ntfscluster - identify files in a specified region of an NTFS volume.

ntfscluster [ options ] device

ntfscluster has three modes of operation: info, sector and cluster.

Info

Sector

Cluster

Below is a summary of all the options that ntfscluster accepts. All options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-c range

--cluster range

Any files whose data is in this range of clusters will be displayed.

-f

--force

This will override some sensible defaults, such as not working with a mounted volume. Use this option with caution.

--help

Show a list of options with a brief description of each one.

-i

--info

This option is not yet implemented.

-q

--quiet

Reduce the amount of output to a minimum. Naturally, it doesn't make sense to combine this option with

-s

--sector

Any files whose data is in this range of sectors will be displayed.

-v

--verbose

Increase the amount of output that ntfscluster prints.

-V

--version

Show the version number, copyright and license ntfscluster.

Get some information about the volume /dev/hda1. ntfscluster /dev/hda1 Look for files in the first 500 clusters of /dev/hda1. ntfscluster -c 0-500 /dev/hda1

The info mode isn't implemented yet. This program is quite limited, but it has no known bugs. If you find one, please send an email to <linux-ntfs-dev@lists.sourceforge.net>

ntfscluster was written by Richard Russon (FlatCap)

ntfscluster is part of the ntfsprogs package and is available from

http://linux-ntfs.sourceforge.net/downloads.html

ntfsinfo(8), ntfsprogs(8)