There seem to be lot of surprises in the deep dungeons of my files. Today I tested a restore scenario and QRecall stopped and the logs says that for a couple of files some properties could not be restored due to insufficient privileges (I run without authorising because the folder only contains my stuff). I was surprised because QRecall was able to capture the file without admin privileges.

I checked the files (All some gif files downloaded from the internet a few month back) and it seems that they all have "wheel" as group instead of staff (for whatever reason).

ls for the original:

-rwxr-xr-x   1 admin  wheel  64356 17 Mär  2003 Krintaru.gif

ls for the recalled version:

-rw-------@  1 admin  staff  64356 16 Dez 16:48 Krintaru.gif

(The Info window in Finder lists no group at all)

It seems all I lost is group and world access and the original date. And I have some finderInfo attributes out of midair:

com.apple.FinderInfo:

00000000  62 7A 79 20 51 6D 52 43 00 00 00 00 00 00 00 00  |bzy QmRC........|

00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

00000020

Strange thing.

For the records: I tried the same with Time Machine. It simply stops restoring when it comes to the first problematic file proclaiming about privileges. Bad. Interestingly Time Machine has the original Wheel privileges in its belly.

QRecall on the other hand simply went on, recalled all files nicely and informs me after that about a possible problem. Good!

Johannes

Johannes wrote:(I run without authorising because the folder only contains my stuff). I was surprised because QRecall was able to capture the file without admin privileges.

This is not surprising at all. Your user account can read this file, and all of its attributes, because the file belongs to 'admin' and file's owner has read privileges. That's why QRecall can capture the item.

When it comes to restoring the item, it can restore all of the data and the original ownership (because it still belongs to 'admin'), but it can't set the group to wheel or grant wheel read or execute privileges. That's because the wheel group doesn't belong to admin, so setting the group would escalate the privileges for this file. Without authorization, QRecall doesn't have the authority to do that.

It seems all I lost is group and world access and the original date. And I have some finderInfo attributes out of midair:

com.apple.FinderInfo:

00000000  62 7A 79 20 51 6D 52 43 00 00 00 00 00 00 00 00  |bzy QmRC........|

Now that's probably a bug, or really a side effect of not having sufficient privileges to restore the file. The 'bzy' type is a special file type that tells the Finder that the file is "busy"?that is, it's being copied or whatever?and the Finder is not supposed to let you try to move, trash, or open that item until the process is finished. Normally the 'bzy' type is removed when the rest of the file's properties are restored, but that got interrupted because of permissions.