Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

ntfscat(8) [centos man page]

NTFSCAT(8)						      System Manager's Manual							NTFSCAT(8)

NAME
ntfscat - print NTFS files and streams on the standard output SYNOPSIS
[options] device [file] DESCRIPTION
ntfscat will read a file or stream from an NTFS volume and display the contents on the standard output. The case of the filename passed to ntfscat is ignored. OPTIONS
Below is a summary of all the options that ntfscat accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name. -a, --attribute TYPE Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name. +-------------------------------------------+ |Hex Decimal Name | |0x10 16 "$STANDARD_INFORMATION" | |0x20 32 "$ATTRIBUTE_LIST" | |0x30 48 "$FILE_NAME" | |0x40 64 "$OBJECT_ID" | |0x50 80 "$SECURITY_DESCRIPTOR" | |0x60 96 "$VOLUME_NAME" | |0x70 112 "$VOLUME_INFORMATION" | |0x80 128 "$DATA" | |0x90 144 "$INDEX_ROOT" | |0xA0 160 "$INDEX_ALLOCATION" | |0xB0 176 "$BITMAP" | |0xC0 192 "$REPARSE_POINT" | |0xD0 208 "$EA_INFORMATION" | |0xE0 224 "$EA" | |0xF0 240 "$PROPERTY_SET" | |0x100 256 "$LOGGED_UTILITY_STREAM" | +-------------------------------------------+ Notes The attribute names may be given without the leading $ symbol. If you use the $ symbol, you must quote the name to prevent the shell interpreting the name. -n, --attribute-name NAME Display this named attribute, stream. -i, --inode NUM Specify a file by its inode number instead of its name. -f, --force This will override some sensible defaults, such as not using a mounted volume. Use this option with caution. -h, --help Show a list of options with a brief description of each one. -q, --quiet Suppress some debug/warning/error messages. -V, --version Show the version number, copyright and license ntfscat. -v, --verbose Display more debug/warning/error messages. EXAMPLES
Display the contents of a file in the root of an NTFS volume. ntfscat /dev/hda1 boot.ini Display the contents of a file in a subdirectory of an NTFS volume. ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5). ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C BUGS
There are no known problems with ntfscat. If you find a bug please send an email describing the problem to the development team: ntfs-3g-devel@lists.sf.net AUTHORS
ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson. AVAILABILITY
ntfscat is part of the ntfs-3g package and is available from: http://www.tuxera.com/community/ SEE ALSO
Read libntfs(8) for details how to access encrypted files. libntfs(8), ntfsls(8), ntfsprogs(8) ntfs-3g 2017.3.23 September 2007 NTFSCAT(8)

Check Out this Related Man Page

NTFSCP(8)						      System Manager's Manual							 NTFSCP(8)

NAME
ntfscp - overwrite file on an NTFS volume. SYNOPSIS
ntfscp [options] device source_file destination DESCRIPTION
ntfscp will overwrite file on an NTFS volume. At present ntfscp can't create new files. destination can be either file or directory. In case if destination is directory specified by name then source_file is copied into this directory, in case if destination is directory and specified by inode number then unnamed data attribute is created for this inode and source_file is copied into it (WARNING: it's unusual to have unnamed data streams in the directories, think twice before specifying directory by inode number). OPTIONS
Below is a summary of all the options that ntfscp accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name. -a, --attribute NUM Write to this attribute. -i, --inode Treat destination as inode number. -N, --attr-name NAME Write to attribute with this name. -n, --no-action Use this option to make a test run before doing the real copy operation. Volume will be opened read-only and no write will be done. -f, --force This will override some sensible defaults, such as not working with a mounted volume. Use this option with caution. -h, --help Show a list of options with a brief description of each one. -q, --quiet Suppress some debug/warning/error messages. -V, --version Show the version number, copyright and license ntfscp. -v, --verbose Display more debug/warning/error messages. DATA STREAMS
All data on NTFS is stored in streams, which can have names. A file can have more than one data streams, but exactly one must have no name. The size of a file is the size of its unnamed data stream. Usually when you don't specify stream name you are access to unnamed data stream. If you want access to named data stream you need to add ":stream_name" to the filename. For example: by opening "some.mp3:artist" you will open stream "artist" in "some.mp3". But windows usually prevent you from accessing to named data streams, so you need to use some program like FAR or utils from cygwin to access named data streams. EXAMPLES
Copy new_boot.ini from /home/user as boot.ini to the root of an /dev/hda1 NTFS volume: ntfscp /dev/hda1 /home/user/new_boot.ini boot.ini Copy myfile to C:somepathmyfile:stream (assume that /dev/hda1 letter in windows is C): ntfscp -N stream /dev/hda1 myfile /some/path BUGS
There are no known problems with ntfscp. If you find a bug please send an email describing the problem to the development team: linux-ntfs-dev@lists.sourceforge.net AUTHORS
ntfscp was written by Yura Pakhuchiy, with contributions from Anton Altaparmakov. DEDICATION
With love to Marina Sapego. AVAILABILITY
ntfscp is part of the ntfsprogs package and is available from: http://www.linux-ntfs.org/content/view/19/37 The manual pages are available online at: http://man.linux-ntfs.org/ SEE ALSO
ntfsprogs(8) ntfsprogs 1.13.1 November 2005 NTFSCP(8)
Man Page

Featured Tech Videos