fsntfsinfo

NAME
fsntfsinfo - determines information about a Windows NT File System (NTFS) volume

SYNOPSIS
fsntfsinfo [-B bodyfile] [-E mft_entry_index] [-F file_entry] [-o offset] [-dhHUvV] source

DESCRIPTION
fsntfsinfo is a utility to determine information about a Windows NT File System (NTFS) volume

fsntfsinfo is part of the libfsntfs package. libfsntfs is a library to access the Windows NT File System (NTFS) format

source is the source file.

The options are as follows:

-B bodyfile
    output file system hierarchy as a bodyfile

-d  calculate a MD5 hash of a file entry to include in the bodyfile

-E mft_entry_index
    show information about a specific MFT entry index or "all"

-F file_entry
    show information about a specific file entry path

-h  shows this help

-H  shows the file system hierarcy

-o offset
    specify the volume offset

-U  shows information from the USN change journal ($UsnJrnl)

-v  verbose output to stderr

-V  print version

ENVIRONMENT
None

FILES
None

EXAMPLES

    # fsntfsinfo ntfs-img-kw-1.dd
    fsntfsinfo 20160414

    Windows NT File System information:

    Volume information:
    	Name				: KW-SRCH-1
    	Version				: 3.1
    	Serial number			: ba50ed9250ed5623
    	Cluster block size		: 512
    	MFT entry size			: 1024
    	Index entry size		: 4096

DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

BUGS
Please report bugs of any kind to <joachim.metz@gmail.com> or on the project website: https://github.com/libyal/libfsntfs/

AUTHOR
These man pages were written by Joachim Metz.

COPYRIGHT
Copyright 2010-2022, Joachim Metz <joachim.metz@gmail.com>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

SEE ALSO