{
    "mode": "man",
    "parameter": "ntfscat",
    "section": "8",
    "url": "https://www.chedong.com/phpMan.php/man/ntfscat/8/json",
    "generated": "2026-05-30T08:16:22Z",
    "synopsis": "[options] device [file]",
    "sections": {
        "NAME": {
            "content": "ntfscat - print NTFS files and streams on the standard output\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "[options] device [file]\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "ntfscat  will read a file or stream from an NTFS volume and display the contents on the stan‐\ndard output.\n\nThe case of the filename passed to ntfscat is ignored.\n",
            "subsections": []
        },
        "OPTIONS": {
            "content": "Below is a summary of all the options that ntfscat accepts.   Nearly  all  options  have  two\nequivalent  names.  The short name is preceded by - and the long name is preceded by --.  Any\nsingle letter options, that don't take an argument, can be combined into  a  single  command,\ne.g.  -fv is equivalent to -f -v.  Long named options can be abbreviated to any unique prefix\nof their name.\n",
            "subsections": [
                {
                    "name": "-a --attribute",
                    "content": "Display the contents of a particular attribute type.  By default,  the  unnamed  $DATA\nattribute  will  be  shown.   The attribute can be specified by a number in decimal or\nhexadecimal, or by name.\n\n┌───────────────────────────────────────────┐\n│Hex     Decimal   Name                     │\n│0x10    16        \"$STANDARDINFORMATION\"  │\n│0x20    32        \"$ATTRIBUTELIST\"        │\n│0x30    48        \"$FILENAME\"             │\n│0x40    64        \"$OBJECTID\"             │\n│0x50    80        \"$SECURITYDESCRIPTOR\"   │\n│0x60    96        \"$VOLUMENAME\"           │\n│0x70    112       \"$VOLUMEINFORMATION\"    │\n│0x80    128       \"$DATA\"                  │\n│0x90    144       \"$INDEXROOT\"            │\n│0xA0    160       \"$INDEXALLOCATION\"      │\n│0xB0    176       \"$BITMAP\"                │\n│0xC0    192       \"$REPARSEPOINT\"         │\n│0xD0    208       \"$EAINFORMATION\"        │\n│0xE0    224       \"$EA\"                    │\n│0xF0    240       \"$PROPERTYSET\"          │\n│0x100   256       \"$LOGGEDUTILITYSTREAM\" │\n└───────────────────────────────────────────┘\n\nNotes The attribute names may be given without the leading $ symbol.\nIf you use the $ symbol, you must quote the name to prevent the shell interpreting the\nname.\n",
                    "flag": "-a",
                    "long": "--attribute"
                },
                {
                    "name": "-n --attribute-name",
                    "content": "Display this named attribute, stream.\n",
                    "flag": "-n",
                    "long": "--attribute-name"
                },
                {
                    "name": "-i --inode",
                    "content": "Specify a file by its inode number instead of its name.\n",
                    "flag": "-i",
                    "long": "--inode"
                },
                {
                    "name": "-f --force",
                    "content": "This  will  override  some sensible defaults, such as not using a mounted volume.  Use\nthis option with caution.\n",
                    "flag": "-f",
                    "long": "--force"
                },
                {
                    "name": "-h --help",
                    "content": "Show a list of options with a brief description of each one.\n",
                    "flag": "-h",
                    "long": "--help"
                },
                {
                    "name": "-q --quiet",
                    "content": "Suppress some debug/warning/error messages.\n",
                    "flag": "-q",
                    "long": "--quiet"
                },
                {
                    "name": "-V --version",
                    "content": "Show the version number, copyright and license ntfscat.\n",
                    "flag": "-V",
                    "long": "--version"
                },
                {
                    "name": "-v --verbose",
                    "content": "Display more debug/warning/error messages.\n",
                    "flag": "-v",
                    "long": "--verbose"
                }
            ]
        },
        "EXAMPLES": {
            "content": "Display the contents of a file in the root of an NTFS volume.\n\nntfscat /dev/hda1 boot.ini\n\nDisplay the contents of a file in a subdirectory of an NTFS volume.\n\nntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts\n\nDisplay the contents of the $INDEXROOT attribute of the root directory (inode 5).\n\nntfscat /dev/hda1 -a INDEXROOT -i 5 | hexdump -C\n\n",
            "subsections": []
        },
        "BUGS": {
            "content": "There are no known problems with ntfscat.  If you find a bug please send an email  describing\nthe problem to the development team:\nntfs-3g-devel@lists.sf.net\n",
            "subsections": []
        },
        "AUTHORS": {
            "content": "ntfscat  was  written  by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.  It was\nported to ntfs-3g by Erik Larsson.\n",
            "subsections": []
        },
        "AVAILABILITY": {
            "content": "ntfscat is part of the ntfs-3g package and is available from:\nhttps://github.com/tuxera/ntfs-3g/wiki/\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "Read libntfs(8) for details how to access encrypted files.\n\nlibntfs(8), ntfsls(8), ntfsprogs(8)\n\n\n\nntfs-3g 2021.8.22                          September 2007                                 NTFSCAT(8)",
            "subsections": []
        }
    },
    "summary": "ntfscat - print NTFS files and streams on the standard output",
    "flags": [
        {
            "flag": "-a",
            "long": "--attribute",
            "arg": null,
            "description": "Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name. ┌───────────────────────────────────────────┐ │Hex Decimal Name │ │0x10 16 \"$STANDARDINFORMATION\" │ │0x20 32 \"$ATTRIBUTELIST\" │ │0x30 48 \"$FILENAME\" │ │0x40 64 \"$OBJECTID\" │ │0x50 80 \"$SECURITYDESCRIPTOR\" │ │0x60 96 \"$VOLUMENAME\" │ │0x70 112 \"$VOLUMEINFORMATION\" │ │0x80 128 \"$DATA\" │ │0x90 144 \"$INDEXROOT\" │ │0xA0 160 \"$INDEXALLOCATION\" │ │0xB0 176 \"$BITMAP\" │ │0xC0 192 \"$REPARSEPOINT\" │ │0xD0 208 \"$EAINFORMATION\" │ │0xE0 224 \"$EA\" │ │0xF0 240 \"$PROPERTYSET\" │ │0x100 256 \"$LOGGEDUTILITYSTREAM\" │ └───────────────────────────────────────────┘ Notes The attribute names may be given without the leading $ symbol. If you use the $ symbol, you must quote the name to prevent the shell interpreting the name."
        },
        {
            "flag": "-n",
            "long": "--attribute-name",
            "arg": null,
            "description": "Display this named attribute, stream."
        },
        {
            "flag": "-i",
            "long": "--inode",
            "arg": null,
            "description": "Specify a file by its inode number instead of its name."
        },
        {
            "flag": "-f",
            "long": "--force",
            "arg": null,
            "description": "This will override some sensible defaults, such as not using a mounted volume. Use this option with caution."
        },
        {
            "flag": "-h",
            "long": "--help",
            "arg": null,
            "description": "Show a list of options with a brief description of each one."
        },
        {
            "flag": "-q",
            "long": "--quiet",
            "arg": null,
            "description": "Suppress some debug/warning/error messages."
        },
        {
            "flag": "-V",
            "long": "--version",
            "arg": null,
            "description": "Show the version number, copyright and license ntfscat."
        },
        {
            "flag": "-v",
            "long": "--verbose",
            "arg": null,
            "description": "Display more debug/warning/error messages."
        }
    ],
    "examples": [
        "Display the contents of a file in the root of an NTFS volume.",
        "ntfscat /dev/hda1 boot.ini",
        "Display the contents of a file in a subdirectory of an NTFS volume.",
        "ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts",
        "Display the contents of the $INDEXROOT attribute of the root directory (inode 5).",
        "ntfscat /dev/hda1 -a INDEXROOT -i 5 | hexdump -C"
    ],
    "see_also": [
        {
            "name": "libntfs",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/libntfs/8/json"
        },
        {
            "name": "libntfs",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/libntfs/8/json"
        },
        {
            "name": "ntfsls",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/ntfsls/8/json"
        },
        {
            "name": "ntfsprogs",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/ntfsprogs/8/json"
        }
    ]
}