ntfscat(8)

1NTFSCAT(8)                  System Manager's Manual                 NTFSCAT(8)
2
3
4

NAME

6       ntfscat - print NTFS files and streams on the standard output
7

SYNOPSIS

9       [options] device [file]
10

DESCRIPTION

12       ntfscat  will read a file or stream from an NTFS volume and display the
13       contents on the standard output.
14
15       The case of the filename passed to ntfscat is ignored.
16

OPTIONS

18       Below is a summary of all the options that ntfscat accepts.  Nearly all
19       options have two equivalent names.  The short name is preceded by - and
20       the long name is preceded by --.  Any single letter options, that don't
21       take  an  argument, can be combined into a single command, e.g.  -fv is
22       equivalent to -f -v.  Long named options  can  be  abbreviated  to  any
23       unique prefix of their name.
24
25       -a, --attribute TYPE
26              Display  the  contents  of  a particular attribute type.  By de‐
27              fault, the unnamed $DATA attribute will be shown.  The attribute
28              can  be  specified  by a number in decimal or hexadecimal, or by
29              name.
30
31              ┌───────────────────────────────────────────┐
32              │Hex     Decimal   Name                     │
33              │0x10    16        "$STANDARD_INFORMATION"  │
34              │0x20    32        "$ATTRIBUTE_LIST"        │
35              │0x30    48        "$FILE_NAME"             │
36              │0x40    64        "$OBJECT_ID"             │
37              │0x50    80        "$SECURITY_DESCRIPTOR"   │
38              │0x60    96        "$VOLUME_NAME"           │
39              │0x70    112       "$VOLUME_INFORMATION"    │
40              │0x80    128       "$DATA"                  │
41              │0x90    144       "$INDEX_ROOT"            │
42              │0xA0    160       "$INDEX_ALLOCATION"      │
43              │0xB0    176       "$BITMAP"                │
44              │0xC0    192       "$REPARSE_POINT"         │
45              │0xD0    208       "$EA_INFORMATION"        │
46              │0xE0    224       "$EA"                    │
47              │0xF0    240       "$PROPERTY_SET"          │
48              │0x100   256       "$LOGGED_UTILITY_STREAM" │
49              └───────────────────────────────────────────┘
50
51              Notes The attribute names may be given  without  the  leading  $
52              symbol.
53              If  you use the $ symbol, you must quote the name to prevent the
54              shell interpreting the name.
55
56       -n, --attribute-name NAME
57              Display this named attribute, stream.
58
59       -i, --inode NUM
60              Specify a file by its inode number instead of its name.
61
62       -f, --force
63              This will override some sensible defaults, such as not  using  a
64              mounted volume.  Use this option with caution.
65
66       -h, --help
67              Show a list of options with a brief description of each one.
68
69       -q, --quiet
70              Suppress some debug/warning/error messages.
71
72       -V, --version
73              Show the version number, copyright and license ntfscat.
74
75       -v, --verbose
76              Display more debug/warning/error messages.
77

EXAMPLES

79       Display the contents of a file in the root of an NTFS volume.
80
81              ntfscat /dev/hda1 boot.ini
82
83       Display the contents of a file in a subdirectory of an NTFS volume.
84
85              ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
86
87       Display the contents of the $INDEX_ROOT attribute of the root directory
88       (inode 5).
89
90              ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C
91
92

BUGS

94       There are no known problems with ntfscat.  If you  find  a  bug  please
95       send an email describing the problem to the development team:
96       ntfs-3g-devel@lists.sf.net
97

AUTHORS

99       ntfscat  was written by Richard Russon, Anton Altaparmakov and Szabolcs
100       Szakacsits.  It was ported to ntfs-3g by Erik Larsson.
101

AVAILABILITY

103       ntfscat is part of the ntfs-3g package and is available from:
104       https://github.com/tuxera/ntfs-3g/wiki/
105