Provided by: ntfsprogs_1.12.1-1_i386 bug


       ntfscat - concatenate files and print them on the standard output


       ntfscat [ options ] device file


       ntfscat  will  read a file from an NTFS volume and display the contents
       on the standard output.

       The case of the filename passed to ntfscat is ignored.


       Below is a summary of  all  the  options  that  ntfscat  accepts.   All
       options have two equivalent names.  The short name is preceded by - and
       the long name is preceded by --.  Any single letter options, that don’t
       take  an  argument, can be combined into a single command, e.g.  -fv is
       equivalent to -f -v.  Long named options  can  be  abbreviated  to  any
       unique prefix of their name.

       -a  desc
       --attribute  desc
              Display the contents of a particular attribute.  By default, the
              unname $DATA attribute will be  shown.   The  attribute  can  be
              specified by number (in decimal or hexadecimal), or by name.

              Hex     Decimal   Name
              0x10    16        "$STANDARD_INFORMATION",
              0x20    32        "$ATTRIBUTE_LIST",
              0x30    48        "$FILE_NAME",
              0x40    64        "$OBJECT_ID",
              0x50    80        "$SECURITY_DESCRIPTOR",
              0x60    96        "$VOLUME_NAME",
              0x70    112       "$VOLUME_INFORMATION",
              0x80    128       "$DATA",
              0x90    144       "$INDEX_ROOT",
              0xA0    160       "$INDEX_ALLOCATION",
              0xB0    176       "$BITMAP",
              0xC0    192       "$REPARSE_POINT",
              0xD0    208       "$EA_INFORMATION",
              0xE0    224       "$EA",
              0xF0    240       "$PROPERTY_SET",
              0x100   256       "$LOGGED_UTILITY_STREAM",
              The attribute names may be given without the leading $ symbol.
              If you use the $ symbol, you must escape it from the shell.

       -i  num
       --inode  num
              Specify a file by its inode number instead of its name.

       --help Show a list of options with a brief description of each one.

              Suppress some debug/warning/error messages.

              Show the version number, copyright and license ntfscat.

              Display more debug/warning/error messages.


       Display the contents of a file in the root of an NTFS volume.

              ntfscat /dev/hda1 boot.ini

       Display the contents of a file in a subdirectory of an NTFS volume.

              ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts

       Display the contents of the $INDEX_ROOT attribute of the root directory
       (inode 5).

              ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C


       ntfscat was written in a short time, to get something "out there".   It
       needs  a  lot more work.  If you find any bugs, please send an email to


       ntfscat was written by Richard Russon (FlatCap)


       ntfscat is part of the ntfsprogs package and is available from


       ntfsls(8), ntfsprogs(8)