Capture issues: Unable to read extended attribute data & Operation not permitted

Hi, James.

Same message, different problem. And a new one. This is on a capture of my entire internal drive.

Action	2020-04-27 03:14:44	       	    volume 0
Action	2020-04-27 03:14:44	       	      Library/Application Support
Action	2020-04-27 02:03:58	       	        folder com.apple.TCC
Action	2020-04-27 02:03:58	Caution	          Unable to read extended attribute data
Action	2020-04-27 02:03:58	       	            path: /.vol/.com.qrecall.snap/0/Library/Application Support/com.apple.TCC
Action	2020-04-27 02:03:58	       	            xattr: com.apple.rootless
Action	2020-04-27 02:03:58	       	            errno: 1
Action	2020-04-27 03:14:44	       	      private/var/db/fpsd/dvp
Action	2020-04-27 02:32:30	       	        file 0x733A06F1C365790885C699239346BD73
Action	2020-04-27 02:32:30	Failure	          Could not capture file
Action	2020-04-27 02:32:30	       	            cannot open file
Action	2020-04-27 02:32:30	       	              flags: 0x0000
Action	2020-04-27 02:32:30	Minutia	              POSIXErr: 1
Action	2020-04-27 02:32:30	       	              ErrDescription: Operation not permitted
Action	2020-04-27 02:32:30	Minutia	              Path: /.vol/.com.qrecall.snap/0/private/var/db/fpsd/dvp/0x733A06F1C365790885C699239346BD73

The log tells me to "Use Capture Assistant," but not how. (I tried to use it to back up the errant folders, but got the same error message.)

Thanks!

Steven,

I'm afraid you'll have to ignore this one.

The com.apple.TCC file contains sensitive information that Apple doesn't want malware to have access to. QRecall works around most file restrictions with special privileges, but the com.apple.TCC directory seems to be different. Also note that it's very inconsistent; some users report problems reading this file, while most systems capture it every day just fine.

The folder contains a database that stores, among other things, the security preferences and allowances defined for various apps. Obviously, macOS is super paranoid about letting a bad actor modify (or even read) this information.

The dvp database is similarly protected.

I would suggest adding an exclusion to your archive that skips these items. Should you need to perform a complete restore of your start-up volume, it just means you'll need to re-grant apps access to your private information (contacts, external volumes, etc). Which is probably a good thing to review from time to time anyway.

Thanks, James!

Understood.

Just migrated from Mojave on an almost 10 year old MacBook Pro to Big Sur on an M1 MacBook Air. My first attempt at capturing an archive on the new machine produced a number of "Capture Issues." Here's a screenshot:

Do I have a problem that needs correcting?

Thanks.

Not a problem. Those are files that can't be captured because of Mojave's security. Future versions of QRecall will exclude the ~/Library/Metadata/CoreSpotlight folder. But for now, simply add it to the archive's exclude list.

Thanks! (Actually the above screen shot was from Big Sur, not Mojave.)