1

I can't read a particular file, even though as far as I can tell I have read rights on it. Here is what "Effective Access" shows:

Effective Access

Here is what Get-Acl is giving me.

PS ...> Get-Acl .\HelloWorld.java | Format-List


Path   : Microsoft.PowerShell.Core\FileSystem::I:\...\HelloWorld.java
Owner  : ...\Admin
Group  : G:S-1-5-21-4281937098-1570975092-1098596674-513
Access : ...\Admin Allow  FullControl
Audit  :
Sddl   : O:S-1-5-21-3073128669-2165567304-4059943147-1001G:S-1-5-21-4281937098-1570975092-1098596674-513D:PAI(A;;FA;;;S-1-5-21-3073128669-2165567304-4059943147-1001)

When I try to open it in Notepad, or even just copy it from command-line, I get an error:

I:\...>copy HelloWorld.java C:\HelloWorld.java
Access is denied.
        0 file(s) copied.

I:\...>more HelloWorld.java
Cannot access file I:\...\HelloWorld.java

I'm logged in as Admin, and also the cmd.exe shell is elevated (right clicked and did "Run as administrator").

Note that it wasn't originally SDDL_PROTECTED, but I added that (via Windows GUI) in an attempt to make sure that there wasn't something being inherited that was confusing access. Then I added an ACE to give Admin full control. The drive was formerly a system disk for a Win7 machine, but I'm trying to read it on a Win10 machine.

kec
  • 2,099
  • 11
  • 17
  • can you read it in an elevated (admin) shell? – Jean-François Fabre Aug 28 '16 at 15:53
  • Sorry, forgot to mention that the shell is elevated (right-clicked and did "Run as administrator". – kec Aug 28 '16 at 15:57
  • that's so frustrating! Is your aim to recover the file or to understand what's going on? did you try to move the file in a directory above? (would it be a path too long problem?) Windows is full of surprises :) – Jean-François Fabre Aug 28 '16 at 16:05
  • More to understand what's going on. I can read all of the important files from that drive. The path length is well under 255. I just tried moving it to the root of that drive, which worked, and am getting the same result. It just bothers me that there's something going on with Windows security that I don't understand. – kec Aug 28 '16 at 16:12
  • Do you just want to recover the file? in which case you could try to mount this disk on a windows 7 box again. Oh, is the file encrypted using windows encryption? that would explain it: if you don't have the key you get access denied. – Jean-François Fabre Aug 28 '16 at 16:15
  • That was it! The file was encrypted! (I have no idea why it was, but I don't really care. It was just some files that were in the `Downloads` folder on the old drive.) Thanks, if you post this and the path length possibility as an answer, I'll accept. – kec Aug 28 '16 at 16:25

1 Answers1

2

When the protections are OK, 2 other problems can occur

  1. path too long: some apps don't like it (but you get file not found rather than access denied): workaround: mount a drive in a lower level using subst and access from here
  2. file is open in write mode by another program/service.
  3. file is encrypted using windows built-in encryption. In that case, it works OK on the original computer, but when you mount the disk somewhere else, you get "access denied" even if the permissions are OK

The chances are: it is option 3 since you switched computers.

Jean-François Fabre
  • 137,073
  • 23
  • 153
  • 219