fsntfsinfo(1) · carta

Usage

fsntfsinfo [-B bodyfile] [-E mft_entry_index] [-F file_entry] [-o offset] [-dhHUvV] source

Overview

fsntfsinfo is a utility to determine information about a Windows NT File System (NTFS) volume

fsntfsinfo is part of the libfsntfs package. libfsntfs is a library to access the Windows NT File System (NTFS) format

source is the source file.

The options are as follows:

-B bodyfile: output file system hierarchy as a bodyfile
-d: calculate a MD5 hash of a file entry to include in the bodyfile
-E mft_entry_index: show information about a specific MFT entry index or "all"
-F file_entry: show information about a specific file entry path
-h: shows this help
-H: shows the file system hierarcy
-o offset: specify the volume offset
-U: shows information from the USN change journal ($UsnJrnl)
-v: verbose output to stderr
-V: print version

Environment

None

Files

None

Examples

# fsntfsinfo ntfs-img-kw-1.dd
fsntfsinfo 20160414

Windows NT File System information:

Volume information:
	Name				: KW-SRCH-1
	Version				: 3.1
	Serial number			: ba50ed9250ed5623
	Cluster block size		: 512
	MFT entry size			: 1024
	Index entry size		: 4096

Diagnostics

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

History

Debian 13 (Trixie): the text shown here
Debian 12 (Bookworm) to Debian 11 (Bullseye)
Debian 10 (Buster) to Debian 9 (Stretch)

-B since Debian 11 (Bullseye); -d since Debian 13 (Trixie).

-a until Debian 12 (Bookworm).