193 files changed, 80411 insertions, 44563 deletions
diff --git a/ntfsprogs/ntfscat.8 b/ntfsprogs/ntfscat.8 new file mode 100644 index 0000000..c240e34 --- a/dev/null +++ b/ntfsprogs/ntfscat.8 @@ -0,0 +1,136 @@ +.\" Copyright (c) 2003\-2005 Richard Russon. +.\" Copyright (c) 2007 Yura Pakhuchiy. +.\" This file may be copied under the terms of the GNU Public License. +.\" +.TH NTFSCAT 8 "September 2007" "ntfs-3g 2014.2.15" +.SH NAME +ntfscat \- print NTFS files and streams on the standard output +.SH SYNOPSIS +[\fIoptions\fR] \fIdevice \fR[\fIfile\fR] +.SH DESCRIPTION +.B ntfscat +will read a file or stream from an NTFS volume and display the contents +on the standard output. +.PP +The case of the filename passed to +.B ntfscat +is ignored. +.SH OPTIONS +Below is a summary of all the options that +.B ntfscat +accepts. Nearly all options have two equivalent names. The short name is +preceded by +.B \- +and the long name is preceded by +.BR \-\- . +Any single letter options, that don't take an argument, can be combined into a +single command, e.g. +.B \-fv +is equivalent to +.BR "\-f \-v" . +Long named options can be abbreviated to any unique prefix of their name. +.TP +\fB\-a\fR, \fB\-\-attribute\fR TYPE +Display the contents of a particular attribute type. By default, the unnamed +$DATA attribute will be shown. The attribute can be specified by a number +in decimal or hexadecimal, or by name. +.TS +box; +lB lB lB +l l l. +Hex Decimal Name +0x10 16 "$STANDARD_INFORMATION" +0x20 32 "$ATTRIBUTE_LIST" +0x30 48 "$FILE_NAME" +0x40 64 "$OBJECT_ID" +0x50 80 "$SECURITY_DESCRIPTOR" +0x60 96 "$VOLUME_NAME" +0x70 112 "$VOLUME_INFORMATION" +0x80 128 "$DATA" +0x90 144 "$INDEX_ROOT" +0xA0 160 "$INDEX_ALLOCATION" +0xB0 176 "$BITMAP" +0xC0 192 "$REPARSE_POINT" +0xD0 208 "$EA_INFORMATION" +0xE0 224 "$EA" +0xF0 240 "$PROPERTY_SET" +0x100 256 "$LOGGED_UTILITY_STREAM" +.TE +.sp +.sp +.B Notes +The attribute names may be given without the leading $ symbol. +.br +If you use the $ symbol, you must quote the name to prevent the shell +interpreting the name. +.TP +\fB\-n\fR, \fB\-\-attribute\-name\fR NAME +Display this named attribute, stream. +.TP +\fB\-i\fR, \fB\-\-inode\fR NUM +Specify a file by its inode number instead of its name. +.TP +\fB\-f\fR, \fB\-\-force\fR +This will override some sensible defaults, such as not using a mounted volume. +Use this option with caution. +.TP +\fB\-h\fR, \fB\-\-help\fR +Show a list of options with a brief description of each one. +.TP +\fB\-q\fR, \fB\-\-quiet\fR +Suppress some debug/warning/error messages. +.TP +\fB\-V\fR, \fB\-\-version\fR +Show the version number, copyright and license +.BR ntfscat . +.TP +\fB\-v\fR, \fB\-\-verbose\fR +Display more debug/warning/error messages. +.SH EXAMPLES +Display the contents of a file in the root of an NTFS volume. +.RS +.sp +.B ntfscat /dev/hda1 boot.ini +.sp +.RE +Display the contents of a file in a subdirectory of an NTFS volume. +.RS +.sp +.B ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts +.sp +.RE +Display the contents of the $INDEX_ROOT attribute of the root directory (inode +5). +.RS +.sp +.B ntfscat /dev/hda1 \-a INDEX_ROOT \-i 5 | hexdump \-C +.sp +.RE +.SH BUGS +There are no known problems with +.BR ntfscat . +If you find a bug please send an email describing the problem to the +development team: +.br +.nh +ntfs\-3g\-devel@lists.sf.net +.hy +.SH AUTHORS +.B ntfscat +was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. +It was ported to ntfs-3g by Erik Larsson. +.SH AVAILABILITY +.B ntfscat +is part of the +.B ntfs-3g +package and is available from: +.br +.nh +http://www.tuxera.com/community/ +.hy +.SH SEE ALSO +Read \fBlibntfs\fR(8) for details how to access encrypted files. +.sp +.BR libntfs (8), +.BR ntfsls (8), +.BR ntfsprogs (8) |