NTFSCAT(8)              (September 2007)               NTFSCAT(8)

     NAME
          ntfscat - print NTFS files and streams on the standard
          output

     SYNOPSIS
          [options] device [file]

     DESCRIPTION
          ntfscat will read a file or stream from an NTFS volume and
          display the contents on the standard output.

          The case of the filename passed to ntfscat is ignored.

     OPTIONS
          Below is a summary of all the options that ntfscat accepts.
          Nearly all options have two equivalent names.  The short
          name is preceded by - and the long name is preceded by --.
          Any single letter options, that don't take an argument, can
          be combined into a single command, e.g.  -fv is equivalent
          to -f -v.  Long named options can be abbreviated to any
          unique prefix of their name.

          -a, --attribute TYPE
               Display the contents of a particular attribute type.
               By default, the unnamed $DATA attribute will be shown.
               The attribute can be specified by a number in decimal
               or hexadecimal, or by name.  box; lB lB lB l l l.
               Hex  Decimal   Name 0x10 16   "$STANDARD_INFORMATION"
               0x20 32   "$ATTRIBUTE_LIST" 0x30 48   "$FILE_NAME"
               0x40 64   "$OBJECT_ID" 0x50 80   "$SECURITY_DESCRIPTOR"
               0x60 96   "$VOLUME_NAME"
               0x70 112  "$VOLUME_INFORMATION" 0x80 128  "$DATA"
               0x90 144  "$INDEX_ROOT" 0xA0 160  "$INDEX_ALLOCATION"
               0xB0 176  "$BITMAP" 0xC0 192  "$REPARSE_POINT"
               0xD0 208  "$EA_INFORMATION" 0xE0 224  "$EA"
               0xF0 240  "$PROPERTY_SET"
               0x100     256  "$LOGGED_UTILITY_STREAM"

               Notes The attribute names may be given without the
               leading $ symbol.
               If you use the $ symbol, you must quote the name to
               prevent the shell interpreting the name.

          -n, --attribute-name NAME
               Display this named attribute, stream.

          -i, --inode NUM
               Specify a file by its inode number instead of its name.

     Page 1                  ntfs-3g 2021.8.22       (printed 5/24/22)

     NTFSCAT(8)              (September 2007)               NTFSCAT(8)

          -f, --force
               This will override some sensible defaults, such as not
               using a mounted volume.  Use this option with caution.

          -h, --help
               Show a list of options with a brief description of each
               one.

          -q, --quiet
               Suppress some debug/warning/error messages.

          -V, --version
               Show the version number, copyright and license ntfscat.

          -v, --verbose
               Display more debug/warning/error messages.

     EXAMPLES
          Display the contents of a file in the root of an NTFS vol-
          ume.

               ntfscat /dev/hda1 boot.ini

          Display the contents of a file in a subdirectory of an NTFS
          volume.

               ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts

          Display the contents of the $INDEX_ROOT attribute of the
          root directory (inode 5).

               ntfscat /dev/hda1 -a INDEX_ROOT -i 5

     BUGS
          There are no known problems with ntfscat.  If you find a bug
          please send an email describing the problem to the develop-
          ment team:
          ntfs-3g-devel@lists.sf.net

     AUTHORS
          ntfscat was written by Richard Russon, Anton Altaparmakov
          and Szabolcs Szakacsits.  It was ported to ntfs-3g by Erik
          Larsson.

     AVAILABILITY
          ntfscat is part of the ntfs-3g package and is available
          from:
          http://www.tuxera.com/community/

     SEE ALSO
          Read libntfs(8) for details how to access encrypted files.

     Page 2                  ntfs-3g 2021.8.22       (printed 5/24/22)

     NTFSCAT(8)              (September 2007)               NTFSCAT(8)

          libntfs(8), ntfsls(8), ntfsprogs(8)

     Page 3                  ntfs-3g 2021.8.22       (printed 5/24/22)