| Steve Kondik | 2111ad7 | 2013-07-07 12:07:44 -0700 | [diff] [blame] | 1 | .\" Copyright (c) 2003\-2005 Richard Russon. |
| 2 | .\" Copyright (c) 2007 Yura Pakhuchiy. |
| 3 | .\" This file may be copied under the terms of the GNU Public License. |
| 4 | .\" |
| 5 | .TH NTFSCAT 8 "September 2007" "ntfs-3g @VERSION@" |
| 6 | .SH NAME |
| 7 | ntfscat \- print NTFS files and streams on the standard output |
| 8 | .SH SYNOPSIS |
| 9 | [\fIoptions\fR] \fIdevice \fR[\fIfile\fR] |
| 10 | .SH DESCRIPTION |
| 11 | .B ntfscat |
| 12 | will read a file or stream from an NTFS volume and display the contents |
| 13 | on the standard output. |
| 14 | .PP |
| 15 | The case of the filename passed to |
| 16 | .B ntfscat |
| 17 | is ignored. |
| 18 | .SH OPTIONS |
| 19 | Below is a summary of all the options that |
| 20 | .B ntfscat |
| 21 | accepts. Nearly all options have two equivalent names. The short name is |
| 22 | preceded by |
| 23 | .B \- |
| 24 | and the long name is preceded by |
| 25 | .BR \-\- . |
| 26 | Any single letter options, that don't take an argument, can be combined into a |
| 27 | single command, e.g. |
| 28 | .B \-fv |
| 29 | is equivalent to |
| 30 | .BR "\-f \-v" . |
| 31 | Long named options can be abbreviated to any unique prefix of their name. |
| 32 | .TP |
| 33 | \fB\-a\fR, \fB\-\-attribute\fR TYPE |
| 34 | Display the contents of a particular attribute type. By default, the unnamed |
| 35 | $DATA attribute will be shown. The attribute can be specified by a number |
| 36 | in decimal or hexadecimal, or by name. |
| 37 | .TS |
| 38 | box; |
| 39 | lB lB lB |
| 40 | l l l. |
| 41 | Hex Decimal Name |
| 42 | 0x10 16 "$STANDARD_INFORMATION" |
| 43 | 0x20 32 "$ATTRIBUTE_LIST" |
| 44 | 0x30 48 "$FILE_NAME" |
| 45 | 0x40 64 "$OBJECT_ID" |
| 46 | 0x50 80 "$SECURITY_DESCRIPTOR" |
| 47 | 0x60 96 "$VOLUME_NAME" |
| 48 | 0x70 112 "$VOLUME_INFORMATION" |
| 49 | 0x80 128 "$DATA" |
| 50 | 0x90 144 "$INDEX_ROOT" |
| 51 | 0xA0 160 "$INDEX_ALLOCATION" |
| 52 | 0xB0 176 "$BITMAP" |
| 53 | 0xC0 192 "$REPARSE_POINT" |
| 54 | 0xD0 208 "$EA_INFORMATION" |
| 55 | 0xE0 224 "$EA" |
| 56 | 0xF0 240 "$PROPERTY_SET" |
| 57 | 0x100 256 "$LOGGED_UTILITY_STREAM" |
| 58 | .TE |
| 59 | .sp |
| 60 | .sp |
| 61 | .B Notes |
| 62 | The attribute names may be given without the leading $ symbol. |
| 63 | .br |
| 64 | If you use the $ symbol, you must quote the name to prevent the shell |
| 65 | interpreting the name. |
| 66 | .TP |
| 67 | \fB\-n\fR, \fB\-\-attribute\-name\fR NAME |
| 68 | Display this named attribute, stream. |
| 69 | .TP |
| 70 | \fB\-i\fR, \fB\-\-inode\fR NUM |
| 71 | Specify a file by its inode number instead of its name. |
| 72 | .TP |
| 73 | \fB\-f\fR, \fB\-\-force\fR |
| 74 | This will override some sensible defaults, such as not using a mounted volume. |
| 75 | Use this option with caution. |
| 76 | .TP |
| 77 | \fB\-h\fR, \fB\-\-help\fR |
| 78 | Show a list of options with a brief description of each one. |
| 79 | .TP |
| 80 | \fB\-q\fR, \fB\-\-quiet\fR |
| 81 | Suppress some debug/warning/error messages. |
| 82 | .TP |
| 83 | \fB\-V\fR, \fB\-\-version\fR |
| 84 | Show the version number, copyright and license |
| 85 | .BR ntfscat . |
| 86 | .TP |
| 87 | \fB\-v\fR, \fB\-\-verbose\fR |
| 88 | Display more debug/warning/error messages. |
| 89 | .SH EXAMPLES |
| 90 | Display the contents of a file in the root of an NTFS volume. |
| 91 | .RS |
| 92 | .sp |
| 93 | .B ntfscat /dev/hda1 boot.ini |
| 94 | .sp |
| 95 | .RE |
| 96 | Display the contents of a file in a subdirectory of an NTFS volume. |
| 97 | .RS |
| 98 | .sp |
| 99 | .B ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts |
| 100 | .sp |
| 101 | .RE |
| 102 | Display the contents of the $INDEX_ROOT attribute of the root directory (inode |
| 103 | 5). |
| 104 | .RS |
| 105 | .sp |
| 106 | .B ntfscat /dev/hda1 \-a INDEX_ROOT \-i 5 | hexdump \-C |
| 107 | .sp |
| 108 | .RE |
| 109 | .SH BUGS |
| 110 | There are no known problems with |
| 111 | .BR ntfscat . |
| 112 | If you find a bug please send an email describing the problem to the |
| 113 | development team: |
| 114 | .br |
| 115 | .nh |
| 116 | ntfs\-3g\-devel@lists.sf.net |
| 117 | .hy |
| 118 | .SH AUTHORS |
| 119 | .B ntfscat |
| 120 | was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. |
| 121 | It was ported to ntfs-3g by Erik Larsson. |
| 122 | .SH AVAILABILITY |
| 123 | .B ntfscat |
| 124 | is part of the |
| 125 | .B ntfs-3g |
| 126 | package and is available from: |
| 127 | .br |
| 128 | .nh |
| 129 | http://www.tuxera.com/community/ |
| 130 | .hy |
| 131 | .SH SEE ALSO |
| 132 | Read \fBlibntfs\fR(8) for details how to access encrypted files. |
| 133 | .sp |
| 134 | .BR libntfs (8), |
| 135 | .BR ntfsls (8), |
| 136 | .BR ntfsprogs (8) |