fsapfstools: password option errors with "Invalid argument: (null)"

[vlautac]

Hi,

While running the command ./fsapfsinfo -p <password> -H /dev/disk3, I got

fsapfstools/.libs/fsapfsinfo: option requires an argument -- p
Invalid argument: (null)

My password contains specific characters such as #, @, _ (for example). Is it such an issue?

[joachimmetz]

Is it such an issue?

any characters that your shell might interpret ? try using quotes or escaping those characters

[joachimmetz]

Also which version of fsapfsinfo are you using? Also know that for libtool build you like want to use fsapfstools/fsapfsinfo (and not fsapfstools/.libs/fsapfsinfo unless you really need to) since the libtool script will ensure you are running the corresponding libfsapfs/.libs/libfsapfs.so

[vlautac]

I try to escape the characters -> \#, \@ but now it returns fsapfsinfo 20201107 I use the latest release version.

Unable to open: /dev/disk3.
libcfile_file_open_with_error_code: access denied to file: /dev/disk3.
libcfile_file_open: unable to open file.
libbfio_file_io_handle_open: unable to open file: /dev/disk3.
libbfio_file_range_io_handle_open: unable to open file IO handle.
libbfio_handle_open: unable to open handle.
libfsapfs_container_open_file_io_handle: unable to open file IO handle.
info_handle_open_input: unable to open input container.

[joachimmetz]

If /dev/disk3 is the partition containing the APFS container you need to unmount it. To my knowledge MacOS does not allow you to access the device of a mounted APFS container or volume

[vlautac]

So I unmount /dev/disk3 using

diskutil unmountDisk /dev/disk3
Unmount of all volumes on disk3 was successful

then I run the command again but I got the same error again

The apfs container is the right one isn't it /dev/disk3

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *5.0 TB     disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:                 Apple_APFS Container disk3         5.0 TB     disk2s2

/dev/disk3 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +5.0 TB     disk3
                                 Physical Store disk2s2
   1:                APFS Volume Seagate                 2.0 TB     disk3s1

[joachimmetz]

then I run the command again but I got the same error again

You're still reading from /dev/disk3? Then MacOS then likely calls "mount" something differently for containers.

Try reading from /dev/disk2s2 and make sure disk3 no longer exists (is visible for MacOS)

[vlautac]

Yes,I'm still reading from /dev/disk3. Unmounting /dev/disk2s2 is similar, same error when trying to read using ./fsapfsinfo

Btw, here is the log of diskutil apfs list, disk3 is unmounted

+-- Container disk3 E0279899-3C66-44F3-82F4-CCA68CDF8667
    ====================================================
    APFS Container Reference:     disk3
    Size (Capacity Ceiling):      5000771321856 B (5.0 TB)
    Capacity In Use By Volumes:   2005523128320 B (2.0 TB) (40.1% used)
    Capacity Not Allocated:       2995248193536 B (3.0 TB) (59.9% free)
    |
    +-< Physical Store disk2s2 6CDEAB4D-F7BD-4CBF-BA7B-476BA9416A11
    |   -----------------------------------------------------------
    |   APFS Physical Store Disk:   disk2s2
    |   Size:                       5000771321856 B (5.0 TB)
    |
    +-> Volume disk3s1 27F6BD2B-2D66-4B13-B951-1AAE33891E3E
        ---------------------------------------------------
        APFS Volume Disk (Role):   disk3s1 (No specific role)
        Name:                      Seagate (Case-sensitive)
        Mount Point:               Not Mounted
        Capacity Consumed:         2004945235968 B (2.0 TB)
        FileVault:                 Yes (Unlocked)

[joachimmetz]

Try something in line of:

diskutil eject disk3
sudo fsapfstools/fsapfsinfo /dev/disk2s2

[vlautac]

Here is the log after ejecting disk3 and read disk2s2

$ sudo ./fsapfsinfo -H /dev/disk2s2
fsapfsinfo 20201107

Apple File System (APFS) information:

File system hierarchy:
Unable to print file system hierarchy.
libfsapfs_internal_volume_get_file_system_btree: unable to unlock volume.
libfsapfs_volume_get_root_directory: unable to determine file system B-tree.
info_handle_file_system_hierarchy_fprint: unable to retrieve root directory file entry from volume: 0.

[joachimmetz]

that is looking better

what the trace back is telling you is that fsapfsinfo is able to read the container but cannot read the file system since it requires a password to unlock it

[vlautac]

Can't unlock it with a password I set with special characters. I tried to set the password in a variable and run the command but still unable to read the content

pass='<my_password>'

$ sudo ./fsapfsinfo -p $pass -H /dev/disk2s2
fsapfsinfo 20201107

Apple File System (APFS) information:

File system hierarchy:
Unable to print file system hierarchy.
libfsapfs_volume_get_root_directory: unable to retrieve root directory inode from file system B-tree.
info_handle_file_system_hierarchy_fprint: unable to retrieve root directory file entry from volume: 0.

[joachimmetz]

libfsapfs_volume_get_root_directory: unable to retrieve root directory inode from file system B-tree. this is a different error.

It tells you libfsapfs cannot find the root directory. Is your file system corrupted by any chance?

If not provide me with debug output so I might be able to tell what is different about your file system. Also see: https://github.com/libyal/libfsapfs/wiki/Troubleshooting#verbose-and-debug-output

[joachimmetz]

No input from original reporter, closing issue