title: ntfs-3g(8)

summary: Third Generation Read/Write NTFS Driver

text:
# ntfs-3g(8)

## NAME
ntfs-3g - Third Generation Read/Write NTFS Driver

## SYNOPSIS
ntfs-3g [-o option[,...]] volume mount_point

mount -t ntfs-3g [-o option[,...]] volume mount_point

lowntfs-3g [-o option[,...]] volume mount_point

mount -t lowntfs-3g [-o option[,...]] volume mount_point

## DESCRIPTION
ntfs-3g is an NTFS driver, which can create, remove, rename, move files, directories, hard links, and streams; it can read and write files, including streams, sparse files and transparently compressed files; it can handle special files like symbolic links, devices, and FIFOs; moreover it provides standard management of file ownership and permissions, including POSIX ACLs.

It comes in two variants ntfs-3g and lowntfs-3g with a few differences mentioned below in relevant options descriptions.

The volume to be mounted can be either a block device or an image file, either by using the mount command or starting the drive.

### Windows hibernation and fast restarting
On computers which can be dual-booted into Windows or Linux, Windows has to be fully shut down before booting into Linux, otherwise the NTFS file systems on internal disks may be left in an inconsistent state and changes made by Linux may be ignored by Windows.

So, Windows may not be left in hibernation when starting Linux, in order to avoid inconsistencies. Moreover, the fast restart feature available on recent Windows systems has to be disabled. This can be achieved by issuing as an Administrator the Windows command which disables both hibernation and fast restarting :

powercfg /h off

If either Windows is hibernated or its fast restart is enabled, partitions on internal disks are forced to be mounted in read-only mode.

### Access Handling and Security
By default, files and directories are owned by the effective user and group of the mounting process, and everybody has full read, write, execution and directory browsing permissions. You can also assign permissions to a single user by using the uid and/or the gid options together with the umask, or fmask and dmask options.

Doing so, all Windows users have full access to the files created by ntfs-3g.

But, by setting the permissions option, you can benefit from the full ownership and permissions features as defined by POSIX. Moreover, by defining a Windows-to-Linux user mapping, the ownerships and permissions are even applied to Windows users and conversely.

If ntfs-3g is set setuid-root then non-root users will be also able to mount volumes.

### Windows Filename Compatibility
NTFS supports several filename namespaces: DOS, Win32 and POSIX. While the ntfs-3g driver handles all of them, it always creates new files in the POSIX namespace for maximum portability and interoperability reasons. This means that filenames are case sensitive and all characters are allowed except '/' and '\0'. This is perfectly legal on Windows, though some application may get confused. The option windows_names may be used to apply Windows restrictions to new file names.

### Alternate Data Streams (ADS)
NTFS stores all data in streams. Every file has exactly one unnamed data stream and can have many named data streams. The size of a file is the size of its unnamed data stream. By default, ntfs-3g will only read the unnamed data stream.

By using the option streams_interface=windows, with the ntfs-3g driver (not possible with lowntfs-3g), you will be able to read any named data streams, simply by specifying the stream name after a colon. For example:

cat some.mp3:artist

Named data streams act like normal files, so you can read from them, write to them and even delete them (using rm). You can list all the named data streams a file has by getting the ntfs.streams.list extended attribute.

## OPTIONS
Below is a summary of the options that ntfs-3g accepts.

acl

Enable setting Posix ACLs on created files and use them for access control. This option is only available on specific builds. It is set by default when a user mapping file is present and the permissions mount option is not set.

allow_other

This option overrides the security measure restricting file access to the user mounting the filesystem. This option is only allowed to root, but this restriction can be overridden by the user_allow_other option in the /etc/fuse.conf file.

atime, noatime, relatime

The atime option updates inode access time for each access. The noatime option disables inode access time updates, which can speed up file operations and prevent sleeping (notebook) disks spinning up too often thus saving energy and disk lifetime.

The relatime option is very similar to noatime. It updates inode access times relative to modify or change time. The access time is only updated if the previous access time was earlier than the current modify or change time. Unlike noatime this option doesn't break applications that need to know if a file has been read since the last time it was modified. This is the default behaviour.

big_writes

This option prevents fuse from splitting write buffers into 4K chunks, enabling big write buffers to be transferred from the application in a single step (up to some system limit, generally 128K bytes).

compression

This option enables creating new transparently compressed files in directories marked for compression. A directory is marked for compression by setting the bit 11 (value 0x00000800) in its Windows attribute. In such a directory, new files are created compressed and new subdirectories are themselves marked for compression. The option and the flag have no effect on existing files. Currently this is the default option.

debug

Makes ntfs-3g (or lowntfs-3g) to print a lot of debug output from libntfs-3g and FUSE.

delay_mtime[= value]

Only update the file modification time and the file change time of a file when it is closed or when the indicated delay since the previous update has elapsed. The argument is a number of seconds, with a default value of 60. This is mainly useful for big files which are kept open for a long time and written to without changing their size, such as databases or file system images mounted as loop.

dmask=value

Set the bitmask of the directory permissions that are not present. The value is given in octal. The default value is 0 which means full access to everybody.

efs_raw

This option should only be used in backup or restore situation. It changes the apparent size of files and the behavior of read and write operation so that encrypted files can be saved and restored without being decrypted. The user.ntfs.efsinfo extended attribute has also to be saved and restored for the file to be decrypted.

fmask=value

Set the bitmask of the file permissions that are not present. The value is given in octal. The default value is 0 which means full access to everybody.

force

This option is obsolete. It has been superseded by the recover and norecover options.

hide_dot_files

Set the hidden flag in the NTFS attribute for created files and directories whose first character of the name is a dot. Such files and directories normally do not appear in directory listings, and when the flag is set they do not appear in Windows directory displays either. When a file is renamed or linked with a new name, the hidden flag is adjusted to the latest name.

hide_hid_files

Hide the hidden files and directories in directory listings, the hidden files and directories being the ones whose NTFS attribute have the hidden flag set. The hidden files will not be selected when using wildcards in commands, but all files and directories remain accessible by full name, for example you can always display the Windows trash bin directory by : "ls -ld '$RECYCLE.BIN'".

ignore_case (only with lowntfs-3g)

Ignore character case when accessing a file (FOO, Foo, foo, etc. designate the same file). All files are displayed with lower case in directory listings.

inherit

When creating a new file, set its initial protections according to inheritance rules defined in parent directory. These rules deviate from Posix specifications, but yield a better Windows compatibility. The permissions (or **acl**) option or a valid user mapping file is required for this option to be effective.

locale=value

This option can be useful when wanting a language specific locale environment. It is however discouraged as it leads to files with untranslatable characters to not be visible.

max_read=value

With this option the maximum size of read operations can be set. The default is infinite. Note that the size of read requests is limited anyway by the system (usually to 128kbyte).

no_def_opts

By default ntfs-3g acts as if silent (ignore permission errors when permissions are not enabled), allow_other (allow any user to access files) and nonempty (allow mounting on non-empty directories) were set, and no_def_opts cancels these default options.

no_detach

Makes ntfs-3g to not detach from terminal and print some debug output.

nocompression

This option disables creating new transparently compressed files in directories marked for compression. Existing compressed files can still be read and updated.

norecover

Do not try to mount a partition which was not unmounted properly by Windows.

permissions

Set standard permissions on created files and use standard access control. This option is set by default when a user mapping file is present.

posix_nlink

Compute the count of hard links of a file or directory according to the POSIX specifications. When this option is not set, a count of 1 is set for directories, and the short name of files is accounted for. Using the option entails some penalty as the count is not stored and has to be computed.

recover

Recover and try to mount a partition which was not unmounted properly by Windows. The Windows logfile is cleared, which may cause inconsistencies. Currently this is the default option.

remove_hiberfile

When the NTFS volume is hibernated, a read-write mount is denied and a read-only mount is forced. One needs either to resume Windows and shutdown it properly, or use this option which will remove the Windows hibernation file. Please note, this means that the saved Windows session will be completely lost. Use this option under your own responsibility.

ro

Mount the filesystem read-only. Useful if Windows is hibernated or the NTFS journal file is unclean.

show_sys_files

Show the metafiles in directory listings. Otherwise the default behaviour is to hide the metafiles, which are special files used to store the NTFS structure. Please note that even when this option is specified, "$MFT" may not be visible due to a glibc bug. Furthermore, irrespectively of show_sys_files, all files are accessible by name, for example you can always do "ls -l '$UpCase'".

silent

Do nothing, without returning any error, on chmod and chown operations and on permission checking errors, when the permissions option is not set and no user mapping file is defined. This option is on by default, and when set off (through option no_def_opts) ownership and permissions parameters have to be set.

special_files=mode

This option selects a mode for representing a special file to be created (symbolic link, socket, fifo, character or block device). The mode can be interix or wsl, and existing files in either mode are recognized irrespective of the selected mode. Interix is the traditional mode, used by default, and wsl is interoperable with Windows WSL, but it is not compatible with Windows versions earlier than Windows 10. Neither mode are interoperable with Windows.

streams_interface=mode

This option controls how the user can access Alternate Data Streams (ADS) or in other words, named data streams. The mode can be set to one of none, windows or xattr. If the option is set to none, the user will have no access to the named data streams. If it is set to windows (not possible with lowntfs-3g), then the user can access them just like in Windows (eg. cat file:stream). If it's set to xattr, then the named data streams are mapped to extended attributes and a user can manipulate them using {get,set}fattr utilities. The default is xattr.

uid=value and gid=value

Set the owner and the group of files and directories. The values are numerical. The defaults are the uid and gid of the current process.

umask=value

Set the bitmask of the file and directory permissions that are not present. The value is given in octal. The default value is 0 which means full access to everybody.

usermapping=file-name

Use file file-name as the user mapping file instead of the default .NTFS-3G/UserMapping. If file-name defines a full path, the file must be located on a partition previously mounted. If it defines a relative path, it is interpreted relative to the root of NTFS partition being mounted.

When a user mapping file is defined, the options uid=, gid=, umask=, fmask=, dmask= and silent are ignored.

user_xattr

Same as streams_interface=xattr.

windows_names

This option prevents files, directories and extended attributes to be created with a name not allowed by windows, because

- it contains some not allowed character,

- or the last character is a space or a dot,

- or the name is reserved.

The forbidden characters are the nine characters " * / : < > ? \ | and those whose code is less than 0x20, and the reserved names are CON, PRN, AUX, NUL, COM1..COM9, LPT1..LPT9, with no suffix or followed by a dot. Existing such files can still be read (and renamed).

## USER MAPPING
NTFS uses specific ids to record the ownership of files instead of the uid (user id) and gid (group id) used by Linux. As a consequence a mapping between the ids has to be defined for ownerships to be recorded into NTFS files and recognized.

By default, this mapping is fetched from the file .NTFS-3G/UserMapping located in the NTFS partition. The option usermapping= may be used to define another location. When the option **permissions** is set and no mapping file is found, a default mapping is used.

Each line in the user mapping file defines a mapping. It is organized in three fields separated by colons. The first field identifies a uid, the second field identifies a gid and the third one identifies the corresponding NTFS id, known as a SID. The uid and the gid are optional and defining both of them for the same SID is not recommended.

If no interoperation with Windows is needed, you can use the option permissions to define a standard mapping. Alternately, you may define your own mapping by setting a single default mapping with no uid and gid. In both cases, files created on Linux will appear to Windows as owned by a foreign user, and files created on Windows will appear to Linux as owned by root. Just copy the example below and replace the 9 and 10-digit numbers by any number not greater than 4294967295. The resulting behavior is the same as the one with the option permission set with no ownership option and no user mapping file available.

::S-1-5-21-3141592653-589793238-462643383-10000

If a strong interoperation with Windows is needed, the mapping has to be defined for each user and group known to both system, and the SIDs used by Windows has to be collected. This will lead to a user mapping file like : john::S-1-5-21-3141592653-589793238-462643383-1008 mary::S-1-5-21-3141592653-589793238-462643383-1009 :smith:S-1-5-21-3141592653-589793238-462643383-513 ::S-1-5-21-3141592653-589793238-462643383-10000

The utility ntfsusermap may be used to create such a user mapping file.

## EXAMPLES
Mount /dev/sda1 to /mnt/windows:

ntfs-3g /dev/sda1 /mnt/windows

or mount -t ntfs-3g /dev/sda1 /mnt/windows

Mount the ntfs data partition /dev/sda3 to /mnt/data with standard Linux permissions applied : ntfs-3g -o permissions /dev/sda3 /mnt/data

or mount -t ntfs-3g -o permissions /dev/sda3 /mnt/data

Read-only mount /dev/sda5 to /home/user/mnt and make user with uid 1000 to be the owner of all files: ntfs-3g /dev/sda5 /home/user/mnt -o ro,uid=1000

/etc/fstab entry for the above (the sixth and last field has to be zero to avoid a file system check at boot time) : /dev/sda5 /home/user/mnt ntfs-3g ro,uid=1000 0 0

Unmount /mnt/windows: umount /mnt/windows

## EXIT CODES
To facilitate the use of the ntfs-3g driver in scripts, an exit code is returned to give an indication of the mountability status of a volume. Value 0 means success, and all other ones mean an error. The unique error codes are documented in the ntfs-3g.probe(8) manual page.

## KNOWN ISSUES
Please see

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ

for common questions and known issues. If you would find a new one in the latest release of the software then please post an ntfs-3g issue describing it in detail so that the development team can be aware of the issue and take care of it: https://github.com/tuxera/ntfs-3g/issues

## AUTHORS
ntfs-3g was based on and a major improvement to ntfsmount and libntfs which were written by Yura Pakhuchiy and the Linux-NTFS team. The improvements were made, the ntfs-3g project was initiated and currently led by long time Linux-NTFS team developer Szabolcs Szakacsits (szaka@tuxera.com).

## THANKS
Several people made heroic efforts, often over five or more years which resulted the ntfs-3g driver. Most importantly they are Anton Altaparmakov, Jean-Pierre André, Erik Larsson, Richard Russon, Szabolcs Szakacsits, Yura Pakhuchiy, Yuval Fledel, and the author of the groundbreaking FUSE filesystem development framework, Miklos Szeredi.

## SEE ALSO
ntfs-3g.probe(8), ntfsprogs(8), attr(5), getfattr(1)


title: ntfs-3g.probe(8)

summary: Probe an NTFS volume mountability

text:
# ntfs-3g.probe(8)

## NAME
ntfs-3g.probe - Probe an NTFS volume mountability

## SYNOPSIS
ntfs-3g.probe <--readonly|--readwrite> volume

## DESCRIPTION
The ntfs-3g.probe utility tests a volume if it's NTFS mountable read-only or read-write, and exits with a status value accordingly. The volume can be a block device or image file.

## OPTIONS
Below is a summary of the options that ntfs-3g.probe accepts.

-r, --readonly

Test if the volume can be mounted read-only.

-w, --readwrite

Test if the volume can be mounted read-write.

-h, --help

Display help and exit.

## EXAMPLE
Test if /dev/sda1 can be mounted read-write:

ntfs-3g.probe --readwrite /dev/sda1

## EXIT CODES
The exit codes are as follows:

0

Volume is mountable.

11

Syntax error, command line parsing failed.

12

The volume doesn't have a valid NTFS.

13

Inconsistent NTFS, hardware or device driver fault, or unsetup SoftRAID/FakeRAID hardware.

14

The NTFS partition is hibernated.

15

The volume was not cleanly unmounted.

16

The volume is already exclusively opened and in use by a kernel driver or software.

17

Unsetup SoftRAID/FakeRAID hardware.

18

Unknown reason.

19

Not enough privilege to mount.

20

Out of memory.

21

Unclassified FUSE error.

## KNOWN ISSUES
Please see

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ

for common questions and known issues. If you think you have found an undocumented problem in the latest release of the software then please post an ntfs-3g issue describing it in detail so that the development team can be aware of the issue and take care of it: https://github.com/tuxera/ntfs-3g/issues

## AUTHORS
ntfs-3g.probe was written by Szabolcs Szakacsits.

## THANKS
Alon Bar-Lev has integrated the utility into the NTFS-3G build process and tested it with Erik Larsson before the public release.

## SEE ALSO
ntfs-3g(8)

branch: sisyphus


ntfscat

title: ntfscat(8)

text:
# ntfscat(8)

## NAME
ntfscat - print NTFS files and streams on the standard output

## SYNOPSIS
[options] device [file]

## DESCRIPTION
ntfscat will read a file or stream from an NTFS volume and display the contents on the standard output.

The case of the filename passed to ntfscat is ignored.

## OPTIONS
Below is a summary of all the options that ntfscat accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-a, --attribute TYPE

Display the contents of a particular attribute type. By default, the unnamed $DATA attribute will be shown. The attribute can be specified by a number in decimal or hexadecimal, or by name. Hex

Decimal

Name

0x10

16

"$STANDARD_INFORMATION"

0x20

32

"$ATTRIBUTE_LIST"

0x30

48

"$FILE_NAME"

0x40

64

"$OBJECT_ID"

0x50

80

"$SECURITY_DESCRIPTOR"

0x60

96

"$VOLUME_NAME"

0x70

112

"$VOLUME_INFORMATION"

0x80

128

"$DATA"

0x90

144

"$INDEX_ROOT"

0xA0

160

"$INDEX_ALLOCATION"

0xB0

176

"$BITMAP"

0xC0

192

"$REPARSE_POINT"

0xD0

208

"$EA_INFORMATION"

0xE0

224

"$EA"

0xF0

240

"$PROPERTY_SET"

0x100

256

"$LOGGED_UTILITY_STREAM"

Notes The attribute names may be given without the leading $ symbol.

If you use the $ symbol, you must quote the name to prevent the shell interpreting the name.

-n, --attribute-name NAME

Display this named attribute, stream.

-i, --inode NUM

Specify a file by its inode number instead of its name.

-f, --force

This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-q, --quiet

Suppress some debug/warning/error messages.

-V, --version

Show the version number, copyright and license ntfscat.

-v, --verbose

Display more debug/warning/error messages.

## EXAMPLES
Display the contents of a file in the root of an NTFS volume.

ntfscat /dev/hda1 boot.ini

Display the contents of a file in a subdirectory of an NTFS volume. ntfscat /dev/hda1 /winnt/system32/drivers/etc/hosts

Display the contents of the $INDEX_ROOT attribute of the root directory (inode 5). ntfscat /dev/hda1 -a INDEX_ROOT -i 5 | hexdump -C

## BUGS
There are no known problems with ntfscat. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfscat was written by Richard Russon, Anton Altaparmakov and Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.

## AVAILABILITY
ntfscat is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
Read libntfs(8) for details how to access encrypted files.

libntfs(8), ntfsls(8), ntfsprogs(8)


ntfsclone

title: ntfsclone(8)

text:
# ntfsclone(8)

## NAME
ntfsclone - Efficiently clone, image, restore or rescue an NTFS

## SYNOPSIS
ntfsclone [OPTIONS] SOURCE

ntfsclone --save-image [OPTIONS] SOURCE

ntfsclone --restore-image [OPTIONS] SOURCE

ntfsclone --metadata [OPTIONS] SOURCE

## DESCRIPTION
ntfsclone will efficiently clone (copy, save, backup, restore) or rescue an NTFS filesystem to a sparse file, image, device (partition) or standard output. It works at disk sector level and copies only the used data. Unused disk space becomes zero (cloning to sparse file), encoded with control codes (saving in special image format), left unchanged (cloning to a disk/partition) or filled with zeros (cloning to standard output).

ntfsclone can be useful to make backups, an exact snapshot of an NTFS filesystem and restore it later on, or for developers to test NTFS read/write functionality, troubleshoot/investigate users' issues using the clone without the risk of destroying the original filesystem.

The clone, if not using the special image format, is an exact copy of the original NTFS filesystem from sector to sector thus it can be also mounted just like the original NTFS filesystem. For example if you clone to a file and the kernel has loopback device and NTFS support then the file can be mounted as

mount -t ntfs -o loop ntfsclone.img /mnt/ntfsclone

### Windows Cloning
If you want to copy, move or restore a system or boot partition to another computer, or to a different disk or partition (e.g. hda1->hda2, hda1->hdb1 or to a different disk sector offset) then you will need to take extra care.

Usually, Windows will not be able to boot, unless you copy, move or restore NTFS to the same partition which starts at the same sector on the same type of disk having the same BIOS legacy cylinder setting as the original partition and disk had.

The ntfsclone utility guarantees to make an exact copy of NTFS but it won't deal with booting issues. This is by design: ntfsclone is a filesystem, not system utility. Its aim is only NTFS cloning, not Windows cloning. Hereby ntfsclone can be used as a very fast and reliable build block for Windows cloning but itself it's not enough.

### Sparse Files
A file is sparse if it has unallocated blocks (holes). The reported size of such files are always higher than the disk space consumed by them. The du command can tell the real disk space used by a sparse file. The holes are always read as zeros. All major Linux filesystem like, ext2, ext3, reiserfs, Reiser4, JFS and XFS, supports sparse files but for example the ISO 9600 CD-ROM filesystem doesn't.

### Handling Large Sparse Files
As of today Linux provides inadequate support for managing (tar, cp, gzip, gunzip, bzip2, bunzip2, cat, etc) large sparse files. The only main Linux filesystem having support for efficient sparse file handling is XFS by the XFS_IOC_GETBMAPX ioctl(2). However none of the common utilities supports it. This means when you tar, cp, gzip, bzip2, etc a large sparse file they will always read the entire file, even if you use the "sparse support" options.

bzip2(1) compresses large sparse files much better than gzip(1) but it does so also much slower. Moreover neither of them handles large sparse files efficiently during uncompression from disk space usage point of view.

At present the most efficient way, both speed and space-wise, to compress and uncompress large sparse files by common tools would be using tar(1) with the options -S (handle sparse files "efficiently") and -j (filter the archive through bzip2). Although tar still reads and analyses the entire file, it doesn't pass on the large data blocks having only zeros to filters and it also avoids writing large amount of zeros to the disk needlessly. But since tar can't create an archive from the standard input, you can't do this in-place by just reading ntfsclone standard output. Even more sadly, using the -S option results serious data loss since the end of 2004 and the GNU tar maintainers didn't release fixed versions until the present day.

### The Special Image Format
It's also possible, actually it's recommended, to save an NTFS filesystem to a special image format. Instead of representing unallocated blocks as holes, they are encoded using control codes. Thus, the image saves space without requiring sparse file support. The image format is ideal for streaming filesystem images over the network and similar, and can be used as a replacement for Ghost or Partition Image if it is combined with other tools. The downside is that you can't mount the image directly, you need to restore it first.

To save an image using the special image format, use the -s or the --save-image option. To restore an image, use the -r or the --restore-image option. Note that you can restore images from standard input by using '-' as the SOURCE file.

### Metadata-only Cloning
One of the features of ntfsclone is that, it can also save only the NTFS metadata using the option -m or --metadata and the clone still will be mountable. In this case all non-metadata file content will be lost and reading them back will result always zeros.

The metadata-only image can be compressed very well, usually to not more than 1-8 MB thus it's easy to transfer for investigation, troubleshooting.

In this mode of ntfsclone, NONE of the user's data is saved, including the resident user's data embedded into metadata. All is filled with zeros. Moreover all the file timestamps, deleted and unused spaces inside the metadata are filled with zeros. Thus this mode is inappropriate for example for forensic analyses. This mode may be combined with --save-image to create a special image format file instead of a sparse file.

Please note, filenames are not wiped out. They might contain sensitive information, so think twice before sending such an image to anybody.

## OPTIONS
Below is a summary of all the options that ntfsclone accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by -- . Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v . Long named options can be abbreviated to any unique prefix of their name.

-o, --output FILE

Clone NTFS to the non-existent FILE. If FILE is '-' then clone to the standard output. This option cannot be used for creating a partition, use --overwrite for an existing partition.

-O, --overwrite FILE

Clone NTFS to FILE, which can be an existing partition or a regular file which will be overwritten if it exists.

-s, --save-image

Save to the special image format. This is the most efficient way space and speed-wise if imaging is done to the standard output, e.g. for image compression, encryption or streaming through a network.

-r, --restore-image

Restore from the special image format specified by SOURCE argument. If the SOURCE is '-' then the image is read from the standard input.

-n, --no-action

Test the consistency of a saved image by simulating its restoring without writing anything. The NTFS data contained in the image is not tested. The option --restore-image must also be present, and the options --output and --overwrite must be omitted.

--rescue

Ignore disk read errors so disks having bad sectors, e.g. dying disks, can be rescued the most efficiently way, with minimal stress on them. Ntfsclone works at the lowest, sector level in this mode too thus more data can be rescued. The contents of the unreadable sectors are filled by character '?' and the beginning of such sectors are marked by "BadSectoR\0".

-m, --metadata

Clone ONLY METADATA (for NTFS experts). Only cloning to a (sparse) file is allowed, unless used the option --save-image is also used. You can't metadata-only clone to a device.

--ignore-fs-check

Ignore the result of the filesystem consistency check. This option is allowed to be used only with the --metadata option, for the safety of user's data. The clusters which cause the inconsistency are saved too.

-t, --preserve-timestamps

Do not wipe the timestamps, to be used only with the --metadata option.

--full-logfile

Include the Windows log file in the copy. This is only useful for extracting metadata, saving or cloning a file system which was not properly unmounted from Windows.

--new-serial, or

--new-half-serial

Set a new random serial number to the clone. The serial number is a 64 bit number used to identify the device during the mounting process, so it has to be changed to enable the original file system and the clone to be mounted at the same time on the same computer. The option --new-half-serial only changes the upper part of the serial number, keeping the lower part which is used by Windows unchanged.

The options --new-serial and --new-half-serial can only be used when cloning a file system of restoring from an image.

The serial number is not the volume UUID used by Windows to locate files which have been moved to another volume.

-f, --force

Forces ntfsclone to proceed if the filesystem is marked "dirty" for consistency check.

-q, --quiet

Do not display any progress-bars during operation.

-h, --help

Show a list of options with a brief description of each one.

## EXIT CODES
The exit code is 0 on success, non-zero otherwise.

## EXAMPLES
Clone NTFS on /dev/hda1 to /dev/hdc1:

ntfsclone --overwrite /dev/hdc1 /dev/hda1

Save an NTFS to a file in the special image format: ntfsclone --save-image --output backup.img /dev/hda1

Restore an NTFS from a special image file to its original partition: ntfsclone --restore-image --overwrite /dev/hda1 backup.img

Save an NTFS into a compressed image file: ntfsclone --save-image -o - /dev/hda1 | gzip -c > backup.img.gz

Restore an NTFS volume from a compressed image file: gunzip -c backup.img.gz |

ntfsclone --restore-image --overwrite /dev/hda1 -

Backup an NTFS volume to a remote host, using ssh. Please note, that ssh may ask for a password! ntfsclone --save-image --output - /dev/hda1 |

gzip -c | ssh host 'cat > backup.img.gz'

Restore an NTFS volume from a remote host via ssh. Please note, that ssh may ask for a password! ssh host 'cat backup.img.gz' | gunzip -c |

ntfsclone --restore-image --overwrite /dev/hda1 -

Stream an image file from a web server and restore it to a partition: wget -qO - http://server/backup.img |

ntfsclone --restore-image --overwrite /dev/hda1 -

Clone an NTFS volume to a non-existent file: ntfsclone --output ntfs-clone.img /dev/hda1

Pack NTFS metadata for NTFS experts. Please note that bzip2 runs very long but results usually at least 10 times smaller archives than gzip on a sparse file. ntfsclone --metadata --output ntfsmeta.img /dev/hda1

bzip2 ntfsmeta.img

Or, outputting to a compressed image :

ntfsclone -mst --output - /dev/hda1 | bzip2 > ntfsmeta.bz2

Unpacking NTFS metadata into a sparse file: bunzip2 -c ntfsmeta.img.bz2 |

cp --sparse=always /proc/self/fd/0 ntfsmeta.img

## KNOWN ISSUES
There are no known problems with ntfsclone. If you think you have found a problem then please send an email describing it to the development team: ntfs-3g-devel@lists.sf.net

Sometimes it might appear ntfsclone froze if the clone is on ReiserFS and even CTRL-C won't stop it. This is not a bug in ntfsclone, however it's due to ReiserFS being extremely inefficient creating large sparse files and not handling signals during this operation. This ReiserFS problem was improved in kernel 2.4.22. XFS, JFS and ext3 don't have this problem.

## AUTHORS
ntfsclone was written by Szabolcs Szakacsits with contributions from Per Olofsson (special image format support) and Anton Altaparmakov. It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.

## AVAILABILITY
ntfsclone is part of the ntfs-3g package and is available at:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfsresize(8) ntfsprogs(8) xfs_copy(8) debugreiserfs(8) e2image(8)


ntfscluster

title: ntfscluster(8)

text:
# ntfscluster(8)

## NAME
ntfscluster - identify files in a specified region of an NTFS volume.

## SYNOPSIS
ntfscluster [options] device

## DESCRIPTION
ntfscluster has three modes of operation: info, sector and cluster.

### Info
The default mode, info is currently not implemented. It will display general information about the NTFS volume when it is working.

### Sector
The sector mode will display a list of files that have data in the specified range of sectors.

### Cluster
The cluster mode will display a list of files that have data in the specified range of clusters. When the cluster size is one sector, this will be equivalent to the sector mode of operation.

## OPTIONS
Below is a summary of all the options that ntfscluster accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-c, --cluster RANGE

Any files whose data is in this range of clusters will be displayed.

-F, --filename NAME

Show information about this file.

-f, --force

This will override some sensible defaults, such as not working with a mounted volume. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-I, --inode NUM

Show information about this inode.

-i, --info

This option is not yet implemented.

-q, --quiet

Reduce the amount of output to a minimum. Naturally, it doesn't make sense to combine this option with --verbose

-s, --sector RANGE

Any files whose data is in this range of sectors will be displayed.

-v, --verbose

Increase the amount of output that ntfscluster prints.

-V, --version

Show the version number, copyright and license for ntfscluster.

## EXAMPLES
Get some information about the volume /dev/hda1.

ntfscluster /dev/hda1

Look for files in the first 500 clusters of /dev/hda1. ntfscluster -c 0-500 /dev/hda1

## BUGS
The info mode isn't implemented yet. ntfscluster is quite limited, but it has no known bugs. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfscluster was written by Richard Russon, with contributions from Anton Altaparmakov. It was ported to ntfs-3g by Erik Larsson.

## AVAILABILITY
ntfscluster is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfsinfo(8), ntfsprogs(8)


ntfscmp

title: ntfscmp(8)

text:
# ntfscmp(8)

## NAME
ntfscmp - compare two NTFS filesystems and tell the differences

## SYNOPSIS
ntfscmp [OPTIONS] DEVICE1 DEVICE2

## DESCRIPTION
The ntfscmp program makes a comparison between two NTFS filesystems from all aspects and reports all variances it finds. The filesystems can be on block devices or images files. Ntfscmp can be used for volume verification however its primary purpose was to be an efficient development tool, used to quickly locate, identify and check the correctness of the metadata changes made to NTFS.

If one is interested only in the NTFS metadata changes then it could be useful to compare the metadata images created by using the --metadata option of ntfsclone(8) to eliminate the usually uninteresting timestamp changes.

The terse output of ntfscmp is intentional because the provided information is enough in each case to determine the exact differences. This can be achieved, for instance, if one compares the verbose outputs of ntfsinfo(8) for each reported inodes by the diff(1) utility.

## OPTIONS
Below is a summary of the options that ntfscmp accepts.

-P, --no-progress-bar

Don't show progress bars.

-v, --verbose

More informational output.

-h, --help

Display help and exit.

## EXIT CODES
The exit code is 0 on success, non-zero otherwise.

## KNOWN ISSUES
No problem is known. If you would find otherwise then please send your report to the development team: ntfs-3g-devel@lists.sf.net

## AUTHOR
ntfscmp was written by Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson.

## AVAILABILITY
ntfscmp is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfsinfo(8), ntfscat(8), diff(1), ntfsclone(8), ntfsprogs(8)


ntfscp

title: ntfscp(8)

summary: copy file to an NTFS volume.

text:
# ntfscp(8)

## NAME
ntfscp - copy file to an NTFS volume.

## SYNOPSIS
ntfscp [options] device source_file destination

## DESCRIPTION
ntfscp will copy file to an NTFS volume. destination can be either file or directory. In case if destination is directory specified by name then source_file is copied into this directory, in case if destination is directory and specified by inode number then unnamed data attribute is created for this inode and source_file is copied into it (WARNING: it's unusual to have unnamed data streams in the directories, think twice before specifying directory by inode number).

## OPTIONS
Below is a summary of all the options that ntfscp accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-a, --attribute NUM

Write to this attribute.

-i, --inode

Treat destination as inode number.

-m, --min-fragments

Minimize fragmentation when allocating space to the attribute. This is mostly useful when creating big files.

-N, --attr-name NAME

Write to attribute with this name.

-n, --no-action

Use this option to make a test run before doing the real copy operation. Volume will be opened read-only and no write will be done.

-f, --force

This will override some sensible defaults, such as not working with a mounted volume. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-q, --quiet

Suppress some debug/warning/error messages.

-t, --timestamp

Copy the modification time of source_file to destination. This is not compatible with --attr-name and --attribute.

-V, --version

Show the version number, copyright and license ntfscp.

-v, --verbose

Display more debug/warning/error messages.

## DATA STREAMS
All data on NTFS is stored in streams, which can have names. A file can have more than one data streams, but exactly one must have no name. The size of a file is the size of its unnamed data stream. Usually when you don't specify stream name you are access to unnamed data stream. If you want access to named data stream you need to add ":stream_name" to the filename. For example: by opening "some.mp3:artist" you will open stream "artist" in "some.mp3". But windows usually prevent you from accessing to named data streams, so you need to use some program like FAR or utils from cygwin to access named data streams.

## EXAMPLES
Copy new_boot.ini from /home/user as boot.ini to the root of an /dev/hda1 NTFS volume:

ntfscp /dev/hda1 /home/user/new_boot.ini boot.ini

Copy myfile to C:\some\path\myfile:stream (assume that /dev/hda1 letter in windows is C): ntfscp -N stream /dev/hda1 myfile /some/path

## BUGS
There are no known problems with ntfscp. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfscp was written by Yura Pakhuchiy, with contributions from Anton Altaparmakov and Hil Liao. It was ported to ntfs-3g by Erik Larsson.

## DEDICATION
With love to Marina Sapego.

## AVAILABILITY
ntfscp is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g

## SEE ALSO
ntfsprogs(8)


ntfsdecrypt

title: ntfsdecrypt(8)

text:
# ntfsdecrypt(8)

## NAME
ntfsdecrypt - decrypt or update NTFS files encrypted according to EFS

## SYNOPSIS
ntfsdecrypt [options] -k key.pfx device file

## DESCRIPTION
ntfsdecrypt decrypts a file from an unmounted device and print the decrypted data on the standard output. It can also update an encrypted file with the encryption key unchanged.

The NTFS file encryption (known as EFS) uses a two-level encryption : first, the file contents is encrypted with a random symmetric key, then this symmetric key is encrypted with the public keys of each of the users allowed to decrypt the file (RSA public key encryptions).

Three symmetric encryption modes are currently implemented in ntfsdecrypt : DESX (a DES variant), 3DES (triple DES) and AES_256 (an AES variant).

All the encrypted symmetric keys are stored along with the file in a special extended attribute named "$LOGGED_UTILITY_STREAM". Usually, at least two users are allowed to read the file : its owner and the recovery manager who is able to decrypt all the files in a company. When backing up an encrypted file, it is important to also backup the corresponding $LOGGED_UTILITY_STREAM, otherwise the file cannot be decrypted, even by the recovery manager. Also note that encrypted files are slightly bigger than apparent, and the option "efs_raw" has to be used when backing up encrypted files with ntfs-3g.

When ntfsdecrypt is used to update a file, the keys and the $LOGGED_UTILITY_STREAM are kept unchanged, so a single key file has to be designated.

Note : the EFS encryption is only available in professional versions of Windows;

## OPTIONS
Below is a summary of all the options that ntfsdecrypt accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-i, --inode NUM

Display or update the contents of a file designated through its inode number instead of its name.

-e, --encrypt

Update an existing encrypted file and get the new contents from the standard input. The full public and private key file has to be designated, as the symmetric key is kept unchanged, so the private key is needed to extract it.

-f, --force

This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.

-k, --keyfile-name key.pfx

Define the file which contains the public and private keys in PKCS#12 format. This file obviously contains the keys of one of the users allowed to decrypt or update the file. It has to be extracted from Windows in PKCS#12 format (its usual suffix is .p12 or .pfx), and it is protected by a passphrase which has to be typed in for the keys to be extracted. This can be the key file of any user allowed to read the file, including the one of the recovery manager.

-h, --help

Show a list of options with a brief description of each one.

-q, --quiet

Suppress some debug/warning/error messages.

-V, --version

Show the version number, copyright and license of ntfsdecrypt.

-v, --verbose

Display more debug/warning/error messages.

## EXAMPLES
Display the contents of the file hamlet.doc in the directory Documents of the root of the NTFS file system on the device /dev/sda1

ntfsdecrypt -k foo.key /dev/sda1 Documents/hamlet.doc

Update the file hamlet.doc ntfsdecrypt -k foo.key /dev/sda1 Documents/hamlet.doc < new.doc

## BUGS
There are no known problems with ntfsdecrypt. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfsdecrypt was written by Yuval Fledel, Anton Altaparmakov and Yura Pakhuchiy. It was ported to ntfs-3g by Erik Larsson and upgraded by Jean-Pierre Andre.

## AVAILABILITY
ntfsdecrypt is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
Read ntfs-3g(8) for details on option efs_raw,

ntfscat(8), ntfsprogs(8)


ntfsfallocate

title: ntfsfallocate(8)

text:
# ntfsfallocate(8)

## NAME
ntfsfallocate - preallocate space to a file on an NTFS volume

## SYNOPSIS
ntfsfallocate [options] -l length device file [attr-type [attr-name]]

## DESCRIPTION
ntfsfallocate preallocates space for any attribute of a file or directory, thus reserving space before actual contents is written. This is similar to fallocate(1).

## OPTIONS
Below is a summary of all the options that ntfsfallocate accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-f, --force

This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-l, --length LENGTH

This is a mandatory option to specify the number of bytes to preallocate. It will be rounded up to a multiple of the cluster size. A suffix of K, M, G, T, P or E may be appended to mean a multiplicative factor of a power of 1000. Similarly a suffix of Ki, Mi, Gi, Ti, Pi or Ei may be appended to mean a multiplicative factor of a power of 1024.

-n, --no-size-change

Do not change the apparent size of the file. The space allocated beyond the apparent size is not zeroed, but subsequent writing beyond the apparent end of file will force zeroing the inner allocated space as it cannot be considered as a hole any more, and this may take significant time.

-N, --no-action

Simulate the allocation without actually write to device.

-o, --offset OFFSET

Specify the offset in the file where preallocation starts. By default, the preallocation is counted from the beginning of the file. Space already allocated in the area defined by offset and length is preserved.

-q, --quiet

Suppress some debug/warning/error messages.

-v, --verbose

Display more debug/warning/error messages.

-V, --version

Show the version number, copyright and license of ntfsfallocate.

attr-type

Define a particular attribute type to be preallocated (advanced use only). By default, the unnamed $DATA attribute (the contents of a plain file) will be preallocated. The attribute has to be specified by a number in decimal or hexadecimal : Hex

Decimal

Name

0x10

16

"$STANDARD_INFORMATION"

0x20

32

"$ATTRIBUTE_LIST"

0x30

48

"$FILE_NAME"

0x40

64

"$OBJECT_ID"

0x50

80

"$SECURITY_DESCRIPTOR"

0x60

96

"$VOLUME_NAME"

0x70

112

"$VOLUME_INFORMATION"

0x80

128

"$DATA"

0x90

144

"$INDEX_ROOT"

0xA0

160

"$INDEX_ALLOCATION"

0xB0

176

"$BITMAP"

0xC0

192

"$REPARSE_POINT"

0xD0

208

"$EA_INFORMATION"

0xE0

224

"$EA"

0xF0

240

"$PROPERTY_SET"

0x100

256

"$LOGGED_UTILITY_STREAM"

attr-name

Define the name of the particular attribute type to be preallocated (advanced use only).

## EXAMPLES
Preallocate 100MB to the file database.db located in the Data directory which is at the root of an NTFS file system.

ntfsfallocate -l 100M /dev/sda1 Data/database.db

## BUGS
There are no known problems with ntfsfallocate, however it can lead to configurations not supported by Windows and Windows may crash (BSOD) when writing to preallocated clusters which were not written to earlier. Files with preallocated space should be fully be written to before they are updated by Windows.

If you find a bug in ntfsfallocate proper, please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfsfallocate was written by Jean-Pierre Andre.

## AVAILABILITY
ntfsfallocate is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfs-3g(8), ntfstruncate(8), ntfsprogs(8), fallocate(1)


ntfsfix

title: ntfsfix(8)

text:
# ntfsfix(8)

## NAME
ntfsfix - fix common errors and force Windows to check NTFS

## SYNOPSIS
ntfsfix [options] device

## DESCRIPTION
ntfsfix is a utility that fixes some common NTFS problems. ntfsfix is NOT a Linux version of chkdsk. It only repairs some fundamental NTFS inconsistencies, resets the NTFS journal file and schedules an NTFS consistency check for the first boot into Windows.

You may run ntfsfix on an NTFS volume if you think it was damaged by Windows or some other way and it cannot be mounted.

## OPTIONS
Below is a summary of all the options that ntfsfix accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-b, --clear-bad-sectors

Clear the list of bad sectors. This is useful after cloning an old disk with bad sectors to a new disk.

-d, --clear-dirty

Clear the volume dirty flag if the volume can be fixed and mounted. If the option is not present or the volume cannot be fixed, the dirty volume flag is set to request a volume checking at next mount.

-h, --help

Show a list of options with a brief description of each one.

-n, --no-action

Do not write anything, just show what would have been done.

-V, --version

Show the version number, copyright and license

## BUGS
There are no known problems with ntfsfix. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfsfix was written by Anton Altaparmakov, with contributions from Szabolcs Szakacsits. It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.

## AVAILABILITY
ntfsfix is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
mkntfs(8), ntfsprogs(8)


ntfsinfo

title: ntfsinfo(8)

summary: dump a file's attributes

text:
# ntfsinfo(8)

## NAME
ntfsinfo - dump a file's attributes

## SYNOPSIS
ntfsinfo [options] device

## DESCRIPTION
ntfsinfo will dump the attributes of inode inode-number or the file path-filename and/or information about the mft ( -m option). Run ntfsinfo without arguments for a full list of options.

## OPTIONS
Below is a summary of all the options that ntfsinfo accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-F, --file FILE

Show information about this file

-f, --force

This will override some sensible defaults, such as not overwriting an existing file. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-i, --inode NUM

Show information about this inode.

-m, --mft

Show information about the volume.

-q, --quiet

Produce less output.

-t, --notime

Do not display timestamps in the output.

-v, --verbose

Increase the amount of output that ntfsinfo prints.

-V, --version

Show the version number, copyright and license.

## BUGS
There are no known problems with ntfsinfo. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfsinfo was written by Matthew J. Fanto, Anton Altaparmakov, Richard Russon, Szabolcs Szakacsits, Yuval Fledel, Yura Pakhuchiy and Cristian Klein. It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.

## AVAILABILITY
ntfsinfo is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfsprogs(8)


ntfslabel

title: ntfslabel(8)

text:
# ntfslabel(8)

## NAME
ntfslabel - display/change the label on an ntfs file system

## SYNOPSIS
ntfslabel [options] device [new-label]

## DESCRIPTION
ntfslabel will display or change the file system label on the ntfs file system located on device. It can also change the serial number of the device.

If the optional argument new-label is not present, and no option is present, ntfslabel will simply display the current file system label.

If the optional argument new-label is present, then ntfslabel will set the file system label to be new-label. NTFS file system labels can be at most 128 Unicode characters long; if new-label is longer than 128 Unicode characters, ntfslabel will truncate it and print a warning message.

It is also possible to set the file system label using the -L option of mkntfs(8) during creation of the file system.

## OPTIONS
Below is a summary of all the options that ntfslabel accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-f, --force

This will override some sensible defaults, such as not working with a mounted volume. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

--new-serial[=ssssssssssssssss], or

--new-half-serial[=ssssssss]

Set a new serial number to the device, either the argument value, or a random one if no argument is given. The serial number is a 64 bit number, represented as a sixteen-digit hexadecimal number, used to identify the device during the mounting process. As a consequence, two devices with the same serial number cannot be mounted at the same time on the same computer. This is not the volume UUID used by Windows to locate files which have been moved to another volume. The option --new-half-serial only changes the upper part of the serial number, keeping the lower part which is used by Windows unchanged. In this case the optional argument is an eight-digit hexadecimal number.

-n, --no-action

Don't actually write to disk.

-q, --quiet

Reduce the amount of output to a minimum.

-v, --verbose

Increase the amount of output that ntfslabel prints. The label and the serial number are displayed.

-V, --version

Show the version number, copyright and license for ntfslabel.

## BUGS
There are no known problems with ntfslabel. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfslabel was written by Matthew J. Fanto, with contributions from Anton Altaparmakov and Richard Russon. It was ported to ntfs-3g by Erik Larsson.

## AVAILABILITY
ntfslabel is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
mkntfs(8), ntfsprogs(8)


ntfsls

title: ntfsls(8)

text:
# ntfsls(8)

## NAME
ntfsls - list directory contents on an NTFS filesystem

## SYNOPSIS
ntfsls [options] device

ntfsls [ -a | --all ] [ -F | --classify ] [ -f | --force ] [ -h | --help ] [ -i | --inode ] [ -l | --long ] [ -p | --path PATH ] [ -q | --quiet ] [ -s | --system ] [ -V | --version ] [ -v | --verbose ] [ -x | --dos ] device

## DESCRIPTION
ntfsls is used to list information about the files specified by the PATH option (the root directory by default). DEVICE is the special file corresponding to the device (e.g /dev/hdXX) or an NTFS image file.

## OPTIONS
Below is a summary of all the options that ntfsls accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-a, --all

Display all files. If this option is not specified file names in the POSIX namespace will not be displayed.

-F, --classify

Append indicator (one of */=@|) to entries.

-f, --force

Force execution. For example necessary to run on an NTFS partition stored in a normal file.

-h, --help

Print the usage information of ntfsls and exit.

-i, --inode

Print inode number of each file. This is the MFT reference number in NTFS terminology.

-l, --long

Use a long listing format.

-p, --path PATH

The directory whose contents to list or the file (including the path) about which to display information.

-q, --quiet

Suppress some debug/warning/error messages.

-R, --recursive

Show the contents of all directories beneath the specified directory.

-s, --system

Unless this options is specified, all files beginning with a dollar sign character will not be listed as these files are usually system files.

-v, --verbose

Display more debug/warning/error messages.

-V, --version

Print the version number of ntfsls and exit.

-x, --dos

Display short file names, i.e. files in the DOS namespace, instead of long file names, i.e. files in the WIN32 namespace.

## BUGS
There are no known problems with ntfsls. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
This version of ntfsls was written by Lode Leroy, Anton Altaparmakov, Richard Russon, Carmelo Kintana and Giang Nguyen. It was ported to ntfs-3g by Erik Larsson.

## AVAILABILITY
ntfsls is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfsprogs(8)


ntfsprogs

title: ntfsprogs(8)

summary: tools for doing neat things with NTFS

text:
# ntfsprogs(8)

## NAME
ntfsprogs - tools for doing neat things with NTFS

## OVERVIEW
ntfsprogs is a suite of NTFS utilities based around a shared library. The tools are available for free and come with full source code.

## TOOLS
mkntfs(8) - Create an NTFS filesystem.

ntfscat(8) - Dump a file's content to the standard output.

ntfsclone(8) - Efficiently clone, backup, restore or rescue NTFS.

ntfscluster(8) - Locate the files which use the given sectors or clusters.

ntfscmp(8) - Compare two NTFS filesystems and tell the differences.

ntfscp(8) - Copy a file to an NTFS volume.

ntfsfallocate(8) - Preallocate space to a file on an NTFS volume

ntfsfix(8) - Check and fix some common errors, clear the LogFile and make Windows perform a thorough check next time it boots.

ntfsinfo(8) - Show information about NTFS or one of the files or directories within it.

ntfslabel(8) - Show, or set, an NTFS filesystem's volume label.

ntfsls(8) - List information about files in a directory residing on an NTFS.

ntfsresize(8) - Resize NTFS without losing data.

ntfsrecover(8) - Recover updates committed by Windows on an NTFS volume.

ntfstruncate(8) - Truncate a file on an NTFS volume.

ntfsundelete(8) - Recover deleted files from NTFS.

ntfswipe(8) - Overwrite unused space on an NTFS volume.

## AUTHORS
The tools were written by Anton Altaparmakov, Carmelo Kintana, Cristian Klein, Erik Sornes, Giang Nguyen, Holger Ohmacht, Lode Leroy, Matthew J. Fanto, Per Olofsson, Richard Russon, Szabolcs Szakacsits, Yura Pakhuchiy and Yuval Fledel.

## AVAILABILITY
The ntfsprogs are part of the ntfs-3g package which can be downloaded from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfs-3g(8)


ntfsrecover

title: ntfsrecover(8)

text:
# ntfsrecover(8)

## NAME
ntfsrecover - Recover updates committed by Windows on an NTFS volume

## SYNOPSIS
ntfsrecover [options] device

## DESCRIPTION
ntfsrecover applies to the metadata the updates which were requested on Windows but could not be completed because they were interrupted by some event such as a power failure, a hardware crash, a software crash or the device being unplugged. Doing so, the file system is restored to a consistent state, however updates to user data may still be lost.

Updating the file system generally requires updating several records which should all be made for the file system to be kept consistent. For instance, creating a new file requires reserving an inode number (set a bit in a bit map), creating a file record (store the file name and file attributes), and registering the file in a directory (locate the file from some path). When an unfortunate event occurs, and one of these updates could be done but not all of them, the file system is left inconsistent.

A group of updates which have all to be done to preserve consistency is called a transaction, and the end of updates within a transaction is called the commitment of the transaction.

To protect from unfortunate events, Windows first logs in a special file all the metadata update requests without applying any, until the commitment is known. If the event occurs before the commitment, no update has been made and the file system is consistent. If the event occurs after the update, the log file can be analyzed later and the transactions which were committed can be executed again, thus restoring the integrity of the file system.

ntfsrecover similarly examines the log file and applies the updates within committed transactions which could not be done by Windows.

Currently, ntfs-3g does not log updates, so ntfsrecover cannot be used to restore consistency after an unfortunate event occurred while the file system was updated by Linux.

## OPTIONS
Below is a summary of all the options that ntfsrecover accepts. The normal usage is to use no option at all, as most of these options are oriented towards developers needs.

Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -bv is equivalent to -b -v. Long named options can be abbreviated to any unique prefix of their name.

-b, --backward

Examine the actions described in the logfile backward from the latest one to the earliest one without applying any update. This may encompass records generated during several sessions, and when Windows is restarted, it often does not restart writing where it ended the previous session, so this leads to errors and bad sequencing when examining the full log file.

-c, --clusters CLUSTER-RANGE

Restrict the output generated when using options -b -f -u -p to the actions operating on a cluster within the given cluster range. CLUSTER-RANGE is defined by the first and last cluster numbers separated by a hyphen, for instance 100-109 or 0x3e8-0x3ff. A single number means restricting to a single cluster. The first four log blocks have a special role and they are always shown.

-f, --forward NUM

Examine the actions described in the logfile forward from the first one to the last one without applying any update. As the log file is reused circularly, the first one is generally not the earliest. Moreover when Windows is restarted, it often does not restart writing where it ended the previous sessions, and this leads to errors when examining a log file generated during several sessions.

-h, --help

Show some help information.

-k, --kill-fast-restart

When Windows has been interrupted with fast restart mode activated, part of pending changes are kept in the Windows cache and only the same Windows version can recover them. This option can be used to apply the changes recorded in the log file and drop the ones in the Windows cache. This is dangerous and may cause loss of data.

-n, --no-action

Do not apply any modification, useful when using the options -p, -s or -u.

-p, --play COUNT

Undo COUNT transaction sets and redo a single one, a transaction set being all transactions between two consecutive checkpoints. This is useful for replaying some transaction in the past. As a few actions are not undoable, this is not always possible.

-r, --range BLOCK-RANGE

Examine the actions described in the logfile forward restricted to the requested log file block range without applying any update. The first four log blocks have a special role and they are always examined.

-s, --sync

Sync the file system by applying the committed actions which have not been synced previously. This is the default option, used when none of the options -n, -f, -r, -p and -u are present. The option -s can be repeated to request applying the committed actions mentioned in the obsolete restart page. This is useful for testing the situations where the latest restart page cannot be read though it can actually be read.

-t, --transactions COUNT

Display the transaction parameters when examining the log file with one of the options --forward, --backward or --range.

-u, --undo COUNT

Undo COUNT transaction sets, thus resetting the file system to some checkpoint in the past, a transaction set being all transactions between two consecutive checkpoints. As a few actions are not undoable, this is not always possible.

-v, --verbose

Display more debug/warning/error messages. This option may be used twice to display even more information.

-V, --version

Show the version number, copyright and license of ntfsrecover.

## EXAMPLES
Sync an NTFS volume on /dev/sda1.

ntfsrecover -s /dev/sda1

Display all actions which updated a cluster in range 100 to 119 : ntfsrecover --verbose --backward --clusters=100-119 /dev/sda1

## BUGS
If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfsrecover was written by Jean-Pierre Andre

## AVAILABILITY
ntfsrecover is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfs-3g(8), ntfsfix(8), ntfsprogs(8)


ntfsresize

title: ntfsresize(8)

text:
# ntfsresize(8)

## NAME
ntfsresize - resize an NTFS filesystem without data loss

## SYNOPSIS
ntfsresize [OPTIONS] --info(-mb-only) DEVICE

ntfsresize [OPTIONS] [--size SIZE[k|M|G]] DEVICE

## DESCRIPTION
The ntfsresize program safely resizes Windows XP, Windows Server 2003, Windows 2000, Windows NT4 and Longhorn NTFS filesystems without data loss. All NTFS versions are supported, used by 32-bit and 64-bit Windows. Defragmentation is NOT required prior to resizing because the program can relocate any data if needed, without risking data integrity.

Ntfsresize can be used to shrink or enlarge any NTFS filesystem located on an unmounted DEVICE (usually a disk partition). The new filesystem will fit in a DEVICE whose desired size is SIZE bytes. The SIZE parameter may have one of the optional modifiers k, M, G, which means the SIZE parameter is given in kilo-, mega- or gigabytes respectively. Ntfsresize conforms to the SI, ATA, IEEE standards and the disk manufacturers by using k=10^3, M=10^6 and G=10^9.

If both --info(-mb-only) and --size are omitted then the NTFS filesystem will be enlarged to match the underlying DEVICE size.

To resize a filesystem on a partition, you must resize BOTH the filesystem and the partition by editing the partition table on the disk. Similarly to other command line filesystem resizers, ntfsresize doesn't manipulate the size of the partitions, hence to do that you must use a disk partitioning tool as well, for example fdisk(8). Alternatively you could use one of the many user friendly partitioners that uses ntfsresize internally, like Mandriva's DiskDrake, QTParted, SUSE/Novell's YaST Partitioner, IBM's EVMS, GParted or Debian/Ubuntu's Partman.

IMPORTANT! It's a good practice making REGULAR BACKUPS of your valuable data, especially before using ANY partitioning tools. To do so for NTFS, you could use ntfsclone(8). Don't forget to save the partition table as well!

### Shrinkage
If you wish to shrink an NTFS partition, first use ntfsresize to shrink the size of the filesystem. Then you could use fdisk(8) to shrink the size of the partition by deleting the partition and recreating it with the smaller size. Do not make the partition smaller than the new size of NTFS otherwise you won't be able to boot. If you did so notwithstanding then just recreate the partition to be as large as NTFS.

### Enlargement
To enlarge an NTFS filesystem, first you must enlarge the size of the underlying partition. This can be done using fdisk(8) by deleting the partition and recreating it with a larger size. Make sure it will not overlap with another existing partition. You may enlarge upwards (first sector unchanged) or downwards (last sector unchanged), but you may not enlarge at both ends in a single step. If you merge two NTFS partitions, only one of them can be expanded to the merged partition. After you have enlarged the partition, you may use ntfsresize to enlarge the size of the filesystem.

### Partitioning
When recreating the partition by a disk partitioning tool, make sure you create it at the same starting sector and with the same partition type as before. Otherwise you won't be able to access your filesystem. Use the 'u' fdisk command to switch to the reliable sector unit from the default cylinder one.

Also make sure you set the bootable flag for the partition if it existed before. Failing to do so you might not be able to boot your computer from the disk.

## OPTIONS
Below is a summary of all the options that ntfsresize accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-c, --check

By using this option ntfsresize will only check the device to ensure that it is ready to be resized. If not, it will print any errors detected. If the device is fine, nothing will be printed.

-i, --info

By using this option without --expand, ntfsresize will determine the theoretically smallest shrunken filesystem size supported. Most of the time the result is the space already used on the filesystem. Ntfsresize will refuse shrinking to a smaller size than what you got by this option and depending on several factors it might be unable to shrink very close to this theoretical size. Although the integrity of your data should be never in risk, it's still strongly recommended to make a test run by using the --no-action option before real resizing. Practically the smallest shrunken size generally is at around "used space" + (20-200 MB). Please also take into account that Windows might need about 50-100 MB free space left to boot safely.

If used in association with option --expand, ntfsresize will determine the smallest downwards expansion size and the possible increments to the size. These are exact byte counts which must not be rounded. This option may be used after the partition has been expanded provided the upper bound has not been changed.

This option never causes any changes to the filesystem, the partition is opened read-only.

-m, --info-mb-only

Like the info option, only print out the shrinkable size in MB. Print nothing if the shrink size is the same as the original size (in MB). This option cannot be used in association with option --expand.

-s, --size SIZE[k|M|G]

Resize filesystem to fit in a partition whose size is SIZE[k|M|G] bytes by shifting its end and keeping its beginning unchanged. The filesystem size is set to be at least one sector smaller than the partition. The optional modifiers k, M, G mean the SIZE parameter is given in kilo-, mega- or gigabytes respectively. Conforming to standards, k=10^3, M=10^6 and G=10^9. ki=2^10, Mi=2^20 and Gi=2^30 are also allowed. Use this option with --no-action first.

-x, --expand

Expand the filesystem to the current partition size, shifting down its beginning and keeping its end unchanged. The metadata is recreated in the expanded space and no user data is relocated. This is incompatible with option -s (or --size) and can only be made if the expanded space is an exact multiple of the cluster size. It must also be large enough to hold the new metadata. If the expansion is interrupted for some reason (power outage, etc), you may restart the resizing, as the original data and metadata have been kept unchanged.

Note : expanding a Windows system partition and filesystem downwards may lead to the registry or some files not matching the new system layout, or to some important files being located too far from the beginning of the partition, thus making Windows not bootable.

-f, --force

Forces ntfsresize to proceed with the resize operation either without prompting for an explicit acceptance, or if the filesystem is marked for consistency check. Double the option (-ff, --force --force) to avoid prompting even if the file system is marked for check. Please note, ntfsresize always marks the filesystem for consistency check before a real resize operation and it leaves that way for extra safety. Thus if NTFS was marked by ntfsresize then it's safe to use this option. If you need to resize several times without booting into Windows between each resizing steps then you must use this option.

-n, --no-action

Use this option to make a test run before doing the real resize operation. Volume will be opened read-only and ntfsresize displays what it would do if it were to resize the filesystem. Continue with the real resizing only if the test run passed.

-b, --bad-sectors

Support disks having hardware errors, bad sectors with those ntfsresize would refuse to work by default. Prior using this option, it's strongly recommended to make a backup by ntfsclone(8) using the --rescue option, then running 'chkdsk /f /r volume:' on Windows from the command line. If the disk guarantee is still valid then replace it. It's defected. Please also note, that no software can repair these type of hardware errors. The most what they can do is to work around the permanent defects.

This option doesn't have any effect if the disk is flawless.

-P, --no-progress-bar

Don't show progress bars.

-v, --verbose

More output.

-V, --version

Print the version number of ntfsresize and exit.

-h, --help

Display help and exit.

## EXIT CODES
The exit code is 0 on success, non-zero otherwise.

## KNOWN ISSUES
No reliability problem is known. If you find a bug please send an email describing the problem to the development team at:

ntfs-3g-devel@lists.sf.net

There are a few very rarely met restrictions at present: filesystems having unknown bad sectors, relocation of the first MFT extent and resizing into the middle of a $MFTMirr extent aren't supported yet. These cases are detected and resizing is restricted to a safe size or the closest safe size is displayed.

Ntfsresize schedules an NTFS consistency check and after the first boot into Windows you must see chkdsk running on a blue background. This is intentional and no need to worry about it. Windows may force a quick reboot after the consistency check. Moreover after repartitioning your disk and depending on the hardware configuration, the Windows message System Settings Change may also appear. Just acknowledge it and reboot again.

The disk geometry handling semantic (HDIO_GETGEO ioctl) has changed in an incompatible way in Linux 2.6 kernels and this triggered multitudinous partition table corruptions resulting in unbootable Windows systems, even if NTFS was consistent, if parted(8) was involved in some way. This problem was often attributed to ntfsresize but in fact it's completely independent of NTFS thus ntfsresize. Moreover ntfsresize never touches the partition table at all. By changing the 'Disk Access Mode' to LBA in the BIOS makes booting work again, most of the time. You can find more information about this issue in the Troubleshooting section of the below referred Ntfsresize FAQ.

## AUTHORS
ntfsresize was written by Szabolcs Szakacsits, with contributions from Anton Altaparmakov and Richard Russon. It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.

## ACKNOWLEDGEMENT
Many thanks to Anton Altaparmakov and Richard Russon for libntfs, the excellent documentation and comments, to Gergely Madarasz, Dewey M. Sasser and Miguel Lastra and his colleagues at the University of Granada for their continuous and highly valuable help, furthermore to Erik Meade, Martin Fick, Sandro Hawke, Dave Croal, Lorrin Nelson, Geert Hendrickx, Robert Bjorkman and Richard Burdick for beta testing the relocation support, to Florian Eyben, Fritz Oppliger, Richard Ebling, Sid-Ahmed Touati, Jan Kiszka, Benjamin Redelings, Christopher Haney, Ryan Durk, Ralf Beyer, Scott Hansen, Alan Evans for the valued contributions and to Theodore Ts'o whose resize2fs(8) man page originally formed the basis of this page.

## AVAILABILITY
ntfsresize is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
fdisk(8), cfdisk(8), sfdisk(8), parted(8), evms(8), ntfsclone(8), mkntfs(8), ntfsprogs(8)


ntfssecaudit

title: ntfssecaudit(8)

summary: NTFS Security Data Auditing

text:
# ntfssecaudit(8)

## NAME
ntfssecaudit - NTFS Security Data Auditing

## SYNOPSIS
ntfssecaudit [options] args

Where options is a combination of :

-a full auditing of security data (Linux only)

-b backup ACLs

-e setting extra backed-up parameters (in conjunction with -s)

-h displaying hexadecimal security descriptors saved in a file

-r recursing in a directory

-s setting backed-up ACLs

-u getting a user mapping proposal

-v verbose (very verbose if set twice)

and args define the parameters and the set of files acted upon.

Typing secaudit with no args will display a summary of available options.

## DESCRIPTION
ntfssecaudit displays the ownership and permissions of a set of files on an NTFS file system, and checks their consistency. It can be started in terminal mode only (no graphical user interface is available.)

When a volume is required, it has to be unmounted, and the command has to be issued as root. The volume can be either a block device (i.e. a disk partition) or an image file.

When acting on a directory or volume, the command may produce a lot of information. It is therefore advisable to redirect the output to a file or pipe it to a text editor for examination.

## OPTIONS
Below are the valid combinations of options and arguments that ntfssecaudit accepts. All the indicated arguments are mandatory and must be unique (if wildcards are used, they must resolve to a single name.)

-h file

Displays in an human readable form the hexadecimal security descriptors saved in file. This can be used to turn a verbose output into a very verbose output.

-a[rv] volume

Audits the volume : all the global security data on volume are scanned and errors are displayed. If option -r is present, all files and directories are also scanned and their relations to global security data are checked. This can produce a lot of data. This option is not effective on volumes formatted for old NTFS versions (pre NTFS 3.0). Such volumes have no global security data.

When errors are signalled, it is advisable to repair the volume with an appropriate tool (such as chkdsk on Windows.)

[-v] volume file

Displays the security parameters of file : its interpreted Linux mode (rwx flags in octal) and Posix ACL[1], its security key if any, and its security descriptor if verbose output.

-r[v] volume directory

displays the security parameters of all files and subdirectories in directory : their interpreted Linux mode (rwx flags in octal) and Posix ACL[1], their security key if any, and their security descriptor if verbose output.

-b[v] volume [directory]

Recursively extracts to standard output the NTFS ACLs of files in volume and directory.

-s[ev] volume [backup-file]

Sets the NTFS ACLS as indicated in backup-file or standard input. The input data must have been created on Linux. With option -e, also sets extra parameters (currently Windows attrib).

volume perms file

Sets the security parameters of file to perms. Perms is the Linux requested mode (rwx flags, expressed in octal form as in chmod) or a Posix ACL[1] (expressed like in setfacl -m). This sets a new ACL which is effective for Linux and Windows.

-r[v] volume perms directory

Sets the security parameters of all files and subdirectories in directory to perms. Perms is the Linux requested mode (rwx flags, expressed in octal form as in chmod), or a Posix ACL[1] (expressed like in setfacl -m.) This sets new ACLs which are effective for Linux and Windows.

[-v] mounted-file

Displays the security parameters of mounted-file : its interpreted Linux mode (rwx flags in octal) and Posix ACL[1], its security key if any, and its security descriptor if verbose output. This is a special case which acts on a mounted file (or directory) and does not require being root. The Posix ACL interpretation can only be displayed if the full path to mounted-file from the root of the global file tree is provided.

-u[v] mounted-file

Displays a proposed contents for a user mapping file, based on the ownership parameters set by Windows on mounted-file, assuming this file was created on Windows by the user who should be mapped to the current Linux user. The displayed information has to be copied to the file .NTFS-3G/UserMapping where .NTFS-3G is a hidden subdirectory of the root of the partition for which the mapping is to be defined. This will cause the ownership of files created on that partition to be the same as the original mounted-file.

## NOTE
[1] provided the POSIX ACL option was selected at compile time. A Posix ACL specification looks like "[d:]{ugmo}:[id]:[perms],..." where id is a numeric user or group id, and perms an octal digit or a set from the letters r, w and x.

Example : "u::7,g::5,o:0,u:510:rwx,g:500:5,d:u:510:7"

## EXAMPLES
Audit the global security data on /dev/sda1

ntfssecaudit -ar /dev/sda1

Display the ownership and permissions parameters for files in directory /audio/music on device /dev/sda5, excluding sub-directories : ntfssecaudit /dev/sda5 /audio/music

Set all files in directory /audio/music on device /dev/sda5 as writeable by owner and read-only for everybody : ntfssecaudit -r /dev/sda5 644 /audio/music

## EXIT CODES
ntfssecaudit exits with a value of 0 when no error was detected, and with a value of 1 when an error was detected.

## KNOWN ISSUES
Please see

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ/

for common questions and known issues. If you would find a new one in the latest release of the software then please send an email describing it in detail. You can contact the development team on the ntfs-3g-devel@lists.sf.net address.

## AUTHORS
ntfssecaudit has been developed by Jean-Pierre André.

## THANKS
Several people made heroic efforts, often over five or more years which resulted the ntfs-3g driver. Most importantly they are Anton Altaparmakov, Richard Russon, Szabolcs Szakacsits, Yura Pakhuchiy, Yuval Fledel, and the author of the groundbreaking FUSE filesystem development framework, Miklos Szeredi.

## SEE ALSO
ntfsprogs(8), attr(5), getfattr(1)


ntfstruncate

title: ntfstruncate(8)

summary: truncate a file on an NTFS volume

text:
# ntfstruncate(8)

## NAME
ntfstruncate - truncate a file on an NTFS volume

## SYNOPSIS
ntfstruncate [options] device file [attr-type [attr-name]] new-length

## DESCRIPTION
ntfstruncate truncates (or extends) a specified attribute belonging to a file or directory, to a specified length.

## OPTIONS
Below is a summary of all the options that ntfstruncate accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-f, --force

This will override some sensible defaults, such as not using a mounted volume. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-l

Display licensing information.

-n, --no-action

Simulate the truncation without actually write to device.

-q, --quiet

Suppress some debug/warning/error messages.

-v, --verbose

Display more debug/warning/error messages.

-V, --version

Show the version number, copyright and license of ntfstruncate.

attr-type

Define a particular attribute type to be truncated (advanced use only). By default, the unnamed $DATA attribute (the contents of a plain file) will be truncated. The attribute has to be specified by a number in decimal or hexadecimal : Hex

Decimal

Name

0x10

16

"$STANDARD_INFORMATION"

0x20

32

"$ATTRIBUTE_LIST"

0x30

48

"$FILE_NAME"

0x40

64

"$OBJECT_ID"

0x50

80

"$SECURITY_DESCRIPTOR"

0x60

96

"$VOLUME_NAME"

0x70

112

"$VOLUME_INFORMATION"

0x80

128

"$DATA"

0x90

144

"$INDEX_ROOT"

0xA0

160

"$INDEX_ALLOCATION"

0xB0

176

"$BITMAP"

0xC0

192

"$REPARSE_POINT"

0xD0

208

"$EA_INFORMATION"

0xE0

224

"$EA"

0xF0

240

"$PROPERTY_SET"

0x100

256

"$LOGGED_UTILITY_STREAM"

attr-name

Define the name of the particular attribute type to be truncated (advanced use only).

new-length

Specify the target size of the file. It will be rounded up to a multiple of the cluster size. A suffix of K, M, G, T, P or E may be appended to mean a multiplicative factor of a power of 1000. Similarly a suffix of Ki, Mi, Gi, Ti, Pi or Ei may be appended to mean a multiplicative factor of a power of 1024.

## EXAMPLES
Resize to 100MB the file database.db located in the Data directory which is at the root of an NTFS file system.

ntfstruncate /dev/sda1 Data/database.db 100M

## BUGS
There are no known problems with ntfstruncate. If you find a bug, please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfstruncate was written by Anton Altaparmakov.

## AVAILABILITY
ntfstruncate is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfs-3g(8), ntfsfallocate(8), ntfsprogs(8).


ntfsundelete

title: ntfsundelete(8)

text:
# ntfsundelete(8)

## NAME
ntfsundelete - recover a deleted file from an NTFS volume.

## SYNOPSIS
ntfsundelete [options] device

## DESCRIPTION
ntfsundelete has three modes of operation: scan, undelete and copy.

### Scan
The default mode, scan simply reads an NTFS Volume and looks for files that have been deleted. Then it will print a list giving the inode number, name and size.

### Undelete
The undelete mode takes the files either matching the regular expression (option -m) or specified by the inode-expressions and recovers as much of the data as possible. It saves the result to another location. Partly for safety, but mostly because NTFS write support isn't finished.

### Copy
This is a wizard's option. It will save a portion of the MFT to a file. This probably only be useful when debugging ntfsundelete

### Notes
ntfsundelete only ever reads from the NTFS Volume. ntfsundelete will never change the volume.

## CAVEATS

### Miracles
ntfsundelete cannot perform the impossible.

When a file is deleted the MFT Record is marked as not in use and the bitmap representing the disk usage is updated. If the power isn't turned off immediately, the free space, where the file used to live, may become overwritten. Worse, the MFT Record may be reused for another file. If this happens it is impossible to tell where the file was on disk.

Even if all the clusters of a file are not in use, there is no guarantee that they haven't been overwritten by some short-lived file.

### Locale
In NTFS all the filenames are stored as Unicode. They will be converted into the current locale for display by ntfsundelete. The utility has successfully displayed some Chinese pictogram filenames and then correctly recovered them.

### Extended MFT Records
In rare circumstances, a single MFT Record will not be large enough to hold the metadata describing a file (a file would have to be in hundreds of fragments for this to happen). In these cases one MFT record may hold the filename, but another will hold the information about the data. ntfsundelete will not try and piece together such records. It will simply show unnamed files with data.

### Compressed and Encrypted Files
ntfsundelete cannot recover compressed or encrypted files. When scanning for them, it will display as being 0% recoverable.

### The Recovered File's Size and Date
To recover a file ntfsundelete has to read the file's metadata. Unfortunately, this isn't always intact. When a file is deleted, the metadata can be left in an inconsistent state. e.g. the file size may be zero; the dates of the file may be set to the time it was deleted, or random.

To be safe ntfsundelete will pick the largest file size it finds and write that to disk. It will also try and set the file's date to the last modified date. This date may be the correct last modified date, or something unexpected.

## OPTIONS
Below is a summary of all the options that ntfsundelete accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.

-b, --byte NUM

If any clusters of the file cannot be recovered, the missing parts will be filled with this byte. The default is zeros.

-C, --case

When scanning an NTFS volume, any filename matching (using the --match option) is case-insensitive. This option makes the matching case-sensitive.

-c, --copy RANGE

This wizard's option will write a block of MFT FILE records to a file. The default file is mft which will be created in the current directory. This option can be combined with the --output and --destination options.

-d, --destination DIR

This option controls where to put the output file of the --undelete and --copy options.

-f, --force

This will override some sensible defaults, such as not overwriting an existing file. Use this option with caution.

-h, --help

Show a list of options with a brief description of each one.

-i, --inodes RANGE

Recover the files with these inode numbers. RANGE can be a single inode number, several numbers separated by commas "," or a range separated by a dash "-".

-m, --match PATTERN

Filter the output by only looking for matching filenames. The pattern can include the wildcards '?', match exactly one character or '*', match zero or more characters. By default the matching is case-insensitive. To make the search case sensitive, use the --case option.

-O, --optimistic

Recover parts of the file even if they are currently marked as in use.

-o, --output FILE

Use this option to set name of output file that --undelete or --copy will create.

-P, --parent

Display the parent directory of a deleted file.

-p, --percentage NUM

Filter the output of the --scan option, by only matching files with a certain amount of recoverable content. Please read the caveats section for more details.

-q, --quiet

Reduce the amount of output to a minimum. Naturally, it doesn't make sense to combine this option with --scan.

-s, --scan

Search through an NTFS volume and print a list of files that could be recovered. This is the default action of ntfsundelete. This list can be filtered by filename, size, percentage recoverable or last modification time, using the --match, --size, --percent and --time options, respectively. The output of scan will be:

```
Inode  Flags  %age     Date    Time    Size  Filename

 6038  FN..    93%  2002-07-17 13:42  26629  thesis.doc
```

Flag

Description

F/D

File/Directory

N/R

(Non-)Resident data stream

C/E

Compressed/Encrypted data stream

!

Missing attributes

The percentage field shows how much of the file can potentially be recovered.

-S, --size RANGE

Filter the output of the --scan option, by looking for a particular range of file sizes. The range may be specified as two numbers separated by a '-'. The sizes may be abbreviated using the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and terabytes respectively.

-t, --time SINCE

Filter the output of the --scan option. Only match files that have been altered since this time. The time must be given as number using a suffix of d, w, m, y for days, weeks, months or years ago.

-T, --truncate

If ntfsundelete is confident about the size of a deleted file, then it will restore the file to exactly that size. The default behaviour is to round up the size to the nearest cluster (which will be a multiple of 512 bytes).

-u, --undelete

Select undelete mode. You can specify the files to be recovered using by using --match or --inodes options. This option can be combined with --output, --destination, and --byte. When the file is recovered it will be given its original name, unless the --output option is used.

-v, --verbose

Increase the amount of output that ntfsundelete prints.

-V, --version

Show the version number, copyright and license for ntfsundelete.

## EXAMPLES
Look for deleted files on /dev/hda1.

ntfsundelete /dev/hda1

Look for deleted documents on /dev/hda1. ntfsundelete /dev/hda1 -s -m '*.doc'

Look for deleted files between 5000 and 6000000 bytes, with at least 90% of the data recoverable, on /dev/hda1. ntfsundelete /dev/hda1 -S 5k-6m -p 90

Look for deleted files altered in the last two days ntfsundelete /dev/hda1 -t 2d

Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1 ntfsundelete /dev/sda1 -u -i 2,5,100-131

Undelete inode number 3689, call the file 'work.doc', set it to recovered size and put it in the user's home directory. ntfsundelete /dev/hda1 -u -T -i 3689 -o work.doc -d ~

Save MFT Records 3689 to 3690 to a file 'debug' ntfsundelete /dev/hda1 -c 3689-3690 -o debug

## BUGS
There are some small limitations to ntfsundelete, but currently no known bugs. If you find a bug please send an email describing the problem to the development team:

ntfs-3g-devel@lists.sf.net

## AUTHORS
ntfsundelete was written by Richard Russon and Holger Ohmacht, with contributions from Anton Altaparmakov. It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.

## AVAILABILITY
ntfsundelete is part of the ntfs-3g package and is available from:

https://github.com/tuxera/ntfs-3g/wiki/

## SEE ALSO
ntfsinfo(8), ntfsprogs(8)


ntfsusermap

title: ntfsusermap(8)

summary: NTFS Building a User Mapping File

text:
# ntfsusermap(8)

## NAME
ntfsusermap - NTFS Building a User Mapping File

## SYNOPSIS
ntfsusermap windows-system-device [other-ntfs-device...]

Where windows-system-device is the device containing the Windows system whose users are to be mapped to current Linux system.

And other-ntfs-device is another device containing files which are to be accessed both by the Windows mentioned above and current Linux system.

the ntfsusermap command must be started as root, and the designated devices must not be mounted.

Typing ntfsusermap with no args will display a summary of command arguments.

## DESCRIPTION
ntfsusermap creates the file defining the mapping of Windows accounts to Linux logins for users who owns files which should be visible from both Windows and Linux.

It relies on existing files which were created on Windows, trying to locate significant files and asking which Linux user or group should own them. When a Linux owner or group is requested, the reply may be :

- the uid or gid (numeric or symbolic) of Linux owner or group of the file.

In that situation, no more file with the same Windows owner will be selected.

- or no answer, when not able to define the owner or group. In that situation another file owned by the same Windows user or group may be selected later so that a mapping can be defined.

The mappings for standard Windows users, such as "Administrator" or "All Users" are defined implicitly. As a consequence a user mapping should never be defined as Linux root.

When there are no more significant files, ntfsusermap create the mapping file into the file UserMapping in the current directory. This file has to be moved to the hidden directory .NTFS-3G in the root of all the NTFS file systems to be shared between Windows and Linux. This requires the file system to be mounted, but the created file will not be taken into account if not present at mount time, which means the file system has to be unmounted and mounted again for the new mapping file to be taken into account.

## OPTIONS
No option is defined for ntfsusermap.

## EXAMPLES
Map the users defined on the Windows system present on /dev/sda1 :

ntfsusermap /dev/sda1

## EXIT CODES
ntfsusermap exits with a value of 0 when no error was detected, and with a value of 1 when an error was detected.

## KNOWN ISSUES
Please see

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ/

for common questions and known issues. If you would find a new one in the latest release of the software then please send an email describing it in detail. You can contact the development team on the ntfs-3g-devel@lists.sf.net address.

## AUTHORS
ntfs-3g.secaudit has been developed by Jean-Pierre André.

## THANKS
Several people made heroic efforts, often over five or more years which resulted the ntfs-3g driver. Most importantly they are Anton Altaparmakov, Richard Russon, Szabolcs Szakacsits, Yura Pakhuchiy, Yuval Fledel, and the author of the groundbreaking FUSE filesystem development framework, Miklos Szeredi.

## SEE ALSO
ntfsprogs(8), attr(5), getfattr(1)