Unable to create DMG after personalization error

[s3hokim]

Hi, I'm using fuji really well. While I was working on it, I found a strange error and wrote it. After the error below occurred, the 'sparse image' was generated normally, but the 'dmg' file was not finally made.

(Error)

ASR/>/dev/disk11s1 Validating target...done Validating source...done

Replicating....10....20....30....40....50....60....70....80....90....100 Replicating....10....20....30....40....50....60....70....80....90....100 Restored target device is /dev/disk11s1. Remounting target volume...done Personalization failed: Error Domain=OSPErrorDomain Code=201 "An error occurred during personalization." UserInfo={NSLocalizedDescription=An error occurred during personalization., NSUnderlyingError=0x600003308360 {Error Domain=AuthInstallErrorDomain Code=14 "(null)"}} asr: Couldn't personalize volume /Volumes/Macintosh HD 2- Unknown error: 201 Waiting to detach temporary image... hdiutil: couldn't unmount "disk11" - Resource Busy hdiutil: couldn't unmount "disk11" - Resource Busy hdiutil: couldn't unmount "disk11" - Resource Busy hdiutil: couldn't unmount "disk11" - Resource Busy ... hdiutil: couldn't unmount "disk11" - Resource Busy hdiutil: couldn't unmount "disk11" - Resource Busy hdiutil: couldn't unmount "disk11" - Resource Busy hdiutil: couldn't unmount "disk11" - Resource Busy

"disk10" ejected. _hdiutil: detach failed - No such file or directory Converting /Volumes/Untitled/----/----_Acquisition/ -_Acquisition.sparseimage -> /Volumes/Untitled/-/-_Acquisition/ -_Acquisition.dmg Preparing image engine... Protective Master Boot Record (MBR: 0) Reading (CRC32 $E1ADAB1C: Protective Master Boot Record (MBR : 0)) GPT Header(Primary GPT Header: 1) Reading ... (CRC32 $1E10C6FD: GPT Header(Primary GPT Header: 1)) GPT Partition Data (Primary GPT Table: 2) Reading ... (CRC32 $95A61DB6: GPT Partition Data (Primary GPT Table: 2)) (Apple Free: 3) Reading ... (CRC32 $00000000: (Apple_Free : 3)) EFI System Partition (C12A7328-F81F-11D2-BA4B-------------: 4) Reading... (CRC32 $B54B659C: EFI System Partition (C12A7328-F81F-11D2-BA4B-------------: 4)) disk image (Apple APFS: 5) Reading... ...

[Lazza]

Thank you for reporting this information.

Can you please tell me more about the environment? What model of Mac is it and what operating system is it running?

[whiteman7]

Hello, I am absolutely delighted with this tool. After a test run (my own MacBook), I tried it on a Macbook Pro M1 (macOS 15.1). At the first attempt I also received an error message when remounting target volume that it can no longer be mounted. Then i formatted the hard disk in MacOS (Journaled) and ran the program on another USB stick. The backup went smoothly until the end, but resulted in the error message shown here (hdiutil....). Then i converted the finished image “sparseimage” into a dmg image and imported it into Axiom. Runs...

Thx for your work - great JOB ;-)

[s3hokim]

Thank you for reporting this information.

Can you please tell me more about the environment? What model of Mac is it and what operating system is it running?

I couldn't get any information about the MacBook that caused the error because it was a problem during forensic work with an external company. (Only about 8 out of 60 had this problem.) What I checked on the field was that Finder or Disk Utility could not unmount the volume in any way. It's circled saying it's still in use.

[whiteman7]

Hi,

sorry for the late response. I wasn't in the office until today and was only able to test the app again this morning with my MacBook.

I formatted the external hard disk as exFAT as “Fuji” and copied the Fuji.dmg to it. During the ASR process, this time it ran the process up to the actual conversion (sparseimage - dmg) (I have attached a picture with an error message).

I then ejected the hard disk, remounted it and converted to dmg with the hard disk tool.

Excerpts from the LogFile:

Fuji - Forensic Unattended Juicy Imaging Version 1.1.0 by Andrea Lazzarotto Acquisition log

Start time: 2024-12-13 10:52:57.109238 End time: None Source: / Acquisition method: ASR

Software: System Software Overview: System Version: macOS 15.1 (24B83) Kernel Version: Darwin 24.1.0 Boot Volume: Macintosh HD Boot Mode: Normal Computer Name: xy User Name: xy Secure Virtual Memory: Enabled System Integrity Protection: Enabled Time since boot: 30 days, 17 hours, 51 minutes

Hardware: Hardware Overview: Model Name: MacBook Pro Model Identifier: MacBookPro17,1 Model Number: MYD82D/A Chip: Apple M1 Total Number of Cores: 8 (4 performance and 4 efficiency) Memory: 8 GB System Firmware Version: 11881.41.5 OS Loader Version: 11881.41.5 Serial Number (system): xy Hardware UUID: xy Provisioning UDID: xy Activation Lock Status: Enabled NVMExpress: Apple SSD Controller: APPLE SSD AP0256Q: Capacity: 251 GB (251,000,193,024 bytes) TRIM Support: Yes Model: APPLE SSD AP0256Q Revision: 499.0.9 Serial Number: 0ba01633811c7039 Detachable Drive: No BSD Name: disk0 Partition Map Type: GPT (GUID Partition Table) Removable Media: No S.M.A.R.T. status: Verified Volumes: iSCPreboot: Capacity: 524.3 MB (524,288,000 bytes) BSD Name: disk0s1 Content: Apple_APFS_ISC Macintosh HD: Capacity: 245.11 GB (245,107,195,904 bytes) BSD Name: disk0s2 Content: Apple_APFS Recovery: Capacity: 5.37 GB (5,368,664,064 bytes) BSD Name: disk0s3 Content: Apple_APFS_Recovery

I hope you can do something with the information.

Thank you already for your efforts,
with kind regards

Moser

[Lazza]

Folks, thank you for the provided information. I hope to be able to test on the latest macOS version, soon.

By the way @whiteman7, I had to edit your comment because it seems that you replied via email and this messes up the formatting of the content. It was not very readable. I suggest that, for future comments, you opt for posting directly on the GitHub website.

In any case, thank you again for providing the information above.

[BrunoFischerGermany]

hi @Lazza

may the flag --no-personaliztion in acquisition/asr.py can help.

add after Line 29 this: "--no-personaliztion"

Look Here: https://managingosx.wordpress.com/2018/01/25/early-notes-on-deploying-images-to-imac-pro/ https://discussions.apple.com/docs/DOC-250005828 https://www.prosofteng.com/blog/how-to-create-a-bootable-clone-on-macos?srsltid=AfmBOorm4g9fuVsgH2K452myFZG_Dzbkkqakz6KHxffViCttn5j8PbW6

Greets

[rafaelcsch]

Got the same error while converting the sparseimage to dmg with a iMac M3 with MacOS 14.5 with ASR method. Converting it manually with hdutil worked.

[Lazza]

@rafaelcsch can you paste the complete text you see in the box, starting from the line above "Validating target", to the bottom?

[rafaelcsch]

Unfortunately I have already sealed the evidence and I only have the Fuji log. What I noticed is that during the conversion to dmg the destination volume (the same volume where I was executing) was ejected and the Fuji was closed with error. I tried twice and the result was the same.

[Lazza]

Do you mean the external exFAT drive?

[rafaelcsch]

Yes. I create a external exFAT drive (with 1 TB) with fuji file and use it as temporary and destination drive. As I mentioned, converting manually the sparseimage with hdiutil worked normally.