man ntfscat (Administration système) - concatenate files and print them on the standard output

NAME

ntfscat - concatenate files and print them on the standard output

SYNOPSIS

ntfscat [ options ] device file

DESCRIPTION

ntfscat will read a file from an NTFS volume and display the contents on the standard output.

The case of the filename passed to ntfscat is ignored.

OPTIONS

Below is a summary of all the options that ntfscat accepts. All options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-a desc


--attribute desc
Display the contents of a particular attribute. By default, the unname $DATA attribute will be shown. The attribute can be specified by number (in decimal or hexadecimal), or by name. lB lB lB l l l. Hex Decimal Name 0x10 16 "$STANDARD_INFORMATION", 0x20 32 "$ATTRIBUTE_LIST", 0x30 48 "$FILE_NAME", 0x40 64 "$OBJECT_ID", 0x50 80 "$SECURITY_DESCRIPTOR", 0x60 96 "$VOLUME_NAME", 0x70 112 "$VOLUME_INFORMATION", 0x80 128 "$DATA", 0x90 144 "$INDEX_ROOT", 0xA0 160 "$INDEX_ALLOCATION", 0xB0 176 "$BITMAP", 0xC0 192 "$REPARSE_POINT", 0xD0 208 "$EA_INFORMATION", 0xE0 224 "$EA", 0xF0 240 "$PROPERTY_SET", 0x100 256 "$LOGGED_UTILITY_STREAM",

Notes

The attribute names may be given without the leading $ symbol.

If you use the $ symbol, you must escape it from the shell.
-i num


--inode num
Specify a file by its inode number instead of its name.
-h


--help
Show a list of options with a brief description of each one.
-q


--quiet
Suppress some debug/warning/error messages.
-V


--version
Show the version number, copyright and license ntfscat.
-v


--verbose
Display more debug/warning/error messages.

EXAMPLES

Display the contents of a file in the root of an NTFS volume. ntfscat /dev/hda1 boot.ini Display the contents of a file in a subdirectory of an NTFS volume. ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5). ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C

BUGS

ntfscat was written in a short time, to get something "out there". It needs a lot more work. If you find any bugs, please send an email to <linux-ntfs-dev@lists.sourceforge.net>

AUTHOR

ntfscat was written by Richard Russon (FlatCap)

AVAILABILITY

ntfscat is part of the ntfsprogs package and is available from

http://linux-ntfs.sourceforge.net/downloads.html

SEE ALSO