NTFSCAT(8)

💅 NAME

okay so bestie, gather round: ntfscat is the manual name, and what it does is literally print NTFS files and streams straight to the standard output. that's it. that's the whole vibe. ✨

---

🦋 SYNOPSIS

[options] device [file]

yeah that's the whole shape of it — options first, then device, then file if you feel like it 🎀

---

🌸 DESCRIPTION

ntfscat reads a file or a stream off an NTFS volume and puts the contents on the standard output. simple. iconic. no cap. 🔥

the case of the filename you pass to ntfscat is ignored — so don't stress about caps, it literally does not care 💅

---

✨ OPTIONS ✨

so below is the full rundown of every option ntfscat accepts, and bestie there are two names for nearly all of them. the short name gets a - in front, the long name gets a --. any single-letter options that don't take an argument can be smooshed together into one command — like -fv is the exact same thing as -f -v. and long named options can be shortened to any unique prefix of their name 🫶

• -a, --attribute TYPE — show the contents of one particular attribute type. by default the unnamed $DATA attribute is what gets shown. you can name the attribute with a decimal number, a hex number, or its actual name 👑

the full attribute menu, in all its glory:

• 0x10 / 16 — "$STANDARD_INFORMATION"
• 0x20 / 32 — "$ATTRIBUTE_LIST"
• 0x30 / 48 — "$FILE_NAME"
• 0x40 / 64 — "$OBJECT_ID"
• 0x50 / 80 — "$SECURITY_DESCRIPTOR"
• 0x60 / 96 — "$VOLUME_NAME"
• 0x70 / 112 — "$VOLUME_INFORMATION"
• 0x80 / 128 — "$DATA"
• 0x90 / 144 — "$INDEX_ROOT"
• 0xA0 / 160 — "$INDEX_ALLOCATION"
• 0xB0 / 176 — "$BITMAP"
• 0xC0 / 192 — "$REPARSE_POINT"
• 0xD0 / 208 — "$EA_INFORMATION"
• 0xE0 / 224 — "$EA"
• 0xF0 / 240 — "$PROPERTY_SET"
• 0x100 / 256 — "$LOGGED_UTILITY_STREAM"

Notes: the attribute names can be given without the leading $ symbol. but if you do use the $ symbol, you gotta quote the name so the shell doesn't go feral and interpret it 🐚

• -n, --attribute-name NAME — show this named attribute, stream 💖
• -i, --inode NUM — pick a file by its inode number instead of by name 🔢
• -f, --force — overrides some sensible defaults, like the whole "don't use a mounted volume" thing.

⚠️ bestie, use this one with caution. like, for real. 🙈

• -h, --help — shows you the list of options with a lil description of each one 🎀
• -q, --quiet — suppresses some of the debug/warning/error messages 🤫
• -V, --version — shows the version number, copyright and license of ntfscat ⭐
• -v, --verbose — shows more debug/warning/error messages. the yapper mode 📣

---

🌈 EXAMPLES

display the contents of a file in the root of an NTFS volume:

ntfscat /dev/hda1 boot.ini

display the contents of a file in a subdirectory of an NTFS volume:

ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts

display the contents of the $INDEX_ROOT attribute of the root directory (inode 5):

ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C

---

💀 BUGS

there are no known problems with ntfscat. icon behavior honestly. but if you do find a bug, please send an email describing the problem to the development team at ntfs-3g-devel@lists.sf.net — they wanna know 🫶

---

👑 AUTHORS

ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. it was ported to ntfs-3g by Erik Larsson. legends, all of them 💜

---

🧚 AVAILABILITY

ntfscat is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

---

🍓 SEE ALSO

read libntfs(8) for the details on how to access encrypted files 🔐

libntfs(8), ntfsls(8), ntfsprogs(8)

---

💖 okay that's the whole page bestie, mwah! this one's from the ntfs-3g 2026.9.28 era, dated back in September 2007, and it lives under the manual page name NTFSCAT(8). go forth and cat some NTFS files, slay 💅✨