{
    "content": [
        {
            "type": "text",
            "text": "# NTFSCAT (man)\n\n## NAME\n\nntfscat - print NTFS files and streams on the standard output\n\n## SYNOPSIS\n\n[options] device [file]\n\n## DESCRIPTION\n\nntfscat  will read a file or stream from an NTFS volume and display the contents on the stan‐\ndard output.\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **OPTIONS** (8 subsections)\n- **EXAMPLES**\n- **BUGS**\n- **AUTHORS**\n- **AVAILABILITY**\n- **SEE ALSO**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n"
        }
    ],
    "structuredContent": {
        "command": "NTFSCAT",
        "section": "",
        "mode": "man",
        "summary": "ntfscat - print NTFS files and streams on the standard output",
        "synopsis": "[options] device [file]",
        "tldr_summary": null,
        "tldr_examples": [],
        "tldr_source": null,
        "flags": [
            {
                "flag": "-a",
                "long": "--attribute",
                "arg": null,
                "description": "Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name. ┌───────────────────────────────────────────┐ │Hex Decimal Name │ │0x10 16 \"$STANDARDINFORMATION\" │ │0x20 32 \"$ATTRIBUTELIST\" │ │0x30 48 \"$FILENAME\" │ │0x40 64 \"$OBJECTID\" │ │0x50 80 \"$SECURITYDESCRIPTOR\" │ │0x60 96 \"$VOLUMENAME\" │ │0x70 112 \"$VOLUMEINFORMATION\" │ │0x80 128 \"$DATA\" │ │0x90 144 \"$INDEXROOT\" │ │0xA0 160 \"$INDEXALLOCATION\" │ │0xB0 176 \"$BITMAP\" │ │0xC0 192 \"$REPARSEPOINT\" │ │0xD0 208 \"$EAINFORMATION\" │ │0xE0 224 \"$EA\" │ │0xF0 240 \"$PROPERTYSET\" │ │0x100 256 \"$LOGGEDUTILITYSTREAM\" │ └───────────────────────────────────────────┘ Notes The attribute names may be given without the leading $ symbol. If you use the $ symbol, you must quote the name to prevent the shell interpreting the name."
            },
            {
                "flag": "-n",
                "long": "--attribute-name",
                "arg": null,
                "description": "Display this named attribute, stream."
            },
            {
                "flag": "-i",
                "long": "--inode",
                "arg": null,
                "description": "Specify a file by its inode number instead of its name."
            },
            {
                "flag": "-f",
                "long": "--force",
                "arg": null,
                "description": "This will override some sensible defaults, such as not using a mounted volume. Use this option with caution."
            },
            {
                "flag": "-h",
                "long": "--help",
                "arg": null,
                "description": "Show a list of options with a brief description of each one."
            },
            {
                "flag": "-q",
                "long": "--quiet",
                "arg": null,
                "description": "Suppress some debug/warning/error messages."
            },
            {
                "flag": "-V",
                "long": "--version",
                "arg": null,
                "description": "Show the version number, copyright and license ntfscat."
            },
            {
                "flag": "-v",
                "long": "--verbose",
                "arg": null,
                "description": "Display more debug/warning/error messages."
            }
        ],
        "examples": [
            "Display the contents of a file in the root of an NTFS volume.",
            "ntfscat /dev/hda1 boot.ini",
            "Display the contents of a file in a subdirectory of an NTFS volume.",
            "ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts",
            "Display the contents of the $INDEXROOT attribute of the root directory (inode 5).",
            "ntfscat /dev/hda1 -a INDEXROOT -i 5 | hexdump -C"
        ],
        "see_also": [
            {
                "name": "libntfs",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/libntfs/8/json"
            },
            {
                "name": "libntfs",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/libntfs/8/json"
            },
            {
                "name": "ntfsls",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/ntfsls/8/json"
            },
            {
                "name": "ntfsprogs",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/ntfsprogs/8/json"
            }
        ],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "SYNOPSIS",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "DESCRIPTION",
                "lines": 5,
                "subsections": []
            },
            {
                "name": "OPTIONS",
                "lines": 6,
                "subsections": [
                    {
                        "name": "-a --attribute",
                        "lines": 28,
                        "flag": "-a",
                        "long": "--attribute"
                    },
                    {
                        "name": "-n --attribute-name",
                        "lines": 2,
                        "flag": "-n",
                        "long": "--attribute-name"
                    },
                    {
                        "name": "-i --inode",
                        "lines": 2,
                        "flag": "-i",
                        "long": "--inode"
                    },
                    {
                        "name": "-f --force",
                        "lines": 3,
                        "flag": "-f",
                        "long": "--force"
                    },
                    {
                        "name": "-h --help",
                        "lines": 2,
                        "flag": "-h",
                        "long": "--help"
                    },
                    {
                        "name": "-q --quiet",
                        "lines": 2,
                        "flag": "-q",
                        "long": "--quiet"
                    },
                    {
                        "name": "-V --version",
                        "lines": 2,
                        "flag": "-V",
                        "long": "--version"
                    },
                    {
                        "name": "-v --verbose",
                        "lines": 2,
                        "flag": "-v",
                        "long": "--verbose"
                    }
                ]
            },
            {
                "name": "EXAMPLES",
                "lines": 13,
                "subsections": []
            },
            {
                "name": "BUGS",
                "lines": 4,
                "subsections": []
            },
            {
                "name": "AUTHORS",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "AVAILABILITY",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "SEE ALSO",
                "lines": 7,
                "subsections": []
            }
        ],
        "sections": {
            "NAME": {
                "content": "ntfscat - print NTFS files and streams on the standard output\n",
                "subsections": []
            },
            "SYNOPSIS": {
                "content": "[options] device [file]\n",
                "subsections": []
            },
            "DESCRIPTION": {
                "content": "ntfscat  will read a file or stream from an NTFS volume and display the contents on the stan‐\ndard output.\n\nThe case of the filename passed to ntfscat is ignored.\n",
                "subsections": []
            },
            "OPTIONS": {
                "content": "Below is a summary of all the options that ntfscat accepts.   Nearly  all  options  have  two\nequivalent  names.  The short name is preceded by - and the long name is preceded by --.  Any\nsingle letter options, that don't take an argument, can be combined into  a  single  command,\ne.g.  -fv is equivalent to -f -v.  Long named options can be abbreviated to any unique prefix\nof their name.\n",
                "subsections": [
                    {
                        "name": "-a --attribute",
                        "content": "Display the contents of a particular attribute type.  By default,  the  unnamed  $DATA\nattribute  will  be  shown.   The attribute can be specified by a number in decimal or\nhexadecimal, or by name.\n\n┌───────────────────────────────────────────┐\n│Hex     Decimal   Name                     │\n│0x10    16        \"$STANDARDINFORMATION\"  │\n│0x20    32        \"$ATTRIBUTELIST\"        │\n│0x30    48        \"$FILENAME\"             │\n│0x40    64        \"$OBJECTID\"             │\n│0x50    80        \"$SECURITYDESCRIPTOR\"   │\n│0x60    96        \"$VOLUMENAME\"           │\n│0x70    112       \"$VOLUMEINFORMATION\"    │\n│0x80    128       \"$DATA\"                  │\n│0x90    144       \"$INDEXROOT\"            │\n│0xA0    160       \"$INDEXALLOCATION\"      │\n│0xB0    176       \"$BITMAP\"                │\n│0xC0    192       \"$REPARSEPOINT\"         │\n│0xD0    208       \"$EAINFORMATION\"        │\n│0xE0    224       \"$EA\"                    │\n│0xF0    240       \"$PROPERTYSET\"          │\n│0x100   256       \"$LOGGEDUTILITYSTREAM\" │\n└───────────────────────────────────────────┘\n\nNotes The attribute names may be given without the leading $ symbol.\nIf you use the $ symbol, you must quote the name to prevent the shell interpreting the\nname.\n",
                        "flag": "-a",
                        "long": "--attribute"
                    },
                    {
                        "name": "-n --attribute-name",
                        "content": "Display this named attribute, stream.\n",
                        "flag": "-n",
                        "long": "--attribute-name"
                    },
                    {
                        "name": "-i --inode",
                        "content": "Specify a file by its inode number instead of its name.\n",
                        "flag": "-i",
                        "long": "--inode"
                    },
                    {
                        "name": "-f --force",
                        "content": "This  will  override  some sensible defaults, such as not using a mounted volume.  Use\nthis option with caution.\n",
                        "flag": "-f",
                        "long": "--force"
                    },
                    {
                        "name": "-h --help",
                        "content": "Show a list of options with a brief description of each one.\n",
                        "flag": "-h",
                        "long": "--help"
                    },
                    {
                        "name": "-q --quiet",
                        "content": "Suppress some debug/warning/error messages.\n",
                        "flag": "-q",
                        "long": "--quiet"
                    },
                    {
                        "name": "-V --version",
                        "content": "Show the version number, copyright and license ntfscat.\n",
                        "flag": "-V",
                        "long": "--version"
                    },
                    {
                        "name": "-v --verbose",
                        "content": "Display more debug/warning/error messages.\n",
                        "flag": "-v",
                        "long": "--verbose"
                    }
                ]
            },
            "EXAMPLES": {
                "content": "Display the contents of a file in the root of an NTFS volume.\n\nntfscat /dev/hda1 boot.ini\n\nDisplay the contents of a file in a subdirectory of an NTFS volume.\n\nntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts\n\nDisplay the contents of the $INDEXROOT attribute of the root directory (inode 5).\n\nntfscat /dev/hda1 -a INDEXROOT -i 5 | hexdump -C\n\n",
                "subsections": []
            },
            "BUGS": {
                "content": "There are no known problems with ntfscat.  If you find a bug please send an email  describing\nthe problem to the development team:\nntfs-3g-devel@lists.sf.net\n",
                "subsections": []
            },
            "AUTHORS": {
                "content": "ntfscat  was  written  by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.  It was\nported to ntfs-3g by Erik Larsson.\n",
                "subsections": []
            },
            "AVAILABILITY": {
                "content": "ntfscat is part of the ntfs-3g package and is available from:\nhttps://github.com/tuxera/ntfs-3g/wiki/\n",
                "subsections": []
            },
            "SEE ALSO": {
                "content": "Read libntfs(8) for details how to access encrypted files.\n\nlibntfs(8), ntfsls(8), ntfsprogs(8)\n\n\n\nntfs-3g 2021.8.22                          September 2007                                 NTFSCAT(8)",
                "subsections": []
            }
        }
    }
}