ntfs-3g.probe

ntfs-3g.probe [options] <device>

<device>
    The block device containing the NTFS filesystem to probe (e.g., /dev/sda1).

-h, --help
    Show a help message and exit.

-V, --version
    Show version information and exit.

-f, --force
    Force probing even if the device is already mounted. Use with caution.

-q, --quiet
    Suppress normal output; rely solely on the exit status for scripting.

-r, --read-only-state
    Exit with status 0 if the partition can be mounted read-only, 1 otherwise.

-u, --hibernation-state
    Exit with status 0 if the partition is hibernated, 1 otherwise.

-w, --windows-shutdown-state
    Exit with status 0 if Windows was not properly shut down (i.e., Fast Startup or dirty flag is set), 1 otherwise.

ntfs-3g.probe is a diagnostic utility included with the ntfs-3g driver suite, designed to inspect the state of an NTFS filesystem on a specified block device. Its primary function is to determine if the NTFS partition is in a clean state, suitable for mounting and modification without risking data corruption.

The command checks for critical conditions such as Windows hibernation, Fast Startup (a feature in Windows 8/10/11 that uses a form of hibernation), and a "dirty" filesystem flag. If the partition is hibernated or Fast Startup is active, ntfs-3g.probe will advise against mounting and writing to the partition from Linux, as this could lead to data loss or corruption when Windows next boots. A dirty filesystem flag similarly indicates inconsistencies that should be resolved by booting Windows and performing a proper shutdown or running chkdsk.

While often called implicitly by ntfs-3g or the mount command before an NTFS filesystem is mounted, ntfs-3g.probe can also be run manually to pre-check a filesystem's health and readiness, aiding in scripting and ensuring data integrity.

ntfs-3g.probe only reports the state of the NTFS partition; it does not fix any issues. If the partition is reported as hibernated or affected by Fast Startup, you must boot into Windows and perform a full shutdown (or disable Fast Startup) for safe read-write access from Linux. A 'dirty' flag requires running chkdsk on Windows. While ntfs-3g often calls probe internally, manual use is primarily for advanced scripting or troubleshooting.

The exit status of ntfs-3g.probe is crucial for scripting:
0: Success, or the specific condition checked by -u, -w, or -r was met.
1: The condition checked by -u, -w, or -r was not met, or a general failure occurred.
>1: An error occurred during execution.

These Windows features leave the NTFS filesystem in a state that is unsafe for write operations from other operating systems like Linux. ntfs-3g.probe explicitly warns about these conditions. To safely modify an NTFS partition from Linux, you must disable Fast Startup in Windows power options and ensure a full shutdown (not a restart or hibernate).

ntfs-3g.probe is an integral part of the ntfs-3g project, which began as a FUSE-based driver aimed at providing robust and full read-write support for NTFS filesystems on Linux. Developed to overcome the limitations of earlier, often read-only, NTFS drivers, the ntfs-3g suite, including ntfs-3g.probe, evolved to handle the complexities introduced by modern Windows features like hibernation and Fast Startup, ensuring data integrity across dual-boot environments.

ntfs-3g(8), mount(8), umount(8), fdisk(8), lsblk(8)