NTFSSECAUDIT(8)

✨ NAME ✨

okay bestie, meet ntfssecaudit 💖 (the manual page for ntfssecaudit(8)) and it's all about NTFS Security Data Auditing 🔥

👑 SYNOPSIS 👑

ntfssecaudit [options] args

Where options is a combo of these 🎀:

• -a — full auditing of security data (Linux only) 🔍
• -b — backup ACLs 💾
• -e — setting extra backed-up parameters (goes with -s) ✨
• -h — displaying hexadecimal security descriptors saved in a file 🧾
• -r — recursing in a directory 🌀
• -s — setting backed-up ACLs 🛠️
• -u — getting a user mapping proposal 🫶
• -v — verbose (very verbose if you set it twice) 📢

And args defines the parameters and the set of files that get acted upon 🦋

Typing secaudit with no args will show you a summary of the available options 🙈

🌸 DESCRIPTION 🌸

okay so ntfssecaudit shows you the ownership and permissions of a set of files on an NTFS file system, and checks that they're consistent 💅 It can only be run in terminal mode, because there's no graphical user interface, so no fancy windows here 🥲

When a volume is needed, it has to be unmounted first, and the command has to be issued as root 👑 The volume can be either a block device (like a disk partition) or an image file 💜

When you're acting on a directory or volume, this command can spit out a LOT of information 😭 So it's highly advisable to redirect the output to a file, or pipe it into a text editor so you can actually read it 📝

🎀 OPTIONS 🎀

Here are the valid combos of options and arguments that ntfssecaudit accepts 💖 Every indicated argument is mandatory and must be unique. If you use wildcards, they have to resolve to a single name, no exceptions 🙅‍♀️

• -h file — Shows, in a human readable form, the hexadecimal security descriptors saved in file 🧾 This is how you can turn a verbose output into a very verbose one 📢
• -a[rv] volume — Audits the volume 🔍 All the global security data on the volume gets scanned and errors get displayed. Add -r and every file and directory gets scanned too, and their relations to the global security data get checked. Heads up, this can produce a lot of data 🌊

This option does nothing on volumes formatted for old NTFS versions (pre NTFS 3.0), because those volumes have no global security data 🥲

If errors pop up, it's a good idea to repair the volume with an appropriate tool, like chkdsk on Windows 🔧

• [-v] volume file — Displays the security parameters of file ✨ That means its interpreted Linux mode (rwx flags in octal) and its Posix ACL[1], its security key if it has one, and its security descriptor if you're in verbose mode 💅
• -r[v] volume directory — Shows the security parameters of all files and subdirectories in directory 🌀 You get their interpreted Linux mode (rwx flags in octal) and Posix ACL[1], their security key if any, and their security descriptor if verbose output is on 🦋
• -b[v] volume [directory] — Recursively extracts the NTFS ACLs of files in volume and directory to standard output 💾
• -s[ev] volume [backup-file] — Sets the NTFS ACLs as indicated in backup-file or standard input 🛠️ The input data must have been created on Linux, bestie, no exceptions 🐧 With -e, it also sets extra parameters (currently Windows attrib) ✨
• volume perms file — Sets the security parameters of file to perms 🎯 perms is either the Linux requested mode (rwx flags, written in octal form like chmod) or a Posix ACL[1] (written like setfacl -m). This sets a new ACL that's effective for both Linux and Windows 🫶
• -r[v] volume perms directory — Sets the security parameters of all files and subdirectories in directory to perms 🌈 perms is the Linux requested mode (rwx flags, octal form like chmod), or a Posix ACL[1] (written like setfacl -m). This sets new ACLs that are effective for both Linux and Windows 💖
• [-v] mounted-file — Displays the security parameters of mounted-file 👀 That's its interpreted Linux mode (rwx flags in octal) and Posix ACL[1], its security key if any, and its security descriptor if you're verbose. This one's a special case that acts on a mounted file (or directory) and does NOT need root 🙌 The Posix ACL interpretation only shows up if you give the full path to mounted-file from the root of the global file tree 🌳
• -u[v] mounted-file — Displays a proposed content for a user mapping file 🫶 It's based on the ownership parameters Windows set on mounted-file, assuming this file was created on Windows by the user who should get mapped to the current Linux user 🪞 Copy the displayed info into the file .NTFS-3G/UserMapping, where .NTFS-3G is a hidden subdirectory at the root of the partition you want the mapping for 🧚 Once that's done, files created on that partition will be owned the same way as the original mounted-file 💅

📝 NOTE 📝

[1] This works provided the POSIX ACL option was selected at compile time 🛠️ A Posix ACL specification looks like "[d:]{ugmo}:[id]:[perms],...", where id is a numeric user or group id, and perms is an octal digit or a set from the letters r, w and x 🌸

Example: "u::7,g::5,o:0,u:510:rwx,g:500:5,d:u:510:7" 🍓

🧪 EXAMPLES 🧪

Audit the global security data on /dev/sda1 🔍

ntfssecaudit -ar /dev/sda1

Display the ownership and permissions parameters for files in the directory /audio/music on device /dev/sda5, excluding sub-directories 🎵

ntfssecaudit /dev/sda5 /audio/music

Set all files in the directory /audio/music on device /dev/sda5 as writeable by the owner and read-only for everybody else 🔒

ntfssecaudit -r /dev/sda5 644 /audio/music

🚦 EXIT CODES 🚦

ntfssecaudit exits with a value of 0 when no error was detected 🥳 and with a value of 1 when an error was detected 💀

🐛 KNOWN ISSUES 🐛

Please peek at this page for common questions and known issues 👀

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ/

If you find a new one in the latest release of the software, send an email describing it in detail 💌 You can contact the development team at ntfs-3g-devel@lists.sf.net 🫶

👩‍💻 AUTHORS 👩‍💻

ntfssecaudit has been developed by Jean-Pierre André 👑

🌈 THANKS 🌈

Several people made heroic efforts, often over five or more years, which resulted in the ntfs-3g driver 😭 The most important ones are Anton Altaparmakov, Richard Russon, Szabolcs Szakacsits, Yura Pakhuchiy, Yuval Fledel, and the author of the groundbreaking FUSE filesystem development framework, Miklos Szeredi 💖✨

🔗 SEE ALSO 🔗

ntfsprogs(8), attr(5), getfattr(1) 🦋

Okay that's a wrap, bestie 🎀 This was ntfssecaudit version 1.5.0 from February 2010, and it's still giving main character energy 🌟💅