NTFSCLUSTER(8) System Manager's Manual NTFSCLUSTER(8)
ntfscluster - identify files in a specified region of an NTFS volume.
ntfscluster [ options ] device
ntfscluster has three modes of operation: info, sector and cluster.
The default mode, info is currently not implemented. It will display
general information about the NTFS volume when it is working.
The sector mode will display a list of files that have data in the
specified range of sectors.
The cluster mode will display a list of files that have data in the
specified range of clusters. When the cluster size is one sector, this
will be equivalent to the sector mode of operation.
Below is a summary of all the options that ntfscluster accepts. All
options have two equivalent names. The short name is preceded by - and
the long name is preceded by --. Any single letter options, that don't
take an argument, can be combined into a single command, e.g. -fv is
equivalent to -f -v. Long named options can be abbreviated to any
unique prefix of their name.
Any files whose data is in this range of clusters will be dis-
This will override some sensible defaults, such as not working
with a mounted volume. Use this option with caution.
--help Show a list of options with a brief description of each one.
--info This option is not yet implemented.
Reduce the amount of output to a minimum. Naturally, it doesn't
make sense to combine this option with
Any files whose data is in this range of sectors will be dis-
Increase the amount of output that ntfscluster prints.
Show the version number, copyright and license ntfscluster.
Get some information about the volume /dev/hda1.
Look for files in the first 500 clusters of /dev/hda1.
ntfscluster -c 0-500 /dev/hda1
The info mode isn't implemented yet. This program is quite limited,
but it has no known bugs. If you find one, please send an email to
ntfscluster was written by Richard Russon (FlatCap)
ntfscluster is part of the ntfsprogs package and is available from
ntfsprogs version 1.9.4 September 2003 NTFSCLUSTER(8)