NTFS-3G(8)

💖 NTFS-3G — Third Generation Read/Write NTFS Driver 💖

okay bestie, gather round, bc this is NTFS-3G(8), from the System Manager's Manual (yes the header goes NTFS-3G(8) System Manager's Manual NTFS-3G(8), we love a symmetrical moment), and it's literally the whole NTFS driver page. it's LONG. it's giving encyclopedia but make it serve. let's go 🦋

---

✨ SYNOPSIS ✨

the ways you can summon this thing:

ntfs-3g [-o option[,...]]  volume mount_point
mount -t ntfs-3g [-o option[,...]]  volume mount_point
lowntfs-3g [-o option[,...]]  volume mount_point
mount -t lowntfs-3g [-o option[,...]]  volume mount_point

four whole moods. same energy. 💅

---

🌸 DESCRIPTION 🌸

so ntfs-3g is an NTFS driver, and not to be dramatic but it does a lot. it can:

• create, remove, rename, move files, directories, hard links, and streams
• read and write files, including streams, sparse files and transparently compressed files
• handle special files like symbolic links, devices, and FIFOs
• and on top of all that, it gives you standard management of file ownership and permissions, including POSIX ACLs

it comes in two variants — ntfs-3g and lowntfs-3g — with a few differences, which get mentioned below in the relevant options' descriptions. no cap, the differences are in there, you just gotta read the options. 👑

the volume you're mounting can be either a block device or an image file, and you can do it either by using the mount command or by starting the drive.

---

🪟 Windows hibernation and fast restarting

this is the part where I need you to pay attention, bestie, because this one bites people.

on computers that can dual-boot into Windows or Linux, Windows has to be fully shut down before booting into Linux. otherwise the NTFS file systems on internal disks may be left in an inconsistent state, and — plot twist — changes made by Linux may be ignored by Windows. 😭

so Windows may not be left in hibernation when starting Linux, all to avoid inconsistencies. and moreover, the fast restart feature on recent Windows systems has to be disabled. how? by issuing the following Windows command as an Administrator, which disables both hibernation and fast restarting:

powercfg /h off

⚠️ if either Windows is hibernated or its fast restart is enabled, partitions on internal disks are forced to be mounted in read-only mode. that's not a vibe. that's a punishment. do the powercfg thing. 🙈

---

🔐 Access Handling and Security

by default, files and directories are owned by the effective user and group of the mounting process, and everybody has full read, write, execution and directory browsing permissions. everyone!! the whole group chat!! 💀

you can also assign permissions to a single user by using the uid and/or the gid options together with the umask, or fmask and dmask options.

and doing so, all Windows users have full access to the files created by ntfs-3g.

but — and here's the glow-up — by setting the permissions option, you can benefit from the full ownership and permissions features as defined by POSIX. and moreover, by defining a Windows-to-Linux user mapping, the ownerships and permissions are even applied to Windows users and conversely. mutual. reciprocal. iconic. 🫶

oh and if ntfs-3g is set setuid-root then non-root users will be also able to mount volumes. slay for them.

---

📛 Windows Filename Compatibility

NTFS supports several filename namespaces: DOS, Win32 and POSIX. the ntfs-3g driver handles all of them, but it always creates new files in the POSIX namespace for maximum portability and interoperability reasons.

what does that mean for you? it means filenames are case sensitive and all characters are allowed except / and \0. this is perfectly legal on Windows, though some application may get confused. 🥴 the option windows_names may be used to apply Windows restrictions to new file names.

---

🌊 Alternate Data Streams (ADS)

NTFS stores all data in streams. every file has exactly one unnamed data stream and can have many named data streams. the size of a file is the size of its unnamed data stream. by default, ntfs-3g will only read the unnamed data stream.

by using the option streams_interface=windows, with the ntfs-3g driver (not possible with lowntfs-3g, sorry bestie), you will be able to read any named data streams, simply by specifying the stream name after a colon. for example:

cat some.mp3:artist

named data streams act like normal files, so you can read from them, write to them and even delete them (using rm). and you can list all the named data streams a file has by getting the ntfs.streams.list extended attribute. it's giving main character data that nobody knew about. 👑

---

🎀 OPTIONS 🎀

below is a summary of the options that ntfs-3g accepts. buckle up.

• acl — enable setting Posix ACLs on created files and use them for access control. this option is only available on specific builds. it is set by default when a user mapping file is present and the permissions mount option is not set.
• allow_other — this option overrides the security measure restricting file access to the user mounting the filesystem. this option is only allowed to root, but that restriction can be overridden by the user_allow_other option in the /etc/fuse.conf file. root privilege + one config file = loophole. iykyk.
• atime, noatime, relatime — a little trio, let's take them one at a time:
  • the atime option updates inode access time for each access.
  • the noatime option disables inode access time updates, which can speed up file operations and prevent sleeping (notebook) disks spinning up too often, thus saving energy and disk lifetime. your laptop battery says thank you. 🔋
  • the relatime option is very similar to noatime. it updates inode access times relative to modify or change time. the access time is only updated if the previous access time was earlier than the current modify or change time. unlike noatime this option doesn't break applications that need to know if a file has been read since the last time it was modified. this is the default behaviour. ✨
• big_writes — this option prevents fuse from splitting write buffers into 4K chunks, enabling big write buffers to be transferred from the application in a single step (up to some system limit, generally 128K bytes).
• compression — this option enables creating new transparently compressed files in directories marked for compression. a directory is marked for compression by setting the bit 11 (value 0x00000800) in its Windows attribute. in such a directory, new files are created compressed and new subdirectories are themselves marked for compression. the option and the flag have no effect on existing files. currently this is the default option.
• debug — makes ntfs-3g (or lowntfs-3g) print a lot of debug output from libntfs-3g and FUSE. a lot a lot. 😭
• delay_mtime[= value] — only update the file modification time and the file change time of a file when it is closed or when the indicated delay since the previous update has elapsed. the argument is a number of seconds, with a default value of 60. this is mainly useful for big files which are kept open for a long time and written to without changing their size, such as databases or file system images mounted as loop.
• dmask=value — set the bitmask of the directory permissions that are not present. the value is given in octal. the default value is 0 which means full access to everybody.
• efs_raw — this option should only be used in backup or restore situation. it changes the apparent size of files and the behavior of read and write operation so that encrypted files can be saved and restored without being decrypted. the user.ntfs.efsinfo extended attribute has also to be saved and restored for the file to be decrypted. read that twice, it's a whole package deal. 💅
• fmask=value — set the bitmask of the file permissions that are not present. the value is given in octal. the default value is 0 which means full access to everybody.
• force — this option is obsolete. it has been superseded by the recover and norecover options. she's retired, let her rest. 🪦
• hide_dot_files — set the hidden flag in the NTFS attribute for created files and directories whose first character of the name is a dot. such files and directories normally do not appear in directory listings, and when the flag is set they do not appear in Windows directory displays either. when a file is renamed or linked with a new name, the hidden flag is adjusted to the latest name. sneaky. stealth mode. 🥷
• hide_hid_files — hide the hidden files and directories in directory listings, the hidden files and directories being the ones whose NTFS attribute have the hidden flag set. the hidden files will not be selected when using wildcards in commands, but all files and directories remain accessible by full name — for example you can always display the Windows trash bin directory by: ls -ld '$RECYCLE.BIN'.
• ignore_case (only with lowntfs-3g) — ignore character case when accessing a file (FOO, Foo, foo, etc. designate the same file). all files are displayed with lower case in directory listings.
• inherit — when creating a new file, set its initial protections according to inheritance rules defined in parent directory. these rules deviate from Posix specifications, but yield a better Windows compatibility. the permissions (or acl) option or a valid user mapping file is required for this option to be effective.
• locale=value — this option can be useful when wanting a language specific locale environment. it is however discouraged, as it leads to files with untranslatable characters to not be visible. 😭 don't do it, bestie.
• max_read=value — with this option the maximum size of read operations can be set. the default is infinite. note that the size of read requests is limited anyway by the system (usually to 128kbyte).
• no_def_opts — by default ntfs-3g acts as if silent (ignore permission errors when permissions are not enabled), allow_other (allow any user to access files) and nonempty (allow mounting on non-empty directories) were set, and no_def_opts cancels these default options. it's the anti-default. the un-default. 💅
• no_detach — makes ntfs-3g to not detach from terminal and print some debug output. she stays. she's clingy. we love her. 🫶
• nocompression — this option disables creating new transparently compressed files in directories marked for compression. existing compressed files can still be read and updated though, no worries.
• norecover — do not try to mount a partition which was not unmounted properly by Windows. if it's messy, she's not going in there. 🙈
• permissions — set standard permissions on created files and use standard access control. this option is set by default when a user mapping file is present.
• posix_nlink — compute the count of hard links of a file or directory according to the POSIX specifications. when this option is not set, a count of 1 is set for directories, and the short name of files is accounted for. using the option entails some penalty as the count is not stored and has to be computed. accuracy costs, bestie. 💀
• recover — recover and try to mount a partition which was not unmounted properly by Windows. the Windows logfile is cleared, which may cause inconsistencies. currently this is the default option.

---

(okay bestie there's more — this page keeps going, don't wander off yet 🌈)

• remove_hiberfile — ok so when the NTFS volume is hibernated, a read-write mount gets straight up denied and you're forced into read-only. Your two options are either resume Windows and shut it down properly, or use this flag, which yeets the Windows hibernation file. Heads up tho: this means the saved Windows session is completely lost. Do it under your own responsibility, bestie, no takebacks. 😭
• ro — mount the filesystem read-only. Iconic move when Windows is hibernated or the NTFS journal file is unclean. 🧊
• show_sys_files — this one shows the metafiles in directory listings. Default behaviour is to hide them (they're the special files that store the NTFS structure). Please note that even with this option on, "$MFT" may still not be visible because of a glibc bug — not our fault, she's just built different. And regardless of show_sys_files, all files are accessible by name, so like, you can always do "ls -l '$UpCase'". 💅
• silent — do nothing, returning zero errors, on chmod and chown operations and on permission checking errors, when the permissions option is not set and no user mapping file is defined. This one is on by default, and when it's set off (through option no_def_opts) the ownership and permissions parameters have to be set. 🫶
• special_files=mode — picks a mode for representing a special file to be created (symbolic link, socket, fifo, character or block device). The mode can be interix or wsl, and existing files in either mode are recognized no matter which mode you selected. interix is the traditional mode and the default; wsl is interoperable with Windows WSL, but it is not compatible with Windows versions earlier than Windows 10. Neither mode is interoperable with Windows. 💀
• streams_interface=mode — controls how the user can access Alternate Data Streams (ADS), aka named data streams. The mode can be none, windows or xattr. Set it to none and you get no access to the named data streams. Set it to windows (not possible with lowntfs-3g) and you can access them just like in Windows (eg. cat file:stream). Set it to xattr and the named data streams get mapped to extended attributes, so you can manipulate them with {get,set}fattr utilities. Default is xattr. ✨
• uid=value and gid=value — set the owner and the group of files and directories. Values are numerical. Defaults are the uid and gid of the current process. 👑
• umask=value — sets the bitmask of the file and directory permissions that are not present. Value is given in octal. Default is 0, which means full access to everybody. 🌈
• usermapping=file-name — use file-name as the user mapping file instead of the default .NTFS-3G/UserMapping. If file-name defines a full path, the file must be located on a partition previously mounted. If it defines a relative path, it's interpreted relative to the root of the NTFS partition being mounted.

When a user mapping file is defined, the options uid=, gid=, umask=, fmask=, dmask= and silent are ignored. 🙈

• user_xattr — same as streams_interface=xattr. Zero notes. 🎀
• windows_names — stops files, directories and extended attributes from being created with a name Windows won't allow, because:
  • it contains some not allowed character,
  • or the last character is a space or a dot,
  • or the name is reserved.

The forbidden characters are the nine characters `" * / : < > ? \ |` and those whose code is less than 0x20, and the reserved names are CON, PRN, AUX, NUL, COM1..COM9, LPT1..LPT9, with no suffix or followed by a dot.

Existing such files can still be read (and renamed). 💖

---

🦋 USER MAPPING 🦋

NTFS uses specific ids to record the ownership of files instead of the uid (user id) and gid (group id) Linux uses. So basically a mapping between the ids has to be defined for ownerships to be recorded into NTFS files and recognized. It's giving translation layer. ✨

By default, this mapping is fetched from the file .NTFS-3G/UserMapping located in the NTFS partition. The option usermapping= may be used to define another location. When the option permissions is set and no mapping file is found, a default mapping is used.

Each line in the user mapping file defines a mapping. It's organized in three fields separated by colons. The first field identifies a uid, the second field identifies a gid, and the third one identifies the corresponding NTFS id, known as a SID. The uid and the gid are optional, and defining both of them for the same SID is not recommended. 🫣

If no interoperation with Windows is needed, you can use the option permissions to define a standard mapping. Alternately, you may define your own mapping by setting a single default mapping with no uid and gid. In both cases, files created on Linux will appear to Windows as owned by a foreign user, and files created on Windows will appear to Linux as owned by root. Just copy the example below and replace the 9 and 10-digit numbers by any number not greater than 4294967295. The resulting behavior is the same as the one with the option permission set with no ownership option and no user mapping file available.

::S-1-5-21-3141592653-589793238-462643383-10000

If a strong interoperation with Windows is needed, the mapping has to be defined for each user and group known to both systems, and the SIDs used by Windows have to be collected. That leads to a user mapping file like:

john::S-1-5-21-3141592653-589793238-462643383-1008
mary::S-1-5-21-3141592653-589793238-462643383-1009
:smith:S-1-5-21-3141592653-589793238-462643383-513
::S-1-5-21-3141592653-589793238-462643383-10000

The utility ntfsusermap may be used to create such a user mapping file. 🛠️

---

🌸 EXAMPLES 🌸

Mount /dev/sda1 to /mnt/windows:

ntfs-3g /dev/sda1 /mnt/windows

or

mount -t ntfs-3g /dev/sda1 /mnt/windows

Mount the ntfs data partition /dev/sda3 to /mnt/data with standard Linux permissions applied:

ntfs-3g -o permissions /dev/sda3 /mnt/data

or

mount -t ntfs-3g -o permissions /dev/sda3 /mnt/data

Read-only mount /dev/sda5 to /home/user/mnt and make user with uid 1000 the owner of all files:

ntfs-3g /dev/sda5 /home/user/mnt -o ro,uid=1000

/etc/fstab entry for the above (the sixth and last field has to be zero to avoid a file system check at boot time):

/dev/sda5 /home/user/mnt ntfs-3g ro,uid=1000 0 0

Unmount /mnt/windows:

umount /mnt/windows

---

⭐ EXIT CODES ⭐

To facilitate the use of the ntfs-3g driver in scripts, an exit code is returned to give an indication of the mountability status of a volume. Value 0 means success, and all other ones mean an error. The unique error codes are documented in the ntfs-3g.probe(8) manual page. 📜

---

💜 KNOWN ISSUES 💜

Please see

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ

for common questions and known issues. If you would find a new one in the latest release of the software, then please post an ntfs-3g issue describing it in detail so that the development team can be aware of the issue and take care of it:

https://github.com/tuxera/ntfs-3g/issues

---

👑 AUTHORS 👑

ntfs-3g was based on and a major improvement to ntfsmount and libntfs, which were written by Yura Pakhuchiy and the Linux-NTFS team. The improvements were made, the ntfs-3g project was initiated and is currently led by long time Linux-NTFS team developer Szabolcs Szakacsits (szaka@tuxera.com). 🫶

---

🥹 THANKS 🥹

Several people made heroic efforts, often over five or more years, which resulted in the ntfs-3g driver. Most importantly they are Anton Altaparmakov, Jean-Pierre André, Erik Larsson, Richard Russon, Szabolcs Szakacsits, Yura Pakhuchiy, Yuval Fledel, and the author of the groundbreaking FUSE filesystem development framework, Miklos Szeredi. Absolute legends, every single one. 💐

---

🎀 SEE ALSO 🎀

ntfs-3g.probe(8), ntfsprogs(8), attr(5), getfattr(1)

---

ok that's the whole thing bestie, you ate that 💅 This was ntfs-3g, version 2026.7.7, dated Aug 2021, from NTFS-3G(8). Go forth and mount responsibly ✨🦋💖