Man page 8 : ntfscat

ntfscat - print NTFS files and streams on the standard output

[options] device [file]

ntfscat will read a file or stream from an NTFS volume and display the contents on the standard output.

The case of the filename passed to

ntfscat is ignored.

Below is a summary of all the options that

ntfscat accepts. Nearly all options have two equivalent names. The short name is preceded by

- and the long name is preceded by

R -- . Any single letter options, that don't take an argument, can be combined into a single command, e.g.

-fv is equivalent to

R Long named options can be abbreviated to any unique prefix of their name.

• -a, --attribute TYPE
      Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name.

Notes The attribute names may be given without the leading $ symbol.
If you use the $ symbol, you must quote the name to prevent the shell interpreting the name.

• -n, --attribute-name NAME
      Display this named attribute, stream.
• -i, --inode NUM
      Specify a file by its inode number instead of its name.
• -f, --force
      This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.
• -h, --help
      Show a list of options with a brief description of each one.
• -q, --quiet
      Suppress some debug/warning/error messages.
• -V, --version
      Show the version number, copyright and license

R ntfscat .

• -v, --verbose
      Display more debug/warning/error messages.

Display the contents of a file in the root of an NTFS volume.

ntfscat /dev/hda1 boot.ini

Display the contents of a file in a subdirectory of an NTFS volume.

ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts

Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5).

ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C

There are no known problems with

R ntfscat . If you find a bug please send an email describing the problem to the development team:

ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.

ntfscat is part of the

ntfsprogs package and is available from:
http://www.linux-ntfs.org/content/view/19/37

The manual pages are available online at:
http://man.linux-ntfs.org/

Read libntfs(8) for details how to access encrypted files.

R libntfs (8),

R ntfsls (8),

R ntfsprogs (8)