FSNTFSINFO(1)

📦
this version · 2 versions
, in debian trixie, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

🌸 fsntfsinfo — local manual, NTFS edition, no cap 🌸

okay so bestie, pull up a chair (or, like, don't, because you're at a terminal and chairs are far) because we're reading the manual for fsntfsinfo, and it lives in the LOCAL corner of the manual universe. it's giving "tiny tool, big forensic energy" and i'm obsessed ✨

💖 NAME 💖

fsntfsinfo — figures out information about a Windows NT File System (NTFS) volume. that's it, that's the whole job, and she does it flawlessly 👑

🎀 SYNOPSIS 🎀

fsntfsinfo [-B bodyfile] [-E mft_entry_index] [-F file_entry]
           [-o offset] [-dhHUvV] source

✨ DESCRIPTION ✨

so fsntfsinfo is a utility whose whole entire purpose is determining information about a Windows NT File System (NTFS) volume. main character behavior, honestly.

fsntfsinfo is part of the libfsntfs package. and libfsntfs is a library to access the Windows NT File System (NTFS) format. the whole family is iconic, ok?

source is the source file. (yeah, that's the sentence. she's short but she's working hard.)

the options are as follows, and we are going to go through every single one, no skipping, because i love you and i want you informed 🫶

  • -B bodyfile — output the file system hierarchy as a bodyfile. like, dump the whole tree in bodyfile format.
  • -d — calculate a MD5 hash of a file entry to include in the bodyfile. hashing bestie 💅
  • -E mft_entry_index — show information about a specific MFT entry index, or literally the string "all" if you want the whole buffet.
  • -F file_entry — show information about a specific file entry path.
  • -h — shows this help. hi, hello, here's how this works.
  • -H — shows the file system hierarcy (and yes, that is exactly how the man page spells it, i am simply relaying the lore, do not come for me 😭).
  • -o offset — specify the volume offset.
  • -U — shows information from the USN change journal ($UsnJrnl). the dollar sign is part of the name fr fr.
  • -v — verbose output to stderr.
  • -V — print version.

🌈 ENVIRONMENT 🌈

None. empty. nothing here. the environment section said "no thoughts, head empty" and honestly? respect.

🦋 FILES 🦋

None. also nothing. she keeps it minimal, periodt.

🍓 EXAMPLES 🍓

here's one, and it's cute:

# fsntfsinfo ntfs-img-kw-1.dd
fsntfsinfo 20160414

Windows NT File System information:

Volume information:
        Name                            : KW-SRCH-1
        Version                         : 3.1
        Serial number                   : ba50ed9250ed5623
        Cluster block size              : 512
        MFT entry size                  : 1024
        Index entry size                : 4096

look at that volume information just sitting there being informative. ate 💖

🧚 DIAGNOSTICS 🧚

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. and here's the lil caveat that matters: verbose and debug output are only printed when enabled at compilation. so if you turned on -v and got silence, that's not a bug, that's a build decision, bestie 🙈

💀 BUGS 💀

Please report bugs of any kind to <joachim.metz@gmail.com> or on the project website: https://github.com/libyal/libfsntfs/ — do it, don't be shy, they want to know 🫶

👑 AUTHOR 👑

These man pages were written by Joachim Metz. legend behavior.

Copyright 2010-2022, Joachim Metz <joachim.metz@gmail.com>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. (that uppercase NO is doing a lot of heavy lifting and she means it.)

🌟 SEE ALSO 🌟

  • libfsntfs

and that's the whole page!! thanks for reading the fsntfsinfo manual with me, you're doing amazing sweetie ✨

this was libfsntfs, dated July 28, 2022 — mwah, go forth and inspect your NTFS volumes responsibly 💅💖

📦 where this page comes from