search

jivanpal / drat

Utility for performing data recovery and analysis of APFS partitions/containers.
GNU General Public License v3.0
163 stars 21 forks source link

ERROR: get_file_size: No file size found. #33

Closed akira-okumura closed 2 years ago

akira-okumura commented 2 years ago

I get the error message ERROR: get_file_size: No file size found. when I try to recover a directory.

$ sudo ./drat list --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/database
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.

Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.

Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.

Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.

Navigating to path `/Nagoya 2021-.photoslibrary/database` ... its FSOID is 0x678e8c.
Finding records for FSOID 0x678e8c ... OK.
Filesystem object has 18 records, as follows:
- INODE
- XATTR || name = com.apple.metadata:com_apple_backup_excludeItem
- XATTR || name = com.apple.quarantine
- DIR REC || RegFile || target ID = 0x83e207 || name = Photos.sqlite.lock
- DIR REC || RegFile || target ID = 0x678e8e || name = Photos.sqlite
- DIR REC || RegFile || target ID = 0x678e99 || name = photos.db
- DIR REC || Dirctry || target ID = 0x678e9a || name = search
- DIR REC || RegFile || target ID = 0x83e20d || name = Photos.sqlite.aside-shm
- DIR REC || RegFile || target ID = 0x678ea4 || name = Photos.sqlite.aside-wal
- DIR REC || RegFile || target ID = 0x678ea5 || name = protection
- DIR REC || Dirctry || target ID = 0x83e210 || name = .Photos_SUPPORT
- DIR REC || RegFile || target ID = 0x678ea8 || name = Photos.sqlite-wal
- DIR REC || RegFile || target ID = 0x678ea9 || name = DataModelVersion.plist
- DIR REC || RegFile || target ID = 0x678eaa || name = Photos.sqlite-shm
- DIR REC || Dirctry || target ID = 0x83e20b || name = .Photos.sqlite_SUPPORT
- DIR REC || RegFile || target ID = 0x678ead || name = metaSchema.db
- DIR REC || RegFile || target ID = 0x83e209 || name = rebuildHistory
- DIR REC || RegFile || target ID = 0x678eaf || name = Photos.sqlite.aside
$ sudo ./drat recover --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/database/ --output /Volumes/TOSHIBA\ 8\ TB/
Creating file `/Volumes/TOSHIBA 8 TB/_com.dratapp.recover_` ... OK.
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.

Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.

Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.

Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.

Navigating to path `/Nagoya 2021-.photoslibrary/database/` ... its FSOID is 0x678e8c.
Finding records for FSOID 0x678e8c ... OK.
Filesystem object has 18 records, as follows:
- INODE
- XATTR || name = com.apple.metadata:com_apple_backup_excludeItem
- XATTR || name = com.apple.quarantine
- DIR REC || RegFile || target ID = 0x83e207 || name = Photos.sqlite.lock
- DIR REC || RegFile || target ID = 0x678e8e || name = Photos.sqlite
- DIR REC || RegFile || target ID = 0x678e99 || name = photos.db
- DIR REC || Dirctry || target ID = 0x678e9a || name = search
- DIR REC || RegFile || target ID = 0x83e20d || name = Photos.sqlite.aside-shm
- DIR REC || RegFile || target ID = 0x678ea4 || name = Photos.sqlite.aside-wal
- DIR REC || RegFile || target ID = 0x678ea5 || name = protection
- DIR REC || Dirctry || target ID = 0x83e210 || name = .Photos_SUPPORT
- DIR REC || RegFile || target ID = 0x678ea8 || name = Photos.sqlite-wal
- DIR REC || RegFile || target ID = 0x678ea9 || name = DataModelVersion.plist
- DIR REC || RegFile || target ID = 0x678eaa || name = Photos.sqlite-shm
- DIR REC || Dirctry || target ID = 0x83e20b || name = .Photos.sqlite_SUPPORT
- DIR REC || RegFile || target ID = 0x678ead || name = metaSchema.db
- DIR REC || RegFile || target ID = 0x83e209 || name = rebuildHistory
- DIR REC || RegFile || target ID = 0x678eaf || name = Photos.sqlite.aside

ERROR: get_file_size: No file size found.

But it looks that single files located under the same directory can be recovered one by one.

$ sudo ./drat recover --container /dev/disk2s2 --volume 1 --path /Nagoya\ 2021-.photoslibrary/database/Photos.sqlite.lock --output /Volumes/TOSHIBA\ 8\ TB/
Creating file `/Volumes/TOSHIBA 8 TB/_com.dratapp.recover_Photos.sqlite.lock` ... OK.
Opening `/dev/disk2s2` in read-only mode ... OK.
Determining block size ... 4096 bytes.

Finding most recent container superblock:
- Reading block 0x0 ... validating ... OK.
- Loading checkpoint descriptor area ... OK.
- Searching checkpoint descriptor area ... found most recent container superblock at index 159, its XID is 0x4921b.
Finding container's omap tree:
- Container's omap has Physical OID 0x624395.
- Reading block 0x624395 ... validating ... OK.
- Container's omap tree has Physical OID 0x624484.
- Reading block 0x624484 ... validating ...OK.

Finding volume 1's superblock:
- Volume 1 has Virtual OID 0x402 ... maps to block 0x624353 with XID 0x4921b.
- Reading block 0x624353 ... validating ... OK.
- Volume name: G-DRIVE
Finding volume's omap tree:
- Volume's omap has Physical OID 0x5d6493.
- Reading block 0x5d6493 ... validating ... OK.
- Volume's omap tree has Physical OID 0x5d7962.
- Reading block 0x5d7962 ... validating ... OK.

Finding volume's filesystem tree:
- Filesystem tree has Virtual OID 0x404 ... maps to block 0x5df33f.
- Reading block 0x5df33f ... validating ... OK.

Navigating to path `/Nagoya 2021-.photoslibrary/database/Photos.sqlite.lock` ... its FSOID is 0x83e207.
Finding records for FSOID 0x83e207 ... OK.
Filesystem object has 4 records, as follows:
- INODE
- XATTR || name = com.apple.quarantine
- DSTREAM ID  || file ID = 0x83e207 || ref. count = 1
- FILE EXTENT || file ID = 0x83e207 || log. addr. =          0 || length =     4096 B =     0x1000 B =     1 blocks =     0x1 blocks || phys. block =   0xf24513

How do I smartly recover a directory? I tried several different directories, but I always get the same error message.

jivanpal commented 2 years ago

Closing as duplicate of #30, please see there for guidance.

akira-okumura commented 2 years ago

Thank you again. I modified the Python script you linked. It looks almost working. A few output files remain to be like _com.dratapp.recover_Icon but I will investigate it.