.\" Copyright (c) 2003\-2005 Richard Russon.
.\" Copyright (c) 2007 Yura Pakhuchiy.
.\" This file may be copied under the terms of the GNU Public License.
.\"
.TH NTFSCAT 8 "September 2007" "ntfs-3g 2022.10.3"
.SH NAME
ntfscat \- print NTFS files and streams on the standard output
.SH SYNOPSIS
[\fIoptions\fR] \fIdevice \fR[\fIfile\fR]
.SH DESCRIPTION
.B ntfscat
will read a file or stream from an NTFS volume and display the contents
on the standard output.
.PP
The case of the filename passed to
.B ntfscat
is ignored.
.SH OPTIONS
Below is a summary of all the options that
.B ntfscat
accepts.  Nearly all options have two equivalent names.  The short name is
preceded by
.B \-
and the long name is preceded by
.BR \-\- .
Any single letter options, that don't take an argument, can be combined into a
single command, e.g.
.B \-fv
is equivalent to
.BR "\-f \-v" .
Long named options can be abbreviated to any unique prefix of their name.
.TP
\fB\-a\fR, \fB\-\-attribute\fR TYPE
Display the contents of a particular attribute type.  By default, the unnamed
$DATA attribute will be shown.  The attribute can be specified by a number
in decimal or hexadecimal, or by name.
.TS
box;
lB lB lB
l l l.
Hex	Decimal	Name
0x10	16	"$STANDARD_INFORMATION"
0x20	32	"$ATTRIBUTE_LIST"
0x30	48	"$FILE_NAME"
0x40	64	"$OBJECT_ID"
0x50	80	"$SECURITY_DESCRIPTOR"
0x60	96	"$VOLUME_NAME"
0x70	112	"$VOLUME_INFORMATION"
0x80	128	"$DATA"
0x90	144	"$INDEX_ROOT"
0xA0	160	"$INDEX_ALLOCATION"
0xB0	176	"$BITMAP"
0xC0	192	"$REPARSE_POINT"
0xD0	208	"$EA_INFORMATION"
0xE0	224	"$EA"
0xF0	240	"$PROPERTY_SET"
0x100	256	"$LOGGED_UTILITY_STREAM"
.TE
.sp
.sp
.B Notes
The attribute names may be given without the leading $ symbol.
.br
If you use the $ symbol, you must quote the name to prevent the shell
interpreting the name.
.TP
\fB\-n\fR, \fB\-\-attribute\-name\fR NAME
Display this named attribute, stream.
.TP
\fB\-i\fR, \fB\-\-inode\fR NUM
Specify a file by its inode number instead of its name.
.TP
\fB\-f\fR, \fB\-\-force\fR
This will override some sensible defaults, such as not using a mounted volume.
Use this option with caution.
.TP
\fB\-h\fR, \fB\-\-help\fR
Show a list of options with a brief description of each one.
.TP
\fB\-q\fR, \fB\-\-quiet\fR
Suppress some debug/warning/error messages.
.TP
\fB\-V\fR, \fB\-\-version\fR
Show the version number, copyright and license
.BR ntfscat .
.TP
\fB\-v\fR, \fB\-\-verbose\fR
Display more debug/warning/error messages.
.SH EXAMPLES
Display the contents of a file in the root of an NTFS volume.
.RS
.sp
.B ntfscat /dev/hda1 boot.ini
.sp
.RE
Display the contents of a file in a subdirectory of an NTFS volume.
.RS
.sp
.B ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
.sp
.RE
Display the contents of the $INDEX_ROOT attribute of the root directory (inode
5).
.RS
.sp
.B ntfscat /dev/hda1 \-a INDEX_ROOT \-i 5 | hexdump \-C
.sp
.RE
.SH BUGS
There are no known problems with
.BR ntfscat .
If you find a bug please send an email describing the problem to the
development team:
.br
.nh
ntfs\-3g\-devel@lists.sf.net
.hy
.SH AUTHORS
.B ntfscat
was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.
It was ported to ntfs-3g by Erik Larsson.
.SH AVAILABILITY
.B ntfscat
is part of the
.B ntfs-3g
package and is available from:
.br
.nh
https://github.com/tuxera/ntfs-3g/wiki/
.hy
.SH SEE ALSO
Read \fBlibntfs\fR(8) for details how to access encrypted files.
.sp
.BR libntfs (8),
.BR ntfsls (8),
.BR ntfsprogs (8)