'Why can't these files be accessed by the system via $stream = new-object system.IO.FileStream($file, "Open", "Read", "ReadWrite")?
Edit: I am running as Administrator.
I'm using the following script to enumerate and record hierarchy / file hashes for forensic analysis. I was having trouble using Get-FileHash on many system files which were open and found an alternative, which seems to have avoided that problem.
Clear-Host
$root = [PSCustomObject]@{}
$d1 = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
$global:i = 0
function FSSkimmer {
Param(
[Parameter(Mandatory=$True)][string]$path,
[Parameter(Mandatory=$True)][PsCustomObject]$currentobject)
$paths = gci $path | Select-Object -ExpandProperty Fullname
foreach ($file in $paths) {
write-host $file
if (!$(get-item $file | Select-Object -ExpandProperty PSiscontainer)) {
$name = get-item -LiteralPath $file -erroraction 'silentlycontinue' | Select-Object -ExpandProperty Name
#$hash = Get-FileHash $file -Algorithm SHA1 -erroraction 'silentlycontinue' | Select-Object -ExpandProperty Hash
$stream = new-object system.IO.FileStream($file, "Open", "Read", "ReadWrite")
if ($stream)
{
$sha = new-object -type System.Security.Cryptography.SHA256Managed
$bytes = $sha.ComputeHash($stream)
$hash = [System.BitConverter]::ToString($bytes).Replace("-", [String]::Empty).ToLower();
$stream.Dispose()
$stream.Close()
$sha.Dispose()
#Measure-Command {(get-item $file).GetHashCode()} #| write-host
#Measure-Command {$hash = Get-FileHash $file -Algorithm SHA256}
#Measure-Command {$hash = Get-FileHash $file -Algorithm SHA1}
#Measure-Command {$hash = Get-FileHash $file -Algorithm MD5}
$global:i++
if ($global:i % 1000 -eq 0) {
write-host $file
write-host $hash
$d2 = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
$diff = $d2 - $d1
$rate = $diff / $global:i
Clear-Host
Write-Host "Number of files processed: $global:i at rate of $rate ms/file"
}
$currentobject | Add-Member -MemberType NoteProperty -Name $name -Value $hash -erroraction 'silentlycontinue'
}
}
else {
$dir_name = get-item -LiteralPath $file | Select-Object -ExpandProperty Name
$dir = [PSCustomObject]@{}
$currentobject | Add-Member -MemberType NoteProperty -Name "\$($dir_name)" -Value $(FSSkimmer -path $file -currentobject $dir) -erroraction 'silentlycontinue'
}
}
return $currentobject
}
$null = FSSkimmer -path "C:\" -currentobject $root
#ConvertTo-Json -InputObject $root
However, on specific files I get an error:
C:\cygwin64\etc\pki\ca-trust\extracted\pem\objsign-ca-bundle.pem
C:\cygwin64\etc\pki\ca-trust\extracted\pem\README
C:\cygwin64\etc\pki\ca-trust\extracted\pem\tls-ca-bundle.pem
C:\cygwin64\etc\pki\ca-trust\extracted\README
C:\cygwin64\etc\pki\ca-trust\source
C:\cygwin64\etc\pki\ca-trust\source\anchors
C:\cygwin64\etc\pki\ca-trust\source\blacklist
C:\cygwin64\etc\pki\ca-trust\source\ca-bundle.legacy.crt
new-object : Exception calling ".ctor" with "4" argument(s): "The file cannot be accessed by the system.
"
At C:\Users\jonat\Desktop\script\test.ps1:15 char:27
+ ... $stream = new-object system.IO.FileStream($file, "Open", "Read", "R ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [New-Object], MethodInvocationException
+ FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand
It's important (since this is forensic analysis) that I cover every file, and I need to do so without any system down-time. What's the likely culprit here?
A few more files that threw the error:
C:\cygwin64\dev
C:\cygwin64\dev\mqueue
C:\cygwin64\dev\shm
C:\cygwin64\dev\fd
new-object : Exception calling ".ctor" with "4" argument(s): "The file cannot be accessed by the system.
"
At C:\Users\jonat\Desktop\script\test.ps1:15 char:27
+ ... $stream = new-object system.IO.FileStream($file, "Open", "Read", "R ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [New-Object], MethodInvocationException
+ FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand
C:\cygwin64\dev\stderr
new-object : Exception calling ".ctor" with "4" argument(s): "The file cannot be accessed by the system.
"
At C:\Users\jonat\Desktop\script\test.ps1:15 char:27
+ ... $stream = new-object system.IO.FileStream($file, "Open", "Read", "R ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [New-Object], MethodInvocationException
+ FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand
C:\cygwin64\dev\stdin
new-object : Exception calling ".ctor" with "4" argument(s): "The file cannot be accessed by the system.
"
At C:\Users\jonat\Desktop\script\test.ps1:15 char:27
+ ... $stream = new-object system.IO.FileStream($file, "Open", "Read", "R ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [New-Object], MethodInvocationException
+ FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand
C:\cygwin64\dev\stdout
new-object : Exception calling ".ctor" with "4" argument(s): "The file cannot be accessed by the system.
"
At C:\Users\jonat\Desktop\script\test.ps1:15 char:27
+ ... $stream = new-object system.IO.FileStream($file, "Open", "Read", "R ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [New-Object], MethodInvocationException
+ FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand
C:\cygwin64\etc
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
