---
name: "ntfscat"
section: "8"
platform: "linux"
package: "ntfsprogs"
version: "2026.9.28-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ntfscat"
---

# ntfscat(8)

print NTFS files and streams on the standard output

## NAME

ntfscat - print NTFS files and streams on the standard output

## SYNOPSIS

\[*options*\] *device* \[*file*\]

## DESCRIPTION

**ntfscat** will read a file or stream from an NTFS volume and display the contents on the standard output.

The case of the filename passed to **ntfscat** is ignored.

## OPTIONS

Below is a summary of all the options that **ntfscat** accepts.  Nearly all options have two equivalent names.  The short name is preceded by **-** and the long name is preceded by **--**. Any single letter options, that don't take an argument, can be combined into a single command, e.g. **-fv** is equivalent to **-f -v**. Long named options can be abbreviated to any unique prefix of their name.

- **-a**, **--attribute** TYPE

  Display the contents of a particular attribute type.  By default, the unnamed $DATA attribute will be shown.  The attribute can be specified by a number in decimal or hexadecimal, or by name.

  | | | |
  | --- | --- | --- |
  | **Hex** | **Decimal** | **Name** |
  | 0x10 | 16 | "$STANDARD\_INFORMATION" |
  | 0x20 | 32 | "$ATTRIBUTE\_LIST" |
  | 0x30 | 48 | "$FILE\_NAME" |
  | 0x40 | 64 | "$OBJECT\_ID" |
  | 0x50 | 80 | "$SECURITY\_DESCRIPTOR" |
  | 0x60 | 96 | "$VOLUME\_NAME" |
  | 0x70 | 112 | "$VOLUME\_INFORMATION" |
  | 0x80 | 128 | "$DATA" |
  | 0x90 | 144 | "$INDEX\_ROOT" |
  | 0xA0 | 160 | "$INDEX\_ALLOCATION" |
  | 0xB0 | 176 | "$BITMAP" |
  | 0xC0 | 192 | "$REPARSE\_POINT" |
  | 0xD0 | 208 | "$EA\_INFORMATION" |
  | 0xE0 | 224 | "$EA" |
  | 0xF0 | 240 | "$PROPERTY\_SET" |
  | 0x100 | 256 | "$LOGGED\_UTILITY\_STREAM" |

  **Notes** The attribute names may be given without the leading $ symbol.\
   If you use the $ symbol, you must quote the name to prevent the shell interpreting the name.

- **-n**, **--attribute-name** NAME

  Display this named attribute, stream.

- **-i**, **--inode** NUM

  Specify a file by its inode number instead of its name.

- **-f**, **--force**

  This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.

- **-h**, **--help**

  Show a list of options with a brief description of each one.

- **-q**, **--quiet**

  Suppress some debug/warning/error messages.

- **-V**, **--version**

  Show the version number, copyright and license **ntfscat**.

- **-v**, **--verbose**

  Display more debug/warning/error messages.

## EXAMPLES

Display the contents of a file in the root of an NTFS volume.

**ntfscat /dev/hda1 boot.ini**

Display the contents of a file in a subdirectory of an NTFS volume.

**ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts**

Display the contents of the $INDEX\_ROOT attribute of the root directory (inode 5).

**ntfscat /dev/hda1 -a INDEX\_ROOT -i 5 \| hexdump -C**

## BUGS

There are no known problems with **ntfscat**. If you find a bug please send an email describing the problem to the development team:\
 ntfs-3g-devel@lists.sf.net

## AUTHORS

**ntfscat** was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.

## AVAILABILITY

**ntfscat** is part of the **ntfs-3g** package and is available from:\
 https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO

Read [**libntfs**(8)](/libntfs/8.md) for details how to access encrypted files.

[**libntfs**(8)](/libntfs/8.md), [**ntfsls**(8)](/ntfsls/8.md), [**ntfsprogs**(8)](/ntfsprogs/8.md)