NAME
ntfscat - print NTFS files and streams on the standard output
SYNOPSIS
[options] device [file]
DESCRIPTION
ntfscat will read a file or stream from an NTFS volume and display the contents on the standard output.
The case of the filename passed to ntfscat is ignored.
OPTIONS
Below is a summary of all the options that ntfscat accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don’t take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.
| -a, --attribute TYPE | ||||||||||||||||||||||||||||||||||||||||||||||||||||
Display the contents of a particular attribute type. By default, the unnamed
$DATA attribute will be shown. The attribute can be specified by a number
in decimal or hexadecimal, or by name.
Notes The attribute names may be given without the leading $ symbol. If you use the $ symbol, you must quote the name to prevent the shell interpreting the name. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| -n, --attribute-name NAME | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Display this named attribute, stream. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| -i, --inode NUM | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Specify a file by its inode number instead of its name. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| -f, --force | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| This will override some sensible defaults, such as not using a mounted volume. Use this option with caution. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| -h, --help | Show a list of options with a brief description of each one. | |||||||||||||||||||||||||||||||||||||||||||||||||||
| -q, --quiet | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Suppress some debug/warning/error messages. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| -V, --version | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Show the version number, copyright and license ntfscat. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| -v, --verbose | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Display more debug/warning/error messages. | ||||||||||||||||||||||||||||||||||||||||||||||||||||
EXAMPLES
Display the contents of a file in the root of an NTFS volume.
ntfscat /dev/hda1 boot.ini
Display the contents of a file in a subdirectory of an NTFS volume.
ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5).
ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C
BUGS
There are no known problems with ntfscat. If you find a bug please send an email describing the problem to the development team: linux-ntfs-dev@lists.sourceforge.net
AUTHORS
ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.
AVAILABILITY
ntfscat is part of the ntfsprogs package and is available from: http://www.linux-ntfs.org/content/view/19/37
The manual pages are available online at: http://man.linux-ntfs.org/
