mirror of
https://git.code.sf.net/p/ntfs-3g/ntfs-3g.git
synced 2024-11-23 18:14:24 +08:00
137 lines
3.4 KiB
Groff
137 lines
3.4 KiB
Groff
.\" Copyright (c) 2003\-2005 Richard Russon.
|
|
.\" Copyright (c) 2007 Yura Pakhuchiy.
|
|
.\" This file may be copied under the terms of the GNU Public License.
|
|
.\"
|
|
.TH NTFSCAT 8 "September 2007" "ntfs-3g @VERSION@"
|
|
.SH NAME
|
|
ntfscat \- print NTFS files and streams on the standard output
|
|
.SH SYNOPSIS
|
|
[\fIoptions\fR] \fIdevice \fR[\fIfile\fR]
|
|
.SH DESCRIPTION
|
|
.B ntfscat
|
|
will read a file or stream from an NTFS volume and display the contents
|
|
on the standard output.
|
|
.PP
|
|
The case of the filename passed to
|
|
.B ntfscat
|
|
is ignored.
|
|
.SH OPTIONS
|
|
Below is a summary of all the options that
|
|
.B ntfscat
|
|
accepts. Nearly all options have two equivalent names. The short name is
|
|
preceded by
|
|
.B \-
|
|
and the long name is preceded by
|
|
.BR \-\- .
|
|
Any single letter options, that don't take an argument, can be combined into a
|
|
single command, e.g.
|
|
.B \-fv
|
|
is equivalent to
|
|
.BR "\-f \-v" .
|
|
Long named options can be abbreviated to any unique prefix of their name.
|
|
.TP
|
|
\fB\-a\fR, \fB\-\-attribute\fR TYPE
|
|
Display the contents of a particular attribute type. By default, the unnamed
|
|
$DATA attribute will be shown. The attribute can be specified by a number
|
|
in decimal or hexadecimal, or by name.
|
|
.TS
|
|
box;
|
|
lB lB lB
|
|
l l l.
|
|
Hex Decimal Name
|
|
0x10 16 "$STANDARD_INFORMATION"
|
|
0x20 32 "$ATTRIBUTE_LIST"
|
|
0x30 48 "$FILE_NAME"
|
|
0x40 64 "$OBJECT_ID"
|
|
0x50 80 "$SECURITY_DESCRIPTOR"
|
|
0x60 96 "$VOLUME_NAME"
|
|
0x70 112 "$VOLUME_INFORMATION"
|
|
0x80 128 "$DATA"
|
|
0x90 144 "$INDEX_ROOT"
|
|
0xA0 160 "$INDEX_ALLOCATION"
|
|
0xB0 176 "$BITMAP"
|
|
0xC0 192 "$REPARSE_POINT"
|
|
0xD0 208 "$EA_INFORMATION"
|
|
0xE0 224 "$EA"
|
|
0xF0 240 "$PROPERTY_SET"
|
|
0x100 256 "$LOGGED_UTILITY_STREAM"
|
|
.TE
|
|
.sp
|
|
.sp
|
|
.B Notes
|
|
The attribute names may be given without the leading $ symbol.
|
|
.br
|
|
If you use the $ symbol, you must quote the name to prevent the shell
|
|
interpreting the name.
|
|
.TP
|
|
\fB\-n\fR, \fB\-\-attribute\-name\fR NAME
|
|
Display this named attribute, stream.
|
|
.TP
|
|
\fB\-i\fR, \fB\-\-inode\fR NUM
|
|
Specify a file by its inode number instead of its name.
|
|
.TP
|
|
\fB\-f\fR, \fB\-\-force\fR
|
|
This will override some sensible defaults, such as not using a mounted volume.
|
|
Use this option with caution.
|
|
.TP
|
|
\fB\-h\fR, \fB\-\-help\fR
|
|
Show a list of options with a brief description of each one.
|
|
.TP
|
|
\fB\-q\fR, \fB\-\-quiet\fR
|
|
Suppress some debug/warning/error messages.
|
|
.TP
|
|
\fB\-V\fR, \fB\-\-version\fR
|
|
Show the version number, copyright and license
|
|
.BR ntfscat .
|
|
.TP
|
|
\fB\-v\fR, \fB\-\-verbose\fR
|
|
Display more debug/warning/error messages.
|
|
.SH EXAMPLES
|
|
Display the contents of a file in the root of an NTFS volume.
|
|
.RS
|
|
.sp
|
|
.B ntfscat /dev/hda1 boot.ini
|
|
.sp
|
|
.RE
|
|
Display the contents of a file in a subdirectory of an NTFS volume.
|
|
.RS
|
|
.sp
|
|
.B ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
|
|
.sp
|
|
.RE
|
|
Display the contents of the $INDEX_ROOT attribute of the root directory (inode
|
|
5).
|
|
.RS
|
|
.sp
|
|
.B ntfscat /dev/hda1 \-a INDEX_ROOT \-i 5 | hexdump \-C
|
|
.sp
|
|
.RE
|
|
.SH BUGS
|
|
There are no known problems with
|
|
.BR ntfscat .
|
|
If you find a bug please send an email describing the problem to the
|
|
development team:
|
|
.br
|
|
.nh
|
|
ntfs\-3g\-devel@lists.sf.net
|
|
.hy
|
|
.SH AUTHORS
|
|
.B ntfscat
|
|
was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.
|
|
It was ported to ntfs-3g by Erik Larsson.
|
|
.SH AVAILABILITY
|
|
.B ntfscat
|
|
is part of the
|
|
.B ntfs-3g
|
|
package and is available from:
|
|
.br
|
|
.nh
|
|
http://www.tuxera.com/community/
|
|
.hy
|
|
.SH SEE ALSO
|
|
Read \fBlibntfs\fR(8) for details how to access encrypted files.
|
|
.sp
|
|
.BR libntfs (8),
|
|
.BR ntfsls (8),
|
|
.BR ntfsprogs (8)
|