ntfsls

ntfsls [options] device [path]

-a, --all
    Do not hide entries starting with '.' (dot).

-l, --long-listing
    Use a long listing format, showing file details including NTFS attributes.

-d, --directory
    List directory entries themselves, not their contents.

-F, --classify
    Append an indicator ('*', '/', '=', '>', '@', '|') to entries based on type.

-p, --pager
    Pipe output to a pager (e.g., less).

-q, --quiet
    Suppress verbose output.

-f, --force
    Override some safety checks during operation.

-i, --inode
    List inode (MFT record) numbers for each file.

-k, --kilobytes
    Report allocated sizes in kilobytes.

-R, --recursive
    List subdirectories recursively.

-s, --size
    Print the allocated size of each file in blocks.

-S, --sort-by-size
    Sort entries by size, largest first.

-t, --sort-by-time
    Sort entries by modification time, newest first.

-r, --reverse
    Reverse the order of the sort.

-u, --access-time
    Use access times for sorting (with -t) and long listing (with -l).

-c, --change-time
    Use ctime (status change time) for sorting (with -t) and long listing (with -l).

-v, --verbose
    Produce more verbose output.

-h, --help
    Display a help message and exit.

-V, --version
    Display version information and exit.

ntfsls is a utility from the ntfs-3g project designed to list the contents of directories on NTFS file systems. Unlike the standard ls command, ntfsls operates directly on an unmounted or mounted NTFS volume specified by its device path (e.g., /dev/sda1), providing a direct view of the NTFS metadata. It offers similar functionality to ls, including long listing formats, recursive directory traversal, and sorting options, but it displays NTFS-specific attributes like hidden, system, compressed, or encrypted flags where applicable, rather than traditional Unix permissions. This command is invaluable for examining the structure and contents of Windows partitions from a Linux environment without requiring the partition to be fully mounted, making it a powerful diagnostic and inspection tool for mixed-OS systems or data recovery scenarios.

ntfsls operates directly on the NTFS file system structure, requiring the target partition to be specified by its device node (e.g., /dev/sda1). It does not interact with the Linux VFS (Virtual File System) layer in the same way ls does for mounted file systems. Therefore, it won't reflect Linux-specific permissions or ownership, but rather NTFS attributes like archive, hidden, system, or encrypted flags. Ensure the device is not heavily in use or corrupted before running, though it's generally a read-only operation.

ntfsls requires direct access to the NTFS device (e.g., /dev/sdb1), not a mount point. This allows inspection of partitions even if they cannot be mounted due to errors or if you wish to avoid altering the file system state.

When using the long listing format (-l), ntfsls displays NTFS-specific file attributes (e.g., A for Archive, H for Hidden, S for System, C for Compressed, E for Encrypted) instead of standard Unix permissions, providing insight into the Windows-native file properties.

The ntfsls command is an integral part of the ntfs-3g project, an open-source, GPL-licensed NTFS driver for Linux and other Unix-like operating systems. Initiated to provide robust read/write support for Microsoft Windows NTFS file systems, ntfs-3g filled a critical gap in Linux's ability to seamlessly interact with Windows partitions. ntfsls was developed as a complementary utility, offering a familiar ls-like interface specifically tailored for inspecting the contents of NTFS volumes, even when they are not mounted or are in a potentially problematic state. Its existence simplifies diagnostics and data access for users operating in dual-boot environments or needing to recover data from Windows systems.

ls(1), ntfs-3g(8), ntfsmount(8), ntfsinfo(8), ntfsfix(8)