path: root/ntfsprogs/ntfscat.8.in (plain)
blob: 478d9b4b233983296463a8ad395135ea79e6fd92

1	.\" Copyright (c) 2003\-2005 Richard Russon.
2	.\" Copyright (c) 2007 Yura Pakhuchiy.
3	.\" This file may be copied under the terms of the GNU Public License.
4	.\"
5	.TH NTFSCAT 8 "September 2007" "ntfs-3g @VERSION@"
6	.SH NAME
7	ntfscat \- print NTFS files and streams on the standard output
8	.SH SYNOPSIS
9	[\fIoptions\fR] \fIdevice \fR[\fIfile\fR]
10	.SH DESCRIPTION
11	.B ntfscat
12	will read a file or stream from an NTFS volume and display the contents
13	on the standard output.
14	.PP
15	The case of the filename passed to
16	.B ntfscat
17	is ignored.
18	.SH OPTIONS
19	Below is a summary of all the options that
20	.B ntfscat
21	accepts. Nearly all options have two equivalent names. The short name is
22	preceded by
23	.B \-
24	and the long name is preceded by
25	.BR \-\- .
26	Any single letter options, that don't take an argument, can be combined into a
27	single command, e.g.
28	.B \-fv
29	is equivalent to
30	.BR "\-f \-v" .
31	Long named options can be abbreviated to any unique prefix of their name.
32	.TP
33	\fB\-a\fR, \fB\-\-attribute\fR TYPE
34	Display the contents of a particular attribute type. By default, the unnamed
35	$DATA attribute will be shown. The attribute can be specified by a number
36	in decimal or hexadecimal, or by name.
37	.TS
38	box;
39	lB lB lB
40	l l l.
41	Hex Decimal Name
42	0x10 16 "$STANDARD_INFORMATION"
43	0x20 32 "$ATTRIBUTE_LIST"
44	0x30 48 "$FILE_NAME"
45	0x40 64 "$OBJECT_ID"
46	0x50 80 "$SECURITY_DESCRIPTOR"
47	0x60 96 "$VOLUME_NAME"
48	0x70 112 "$VOLUME_INFORMATION"
49	0x80 128 "$DATA"
50	0x90 144 "$INDEX_ROOT"
51	0xA0 160 "$INDEX_ALLOCATION"
52	0xB0 176 "$BITMAP"
53	0xC0 192 "$REPARSE_POINT"
54	0xD0 208 "$EA_INFORMATION"
55	0xE0 224 "$EA"
56	0xF0 240 "$PROPERTY_SET"
57	0x100 256 "$LOGGED_UTILITY_STREAM"
58	.TE
59	.sp
60	.sp
61	.B Notes
62	The attribute names may be given without the leading $ symbol.
63	.br
64	If you use the $ symbol, you must quote the name to prevent the shell
65	interpreting the name.
66	.TP
67	\fB\-n\fR, \fB\-\-attribute\-name\fR NAME
68	Display this named attribute, stream.
69	.TP
70	\fB\-i\fR, \fB\-\-inode\fR NUM
71	Specify a file by its inode number instead of its name.
72	.TP
73	\fB\-f\fR, \fB\-\-force\fR
74	This will override some sensible defaults, such as not using a mounted volume.
75	Use this option with caution.
76	.TP
77	\fB\-h\fR, \fB\-\-help\fR
78	Show a list of options with a brief description of each one.
79	.TP
80	\fB\-q\fR, \fB\-\-quiet\fR
81	Suppress some debug/warning/error messages.
82	.TP
83	\fB\-V\fR, \fB\-\-version\fR
84	Show the version number, copyright and license
85	.BR ntfscat .
86	.TP
87	\fB\-v\fR, \fB\-\-verbose\fR
88	Display more debug/warning/error messages.
89	.SH EXAMPLES
90	Display the contents of a file in the root of an NTFS volume.
91	.RS
92	.sp
93	.B ntfscat /dev/hda1 boot.ini
94	.sp
95	.RE
96	Display the contents of a file in a subdirectory of an NTFS volume.
97	.RS
98	.sp
99	.B ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts
100	.sp
101	.RE
102	Display the contents of the $INDEX_ROOT attribute of the root directory (inode
103	5).
104	.RS
105	.sp
106	.B ntfscat /dev/hda1 \-a INDEX_ROOT \-i 5 | hexdump \-C
107	.sp
108	.RE
109	.SH BUGS
110	There are no known problems with
111	.BR ntfscat .
112	If you find a bug please send an email describing the problem to the
113	development team:
114	.br
115	.nh
116	ntfs\-3g\-devel@lists.sf.net
117	.hy
118	.SH AUTHORS
119	.B ntfscat
120	was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits.
121	It was ported to ntfs-3g by Erik Larsson.
122	.SH AVAILABILITY
123	.B ntfscat
124	is part of the
125	.B ntfs-3g
126	package and is available from:
127	.br
128	.nh
129	http://www.tuxera.com/community/
130	.hy
131	.SH SEE ALSO
132	Read \fBlibntfs\fR(8) for details how to access encrypted files.
133	.sp
134	.BR libntfs (8),
135	.BR ntfsls (8),
136	.BR ntfsprogs (8)
137