ntfs-read.py

all

A read-only NTFS explorer for accessing and extracting files from NTFS volumes. Part of the Impacket suite.

Examples (4)

Open an NTFS volume for exploration (e.g., `C:\.\\` or `/dev/disk1s1`)

ntfs-read.py volume

Extract a specific file from an NTFS volume (e.g., `\windows\system32\config\sam`)

ntfs-read.py -extract \windows\system32\config\sam volume

Enable debug output

ntfs-read.py -debug volume

Display help

ntfs-read.py --help