![]() |
![]()
| ![]() |
![]()
NAMEntfscat - print NTFS files and streams on the standard outputSYNOPSIS[ options] device [file]DESCRIPTIONntfscat will read a file or stream from an NTFS volume and display the contents on the standard output. The case of the filename passed to ntfscat is ignored.OPTIONSBelow is a summary of all the options that ntfscat accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.
EXAMPLESDisplay the contents of a file in the root of an NTFS volume.
ntfscat /dev/hda1 boot.ini
Display the contents of a file in a subdirectory of an NTFS volume.
ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
Display the contents of the $INDEX_ROOT attribute of the root directory (inode
5).
ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C
BUGSThere are no known problems with ntfscat. If you find a bug please send an email describing the problem to the development team:AUTHORSntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.AVAILABILITYntfscat is part of the ntfs-3g package and is available from:SEE ALSORead libntfs(8) for details how to access encrypted files. libntfs(8), ntfsls(8), ntfsprogs(8)
|