NAME
ntfscat - print NTFS files and streams on the standard output
SYNOPSIS
[options] device [file]
DESCRIPTION
ntfscat will read a file or stream from an NTFS volume and display the contents on the standard output. The case of the filename passed to ntfscat is ignored.
OPTIONS
Below is a summary of all the options that ntfscat accepts. Nearly all
options have two equivalent names. The short name is preceded by - and
the long name is preceded by --. Any single letter options, that don't
take an argument, can be combined into a single command, e.g. -fv is
equivalent to -f -v. Long named options can be abbreviated to any
unique prefix of their name.
-a, --attribute TYPE
Display the contents of a particular attribute type. By
default, the unnamed $DATA attribute will be shown. The
attribute can be specified by a number in decimal or
hexadecimal, or by name.
Hex Decimal Name
0x10 16 "$STANDARD_INFORMATION"
0x20 32 "$ATTRIBUTE_LIST"
0x30 48 "$FILE_NAME"
0x40 64 "$OBJECT_ID"
0x50 80 "$SECURITY_DESCRIPTOR"
0x60 96 "$VOLUME_NAME"
0x70 112 "$VOLUME_INFORMATION"
0x80 128 "$DATA"
0x90 144 "$INDEX_ROOT"
0xA0 160 "$INDEX_ALLOCATION"
0xB0 176 "$BITMAP"
0xC0 192 "$REPARSE_POINT"
0xD0 208 "$EA_INFORMATION"
0xE0 224 "$EA"
0xF0 240 "$PROPERTY_SET"
0x100 256 "$LOGGED_UTILITY_STREAM"
Notes The attribute names may be given without the leading $
symbol.
If you use the $ symbol, you must quote the name to prevent the
shell interpreting the name.
-n, --attribute-name NAME
Display this named attribute, stream.
-i, --inode NUM
Specify a file by its inode number instead of its name.
-f, --force
This will override some sensible defaults, such as not using a
mounted volume. Use this option with caution.
-h, --help
Show a list of options with a brief description of each one.
-q, --quiet
Suppress some debug/warning/error messages.
-V, --version
Show the version number, copyright and license ntfscat.
-v, --verbose
Display more debug/warning/error messages.
EXAMPLES
Display the contents of a file in the root of an NTFS volume.
ntfscat /dev/hda1 boot.ini
Display the contents of a file in a subdirectory of an NTFS volume.
ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
Display the contents of the $INDEX_ROOT attribute of the root directory
(inode 5).
ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C
BUGS
There are no known problems with ntfscat. If you find a bug please send an email describing the problem to the development team: ntfs-3g-devel@lists.sf.net
AUTHORS
ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.
AVAILABILITY
ntfscat is part of the ntfs-3g package and is available from: http://www.tuxera.com/community/
SEE ALSO
Read libntfs(8) for details how to access encrypted files. libntfs(8), ntfsls(8), ntfsprogs(8)
More Linux Commands
manpages/mailaddr.7.html
mailaddr(7) - mail addressing description - Linux man page
This manual page gives a brief introduction to SMTP mail addresses, as used on the Internet. These addresses are in the general format user@domain where a domai
manpages/XML::DOM::AttDef.3pm.html
XML::DOM::AttDef(3pm) - A single XML attribute definition in
XML::DOM::AttDef extends XML::DOM::Node, but is not part of the DOM Level 1 specification. Each object of this class represents one attribute definition in an A
manpages/sane-leo.5.html
sane-leo(5) - SANE backend for LEO Technologies scanners....
The sane-leo library implements a SANE (Scanner Access Now Easy) backend that provides access to some LEO SCSI flatbed scanners. This backend should be consider
manpages/locks.5.html
locks(5) - libzypp locking file (Formats - Linux man page)
The file /etc/zypp/locks is read by libzypp at start-up if zypp.conf allows it. The entries are used for initial locking of packages. Locking a package means no
manpages/dracut-mount.service.8.html
dracut-mount.service(8) runs the dracut hooks after sysroot
This service runs all dracut hooks after the real root is mounted on /sysroot. AUTHORS Harald Hoyer SEE ALSO dracut.bootup(7) dracut(8) dracut-mount.service.8 (
manpages/SDL_PixelFormat.3.html
SDL_PixelFormat(3) - Stores surface format information......
A SDL_PixelFormat describes the format of the pixel data stored at the pixels field of a SDL_Surface. Every surface stores a SDL_PixelFormat in the format field
manpages/locale.1.html
locale(1) get locale-specific information - Linux man page
The locale command displays information about the current locale, or all locales, on standard output. When invoked without arguments, locale displays the curren
manpages/Mail::SPF::SenderIPAddrMech.3pm.html
Mail::SPF::SenderIPAddrMech(3pm) - Abstract base class for S
Mail::SPF::SenderIPAddrMech is an abstract base class for SPF record mechanisms that operate on the SMTP senders IP address. It cannot be instantiated directly.
manpages/add_mibdir.3.html
add_mibdir(3) - netsnmp_mib_api functions - Linux man page
The functions dealing with MIB modules fall into four groups - those dealing with initialisation and shutdown, with reading in and parsing MIB files, with searc
manpages/adduser.8.html
adduser(8) - create a new user account - Linux manual page
useradd creates a new user account using the default values from /etc/default/useradd and the specified on the command line. Depending on the command line optio
manpages/netlink.7.html
netlink(7) - Communication between kernel and userspace (AF_
Netlink is used to transfer information between kernel and user-space processes. It consists of a standard sockets-based interface for user space processes and
manpages/plasmaengineexplorer.1.html
plasmaengineexplorer(1) - Provides direct access to plasma d
plasmaengineexplorer is a graphical tool allowing developers to test Plasma data engines without writing a Plasma applet. If no options are given, it will start
