NTFSCAT(8) System Manager's Manual NTFSCAT(8)

# [NAME](#NAME)

ntfscat - print NTFS files and streams on the standard output

# [SYNOPSIS](#SYNOPSIS)

\[*options*] *device* \[*file*]

# [DESCRIPTION](#DESCRIPTION)

**ntfscat** will read a file or stream from an NTFS volume and display the contents on the standard output.

The case of the filename passed to **ntfscat** is ignored.

# [OPTIONS](#OPTIONS)

Below is a summary of all the options that **ntfscat** accepts. Nearly all options have two equivalent names. The short name is preceded by **-** and the long name is preceded by **--**. Any single letter options, that don't take an argument, can be combined into a single command, e.g. **-fv** is equivalent to **-f -v**. Long named options can be abbreviated to any unique prefix of their name.

[**-a**, **--attribute** TYPE](#a)

Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name.

**Hex** **Decimal** **Name** 0x10 16 "$STANDARD\_INFORMATION" 0x20 32 "$ATTRIBUTE\_LIST" 0x30 48 "$FILE\_NAME" 0x40 64 "$OBJECT\_ID" 0x50 80 "$SECURITY\_DESCRIPTOR" 0x60 96 "$VOLUME\_NAME" 0x70 112 "$VOLUME\_INFORMATION" 0x80 128 "$DATA" 0x90 144 "$INDEX\_ROOT" 0xA0 160 "$INDEX\_ALLOCATION" 0xB0 176 "$BITMAP" 0xC0 192 "$REPARSE\_POINT" 0xD0 208 "$EA\_INFORMATION" 0xE0 224 "$EA" 0xF0 240 "$PROPERTY\_SET" 0x100 256 "$LOGGED\_UTILITY\_STREAM"

**Notes** The attribute names may be given without the leading $ symbol.  
If you use the $ symbol, you must quote the name to prevent the shell interpreting the name.

[**-n**, **--attribute-name** NAME](#n)

Display this named attribute, stream.

[**-i**, **--inode** NUM](#i)

Specify a file by its inode number instead of its name.

[**-f**, **--force**](#f)

This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.

[**-h**, **--help**](#h)

Show a list of options with a brief description of each one.

[**-q**, **--quiet**](#q)

Suppress some debug/warning/error messages.

[**-V**, **--version**](#V)

Show the version number, copyright and license **ntfscat**.

[**-v**, **--verbose**](#v)

Display more debug/warning/error messages.

# [EXAMPLES](#EXAMPLES)

Display the contents of a file in the root of an NTFS volume.

**ntfscat /dev/hda1 boot.ini**

Display the contents of a file in a subdirectory of an NTFS volume.

**ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts**

Display the contents of the $INDEX\_ROOT attribute of the root directory (inode 5).

**ntfscat /dev/hda1 -a INDEX\_ROOT -i 5 | hexdump -C**

# [BUGS](#BUGS)

There are no known problems with **ntfscat**. If you find a bug please send an email describing the problem to the development team:  
ntfs-3g-devel@lists.sf.net

# [AUTHORS](#AUTHORS)

**ntfscat** was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.

# [AVAILABILITY](#AVAILABILITY)

**ntfscat** is part of the **ntfs-3g** package and is available from:  
https://github.com/tuxera/ntfs-3g/wiki/

# [SEE ALSO](#SEE_ALSO)

Read [**libntfs**(8)](/man/os/ntfs-3g/libntfs.8) for details how to access encrypted files.

[**libntfs**(8)](/man/os/ntfs-3g/libntfs.8), [**ntfsls**(8)](/man/os/ntfs-3g/ntfsls.8), [**ntfsprogs**(8)](/man/os/ntfs-3g/ntfsprogs.8)

September 2007 ntfs-3g 2026.9.28

---

Document: ntfscat(8) from ntfs-3g 2026.9.28-r0 (Chainguard OS)
Source: https://github.com/tuxera/ntfs-3g