255   0000000256   Unallocated
002:  Meta      0000000001   0000000001   0000000001   GPT Header
003:  Meta      0000000002   0000000005   0000000004   Partition Table
004:  000       0000000256   0000077055   0000076800   EFI System Partition
005:  -------   0000076800   0122138132   0122061333   Unallocated
006:  002       0000076806   0122138127   0122061322   
007:  001       0000077056   0000076799   18446744073709551360   EFI System Partition

Assuming the Unallocated slot is where afro should parse I ran:

sudo afro -o 0000076806 -e files ssd.dmg and keep getting this error:

mint@mint:/media/mint/4a980bb4-4e71-413b-bc7a-9af81f72e918$ sudo afro -o 0000076806 -e files ssd.dmg 
Traceback (most recent call last):
  File "/usr/local/bin/afro", line 11, in <module>
    load_entry_point('afro==0.2', 'console_scripts', 'afro')()
  File "/usr/local/lib/python3.8/dist-packages/afro-0.2-py3.8.egg/afro/__init__.py", line 117, in main
  File "/usr/local/lib/python3.8/dist-packages/afro-0.2-py3.8.egg/afro/__init__.py", line 71, in extract
  File "/usr/local/lib/python3.8/dist-packages/afro-0.2-py3.8.egg/afro/libapfs/apfs.py", line 1025, in block_size
AttributeError: 'Obj' object has no attribute 'body'

If anyone can help me with this issue it would be really helpfull.

p.s. I don't know too much about data recovery; what is the difference between the carving methods parse and carve?

gaycodegal commented 3 years ago

I'm also running into this issue for me i have two apfs drives, one at 005: 001 start end length "Customer" and another (just a normal non botched apfs drive) at 007: 002 start end length "Rescue"

when i run the code on a non Apfs drive i get a different error so the code must recognize it is Apfs

I'm running this on MacOs from an external drive on the internal drive and my command is afro -o 50 -e bodyfile /dev/disk0