impacket-ntfs-read

impacket-ntfs-read [-h] [-extract pathname] [-debug] [-ts] volume

impacket-ntfs-read (upstream name ntfs-read.py) is a small NTFS explorer from the Impacket suite. It opens an NTFS volume or image and parses the MFT and file records itself instead of relying on the operating system's filesystem driver, then offers a mini shell to browse and extract files.Because it reads the raw structures, it can copy files that Windows keeps locked while running, such as registry hives (SAM, SYSTEM, SECURITY) or NTDS.dit, when run against the live volume with administrator rights. It is also handy for inspecting disk images forensically without mounting them.

volume

NTFS volume to open, e.g. a block device like /dev/sdb1, a raw image file, or \\\\.\\C: on Windows

Extract the given NTFS path (backslash-separated) to the current directory and exit

Turn debug output on

Add a timestamp to every logging output

Show help and exit

ls

List files in the current directory

Change the current directory on the volume

Show the current directory on the volume

Print the contents of a file

Hexdump the contents of a file

Copy a file from the volume to the local directory

Change the local directory

Run a local shell command

Leave the shell

The tool is strictly read-only and works on local volumes or images only; it has no network or SMB support. Reading a block device on Linux requires root. Paths use backslashes. Compressed and encrypted (EFS) files may not be extracted correctly.

Part of Impacket, originally developed by Alberto Solino at Core Security, later maintained by SecureAuth and now by Fortra. The script is installed as impacket-ntfs-read on Kali and Debian-based packages.

ntfs-read.py(1), impacket-secretsdump(1), ntfsls(8), ntfscat(8), ntfs-3g(8)

Source code