ntfsls

ntfsls [options] device:[path]

-a
    Show all files, including hidden files. Similar to `ls -a`.

-l
    Long listing format. Displays detailed file information, including permissions, size, owner, group, and modification date. Similar to `ls -l`.

-R
    Recursively list subdirectories encountered.

device:[path]
    The device to list, and optionally the path inside NTFS volume.

The `ntfsls` command is a Linux utility used to list the contents of files and directories located on NTFS (New Technology File System) volumes. Unlike the standard `ls` command, `ntfsls` is specifically designed to work with NTFS file systems, allowing users to examine files and directories on partitions formatted with this Microsoft Windows file system. It allows users to view the files inside NTFS volumes, without mount the volumes in read-write.

Key Features:

• List files and directories on NTFS volumes.
• Display file size, modification date, and attributes.
• Provides functionality similar to the `ls` command but tailored for NTFS.

• Examining files on an external NTFS hard drive.
• Verifying the contents of an NTFS partition.
• Recovering data from an NTFS volume.

ntfsls requires the `ntfs-3g` package to be installed. It is primarily for reading NTFS volumes, and attempting to modify files directly using other tools without proper mounting can lead to data loss or corruption.

• List all files in the root directory of `/dev/sda1`:
  `ntfsls /dev/sda1:`
• List all files and subdirectories recursively in the `/Windows` directory of `/dev/sdb2`:
  `ntfsls -R /dev/sdb2:/Windows`
• List detailed information about files in the `/Documents` directory of `/dev/sdc1`:
  `ntfsls -l /dev/sdc1:/Documents`

The `ntfsls` command is part of the `ntfs-3g` suite, which provides read and write support for NTFS file systems on Linux. The suite was created to allow Linux systems to interact seamlessly with NTFS volumes, commonly used on Windows systems. `ntfsls` allows examination of NTFS file structure without mounting the partition in read-write mode, and therefore lowering risk of data loss due to mounting errors.

ls(1), ntfs-3g(8), mount(8)