{
    "content": [
        {
            "type": "text",
            "text": "# ntfscat(8) (man)\n\n**Summary:** ntfscat - print NTFS files and streams on the standard output\n\n**Synopsis:** [options] device [file]\n\n## Flags\n\n| Flag | Long | Arg | Description |\n|------|------|-----|-------------|\n| -a | --attribute | — | Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribut |\n| -n | --attribute-name | — | Display this named attribute, stream. |\n| -i | --inode | — | Specify a file by its inode number instead of its name. |\n| -f | --force | — | This will override some sensible defaults, such as not using a mounted volume. Use this option with caution. |\n| -h | --help | — | Show a list of options with a brief description of each one. |\n| -q | --quiet | — | Suppress some debug/warning/error messages. |\n| -V | --version | — | Show the version number, copyright and license ntfscat. |\n| -v | --verbose | — | Display more debug/warning/error messages. |\n\n## Examples\n\n- `Display the contents of a file in the root of an NTFS volume.`\n- `ntfscat /dev/hda1 boot.ini`\n- `Display the contents of a file in a subdirectory of an NTFS volume.`\n- `ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts`\n- `Display the contents of the $INDEXROOT attribute of the root directory (inode 5).`\n- `ntfscat /dev/hda1 -a INDEXROOT -i 5 | hexdump -C`\n\n## See Also\n\n- libntfs(8)\n- libntfs(8)\n- ntfsls(8)\n- ntfsprogs(8)\n\n## Section Outline\n\n- **NAME** (2 lines)\n- **SYNOPSIS** (2 lines)\n- **DESCRIPTION** (5 lines)\n- **OPTIONS** (6 lines) — 8 subsections\n  - -a --attribute (28 lines)\n  - -n --attribute-name (2 lines)\n  - -i --inode (2 lines)\n  - -f --force (3 lines)\n  - -h --help (2 lines)\n  - -q --quiet (2 lines)\n  - -V --version (2 lines)\n  - -v --verbose (2 lines)\n- **EXAMPLES** (13 lines)\n- **BUGS** (4 lines)\n- **AUTHORS** (3 lines)\n- **AVAILABILITY** (3 lines)\n- **SEE ALSO** (7 lines)\n\n## Full Content\n\n### NAME\n\nntfscat - print NTFS files and streams on the standard output\n\n### SYNOPSIS\n\n[options] device [file]\n\n### DESCRIPTION\n\nntfscat  will read a file or stream from an NTFS volume and display the contents on the stan‐\ndard output.\n\nThe case of the filename passed to ntfscat is ignored.\n\n### OPTIONS\n\nBelow is a summary of all the options that ntfscat accepts.   Nearly  all  options  have  two\nequivalent  names.  The short name is preceded by - and the long name is preceded by --.  Any\nsingle letter options, that don't take an argument, can be combined into  a  single  command,\ne.g.  -fv is equivalent to -f -v.  Long named options can be abbreviated to any unique prefix\nof their name.\n\n#### -a --attribute\n\nDisplay the contents of a particular attribute type.  By default,  the  unnamed  $DATA\nattribute  will  be  shown.   The attribute can be specified by a number in decimal or\nhexadecimal, or by name.\n\n┌───────────────────────────────────────────┐\n│Hex     Decimal   Name                     │\n│0x10    16        \"$STANDARDINFORMATION\"  │\n│0x20    32        \"$ATTRIBUTELIST\"        │\n│0x30    48        \"$FILENAME\"             │\n│0x40    64        \"$OBJECTID\"             │\n│0x50    80        \"$SECURITYDESCRIPTOR\"   │\n│0x60    96        \"$VOLUMENAME\"           │\n│0x70    112       \"$VOLUMEINFORMATION\"    │\n│0x80    128       \"$DATA\"                  │\n│0x90    144       \"$INDEXROOT\"            │\n│0xA0    160       \"$INDEXALLOCATION\"      │\n│0xB0    176       \"$BITMAP\"                │\n│0xC0    192       \"$REPARSEPOINT\"         │\n│0xD0    208       \"$EAINFORMATION\"        │\n│0xE0    224       \"$EA\"                    │\n│0xF0    240       \"$PROPERTYSET\"          │\n│0x100   256       \"$LOGGEDUTILITYSTREAM\" │\n└───────────────────────────────────────────┘\n\nNotes The attribute names may be given without the leading $ symbol.\nIf you use the $ symbol, you must quote the name to prevent the shell interpreting the\nname.\n\n#### -n --attribute-name\n\nDisplay this named attribute, stream.\n\n#### -i --inode\n\nSpecify a file by its inode number instead of its name.\n\n#### -f --force\n\nThis  will  override  some sensible defaults, such as not using a mounted volume.  Use\nthis option with caution.\n\n#### -h --help\n\nShow a list of options with a brief description of each one.\n\n#### -q --quiet\n\nSuppress some debug/warning/error messages.\n\n#### -V --version\n\nShow the version number, copyright and license ntfscat.\n\n#### -v --verbose\n\nDisplay more debug/warning/error messages.\n\n### EXAMPLES\n\nDisplay the contents of a file in the root of an NTFS volume.\n\nntfscat /dev/hda1 boot.ini\n\nDisplay the contents of a file in a subdirectory of an NTFS volume.\n\nntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts\n\nDisplay the contents of the $INDEXROOT attribute of the root directory (inode 5).\n\nntfscat /dev/hda1 -a INDEXROOT -i 5 | hexdump -C\n\n### BUGS\n\nThere are no known problems with ntfscat.  If you find a bug please send an email  describing\nthe problem to the development team:\nntfs-3g-devel@lists.sf.net\n\n### AUTHORS\n\nntfscat  was  written  by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.  It was\nported to ntfs-3g by Erik Larsson.\n\n### AVAILABILITY\n\nntfscat is part of the ntfs-3g package and is available from:\nhttps://github.com/tuxera/ntfs-3g/wiki/\n\n### SEE ALSO\n\nRead libntfs(8) for details how to access encrypted files.\n\nlibntfs(8), ntfsls(8), ntfsprogs(8)\n\n\n\nntfs-3g 2021.8.22                          September 2007                                 NTFSCAT(8)\n\n"
        }
    ],
    "structuredContent": {
        "command": "ntfscat",
        "section": "8",
        "mode": "man",
        "summary": "ntfscat - print NTFS files and streams on the standard output",
        "synopsis": "[options] device [file]",
        "flags": [
            {
                "flag": "-a",
                "long": "--attribute",
                "arg": null,
                "description": "Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name. ┌───────────────────────────────────────────┐ │Hex Decimal Name │ │0x10 16 \"$STANDARDINFORMATION\" │ │0x20 32 \"$ATTRIBUTELIST\" │ │0x30 48 \"$FILENAME\" │ │0x40 64 \"$OBJECTID\" │ │0x50 80 \"$SECURITYDESCRIPTOR\" │ │0x60 96 \"$VOLUMENAME\" │ │0x70 112 \"$VOLUMEINFORMATION\" │ │0x80 128 \"$DATA\" │ │0x90 144 \"$INDEXROOT\" │ │0xA0 160 \"$INDEXALLOCATION\" │ │0xB0 176 \"$BITMAP\" │ │0xC0 192 \"$REPARSEPOINT\" │ │0xD0 208 \"$EAINFORMATION\" │ │0xE0 224 \"$EA\" │ │0xF0 240 \"$PROPERTYSET\" │ │0x100 256 \"$LOGGEDUTILITYSTREAM\" │ └───────────────────────────────────────────┘ Notes The attribute names may be given without the leading $ symbol. If you use the $ symbol, you must quote the name to prevent the shell interpreting the name."
            },
            {
                "flag": "-n",
                "long": "--attribute-name",
                "arg": null,
                "description": "Display this named attribute, stream."
            },
            {
                "flag": "-i",
                "long": "--inode",
                "arg": null,
                "description": "Specify a file by its inode number instead of its name."
            },
            {
                "flag": "-f",
                "long": "--force",
                "arg": null,
                "description": "This will override some sensible defaults, such as not using a mounted volume. Use this option with caution."
            },
            {
                "flag": "-h",
                "long": "--help",
                "arg": null,
                "description": "Show a list of options with a brief description of each one."
            },
            {
                "flag": "-q",
                "long": "--quiet",
                "arg": null,
                "description": "Suppress some debug/warning/error messages."
            },
            {
                "flag": "-V",
                "long": "--version",
                "arg": null,
                "description": "Show the version number, copyright and license ntfscat."
            },
            {
                "flag": "-v",
                "long": "--verbose",
                "arg": null,
                "description": "Display more debug/warning/error messages."
            }
        ],
        "examples": [
            "Display the contents of a file in the root of an NTFS volume.",
            "ntfscat /dev/hda1 boot.ini",
            "Display the contents of a file in a subdirectory of an NTFS volume.",
            "ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts",
            "Display the contents of the $INDEXROOT attribute of the root directory (inode 5).",
            "ntfscat /dev/hda1 -a INDEXROOT -i 5 | hexdump -C"
        ],
        "see_also": [
            {
                "name": "libntfs",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/libntfs/8/json"
            },
            {
                "name": "libntfs",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/libntfs/8/json"
            },
            {
                "name": "ntfsls",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/ntfsls/8/json"
            },
            {
                "name": "ntfsprogs",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/ntfsprogs/8/json"
            }
        ],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "SYNOPSIS",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "DESCRIPTION",
                "lines": 5,
                "subsections": []
            },
            {
                "name": "OPTIONS",
                "lines": 6,
                "subsections": [
                    {
                        "name": "-a --attribute",
                        "lines": 28,
                        "flag": "-a",
                        "long": "--attribute"
                    },
                    {
                        "name": "-n --attribute-name",
                        "lines": 2,
                        "flag": "-n",
                        "long": "--attribute-name"
                    },
                    {
                        "name": "-i --inode",
                        "lines": 2,
                        "flag": "-i",
                        "long": "--inode"
                    },
                    {
                        "name": "-f --force",
                        "lines": 3,
                        "flag": "-f",
                        "long": "--force"
                    },
                    {
                        "name": "-h --help",
                        "lines": 2,
                        "flag": "-h",
                        "long": "--help"
                    },
                    {
                        "name": "-q --quiet",
                        "lines": 2,
                        "flag": "-q",
                        "long": "--quiet"
                    },
                    {
                        "name": "-V --version",
                        "lines": 2,
                        "flag": "-V",
                        "long": "--version"
                    },
                    {
                        "name": "-v --verbose",
                        "lines": 2,
                        "flag": "-v",
                        "long": "--verbose"
                    }
                ]
            },
            {
                "name": "EXAMPLES",
                "lines": 13,
                "subsections": []
            },
            {
                "name": "BUGS",
                "lines": 4,
                "subsections": []
            },
            {
                "name": "AUTHORS",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "AVAILABILITY",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "SEE ALSO",
                "lines": 7,
                "subsections": []
            }
        ]
    }
}