Linux Commands Examples

A great documentation place for Linux commands


print NTFS files and streams on the standard output

see also : ntfsls


[options] device [file]

add an example, a script, a trick and tips

: email address (won't be displayed)
: name

Step 2

Thanks for this example ! - It will be moderated and published shortly.

Feel free to post other examples
Oops ! There is a tiny cockup. A damn 404 cockup. Please contact the loosy team who maintains and develops this wonderful site by clicking in the mighty feedback button on the side of the page. Say what happened. Thanks!



Display the contents of a file in the root of an NTFS volume.

ntfscat /dev/hda1 boot.ini

Display the contents of a file in a subdirectory of an NTFS volume.

ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts

Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5).

ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C

echo "Copy:" $file
sudo ntfscat -q $1 $2\/$file > $3\/$file # Copy it
if [ ${?} -eq 0 ]
"${TOOLS_FOLDER}"/ntfscat -f "${NTFS_DEVICE}" /windows/panther/unattend.XML > /tmp/unattend.xml


ntfscat will read a file or stream from an NTFS volume and display the contents on the standard output.

The case of the filename passed to ntfscat is ignored.


Below is a summary of all the options that ntfscat accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don’t take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.
, --attribute TYPE

Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name.

Image grohtml-140821.png

Notes The attribute names may be given without the leading $ symbol.
If you use the $ symbol, you must quote the name to prevent the shell interpreting the name.

-n, --attribute-name NAME

Display this named attribute, stream.

-i, --inode NUM

Specify a file by its inode number instead of its name.

-f, --force

This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-q, --quiet

Suppress some debug/warning/error messages.

-V, --version

Show the version number, copyright and license ntfscat.

-v, --verbose

Display more debug/warning/error messages.


ntfscat is part of the ntfs-3g package and is available from:


There are no known problems with ntfscat. If you find a bug please send an email describing the problem to the development team:

see also

Read libntfs for details how to access encrypted files.

libntfs, ntfsls , ntfsprogs


ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.

How can this site be more helpful to YOU ?

give  feedback