NAME

       ntfscat - print NTFS files and streams on the standard output

SYNOPSIS

       [options] device [file]

DESCRIPTION

       ntfscat  will  read  a  file or stream from an NTFS volume and display the contents on the
       standard output.

       The case of the filename passed to ntfscat is ignored.

OPTIONS

       Below is a summary of all the options that ntfscat accepts.  Nearly all options  have  two
       equivalent  names.   The  short name is preceded by - and the long name is preceded by --.
       Any single letter options, that don't take an argument, can  be  combined  into  a  single
       command,  e.g.   -fv is equivalent to -f -v.  Long named options can be abbreviated to any
       unique prefix of their name.

       -a, --attribute TYPE
              Display the contents of a particular attribute type.  By default, the unnamed $DATA
              attribute  will be shown.  The attribute can be specified by a number in decimal or
              hexadecimal, or by name.

              ┌───────────────────────────────────────────┐
              │Hex     Decimal   Name                     │
              │0x10    16        "$STANDARD_INFORMATION"  │
              │0x20    32        "$ATTRIBUTE_LIST"        │
              │0x30    48        "$FILE_NAME"             │
              │0x40    64        "$OBJECT_ID"             │
              │0x50    80        "$SECURITY_DESCRIPTOR"   │
              │0x60    96        "$VOLUME_NAME"           │
              │0x70    112       "$VOLUME_INFORMATION"    │
              │0x80    128       "$DATA"                  │
              │0x90    144       "$INDEX_ROOT"            │
              │0xA0    160       "$INDEX_ALLOCATION"      │
              │0xB0    176       "$BITMAP"                │
              │0xC0    192       "$REPARSE_POINT"         │
              │0xD0    208       "$EA_INFORMATION"        │
              │0xE0    224       "$EA"                    │
              │0xF0    240       "$PROPERTY_SET"          │
              │0x100   256       "$LOGGED_UTILITY_STREAM" │
              └───────────────────────────────────────────┘

              Notes The attribute names may be given without the leading $ symbol.
              If you use the $ symbol, you must quote the name to prevent the shell  interpreting
              the name.

       -n, --attribute-name NAME
              Display this named attribute, stream.

       -i, --inode NUM
              Specify a file by its inode number instead of its name.

       -f, --force
              This will override some sensible defaults, such as not using a mounted volume.  Use
              this option with caution.

       -h, --help
              Show a list of options with a brief description of each one.

       -q, --quiet
              Suppress some debug/warning/error messages.

       -V, --version
              Show the version number, copyright and license ntfscat.

       -v, --verbose
              Display more debug/warning/error messages.

EXAMPLES

       Display the contents of a file in the root of an NTFS volume.

              ntfscat /dev/hda1 boot.ini

       Display the contents of a file in a subdirectory of an NTFS volume.

              ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts

       Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5).

              ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C

BUGS

       There are no known problems with ntfscat.   If  you  find  a  bug  please  send  an  email
       describing the problem to the development team:
       ntfs-3g-devel@lists.sf.net

AUTHORS

       ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.  It was
       ported to ntfs-3g by Erik Larsson.

AVAILABILITY

       ntfscat is part of the ntfs-3g package and is available from:
       https://github.com/tuxera/ntfs-3g/wiki/

SEE ALSO

       Read libntfs(8) for details how to access encrypted files.

       libntfs(8), ntfsls(8), ntfsprogs(8)