Man page - ntfscat(8)
Packages contains this manual
- ntfsls(8)
- ntfscp(8)
- lowntfs-3g(8)
- ntfs-3g(8)
- ntfsundelete(8)
- ntfscluster(8)
- mkfs.ntfs(8)
- ntfscmp(8)
- mount.lowntfs-3g(8)
- mount.ntfs(8)
- ntfsinfo(8)
- ntfsusermap(8)
- ntfsdecrypt(8)
- ntfs-3g.probe(8)
- ntfsfallocate(8)
- ntfsfix(8)
- ntfsrecover(8)
- ntfstruncate(8)
- ntfswipe(8)
- ntfsclone(8)
- ntfsresize(8)
- mkntfs(8)
- ntfscat(8)
- ntfslabel(8)
- ntfsprogs(8)
- mount.ntfs-3g(8)
- ntfssecaudit(8)
apt-get install ntfs-3g
Manual
NTFSCAT
NAMESYNOPSIS
DESCRIPTION
OPTIONS
EXAMPLES
BUGS
AUTHORS
AVAILABILITY
SEE ALSO
NAME
ntfscat - print NTFS files and streams on the standard output
SYNOPSIS
[ options ] device [ file ]
DESCRIPTION
ntfscat will read a file or stream from an NTFS volume and display the contents on the standard output.
The case of the filename passed to ntfscat is ignored.
OPTIONS
Below is a
summary of all the options that
ntfscat
accepts.
Nearly all options have two equivalent names. The short name
is preceded by
-
and the long name is preceded by
--
. Any single letter options, that don’t take
an argument, can be combined into a single command, e.g.
-fv
is equivalent to
-f -v
. Long named options
can be abbreviated to any unique prefix of their name.
-a
,
--attribute
TYPE
|
Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name. |
Notes
The attribute names may be given without the leading $
symbol.
If you use the $ symbol, you must quote the name to prevent
the shell interpreting the name.
-n , --attribute-name NAME
Display this named attribute, stream.
-i , --inode NUM
Specify a file by its inode number instead of its name.
-f , --force
This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.
-h , --help
Show a list of options with a brief description of each one.
-q , --quiet
Suppress some debug/warning/error messages.
-V , --version
Show the version number, copyright and license ntfscat .
-v , --verbose
Display more debug/warning/error messages.
EXAMPLES
Display the contents of a file in the root of an NTFS volume.
ntfscat /dev/hda1 boot.ini
Display the contents of a file in a subdirectory of an NTFS volume.
ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5).
ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C
BUGS
There are no
known problems with
ntfscat
. If you find a bug please
send an email describing the problem to the development
team:
ntfs-3g-devel@lists.sf.net
AUTHORS
ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.
AVAILABILITY
ntfscat
is part of the
ntfs-3g
package and is available from:
https://github.com/tuxera/ntfs-3g/wiki/
SEE ALSO
Read libntfs (8) for details how to access encrypted files.
libntfs (8), ntfsls (8), ntfsprogs (8)