0

Much like: How do I cat a deleted file which is still open by its inode?.

I am using 'Sleuth Kit' command line tool, to gather relevant data from the disk. But I keep on getting:

Error opening image file (raw_open: file "/dev/rdisk1s2" - Permission denied)

This is so, whether or not I included r. How can I solve this problem?

Improve this question
3
  • Are you running this via sudo or as your own user?
    – mmmmmm
    Commented Oct 5, 2013 at 10:18
  • own user. must I use sudo?
    – forgodsakehold
    Commented Oct 5, 2013 at 12:19
  • 1
    Yes as the data is not necessarily yours. My general comment is if you don't know if to use sudo you need to learn more about what you are doing as using sudo can delete all your data or install a virus
    – mmmmmm
    Commented Oct 5, 2013 at 12:21

1 Answer 1

Reset to default
1

In order to access a raw disk device /dev/rdisk1s2, it should not be mounted. Open Disk Utility and unmount it first. Otherwise you would get a Permission denied error when you try to access it as a raw device.

If you wish to (or need to) have it mounted and use the block device, remove the "r" from the disk name, making it /dev/disk1s2 (notice the missing "r" before "disk1s2").

Improve this answer
2
  • even with r or w/o r, mounted or not, I still get "Permission denied". what else can be the problem?
    – forgodsakehold
    Commented Oct 5, 2013 at 13:07
  • Are you using sudo?
    – nohillside ♦
    Commented Oct 5, 2013 at 13:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .