diff --git a/pages/common/impacket-ntfs-read.md b/pages/common/impacket-ntfs-read.md new file mode 100644 index 0000000000..32c2485a84 --- /dev/null +++ b/pages/common/impacket-ntfs-read.md @@ -0,0 +1,7 @@ +# impacket-ntfs-read + +> This command is an alias of `ntfs-read.py`. + +- View documentation for the original command: + +`tldr ntfs-read.py` diff --git a/pages/common/ntfs-read.py.md b/pages/common/ntfs-read.py.md new file mode 100644 index 0000000000..fe4e0e1450 --- /dev/null +++ b/pages/common/ntfs-read.py.md @@ -0,0 +1,21 @@ +# ntfs-read.py + +> A read-only NTFS explorer for accessing and extracting files from NTFS volumes. +> Part of the Impacket suite. +> More information: . + +- Open an NTFS volume for exploration (e.g., `C:\.\\` or `/dev/disk1s1`): + +`ntfs-read.py {{volume}}` + +- Extract a specific file from an NTFS volume (e.g., `\windows\system32\config\sam`): + +`ntfs-read.py -extract {{\windows\system32\config\sam}} {{volume}}` + +- Enable debug output: + +`ntfs-read.py -debug {{volume}}` + +- Display help message: + +`ntfs-read.py --help`