From 6364f693e4a53de37405ce592fec1c65e37d85be Mon Sep 17 00:00:00 2001 From: Machiavelli <145562237+MachiavelliII@users.noreply.github.com> Date: Sat, 3 May 2025 13:01:39 +0300 Subject: [PATCH] ntfs-read.py, impacket-ntfs-read: add page (#16346) * ntfs-read.py: add page * impacket-ntfs-read: add page * impacket-ntfs-read: update page * Update pages/common/ntfs-read.py.md Co-authored-by: Fazle Arefin --------- Co-authored-by: Fazle Arefin --- pages/common/impacket-ntfs-read.md | 7 +++++++ pages/common/ntfs-read.py.md | 21 +++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 pages/common/impacket-ntfs-read.md create mode 100644 pages/common/ntfs-read.py.md diff --git a/pages/common/impacket-ntfs-read.md b/pages/common/impacket-ntfs-read.md new file mode 100644 index 0000000000..32c2485a84 --- /dev/null +++ b/pages/common/impacket-ntfs-read.md @@ -0,0 +1,7 @@ +# impacket-ntfs-read + +> This command is an alias of `ntfs-read.py`. + +- View documentation for the original command: + +`tldr ntfs-read.py` diff --git a/pages/common/ntfs-read.py.md b/pages/common/ntfs-read.py.md new file mode 100644 index 0000000000..fe4e0e1450 --- /dev/null +++ b/pages/common/ntfs-read.py.md @@ -0,0 +1,21 @@ +# ntfs-read.py + +> A read-only NTFS explorer for accessing and extracting files from NTFS volumes. +> Part of the Impacket suite. +> More information: . + +- Open an NTFS volume for exploration (e.g., `C:\.\\` or `/dev/disk1s1`): + +`ntfs-read.py {{volume}}` + +- Extract a specific file from an NTFS volume (e.g., `\windows\system32\config\sam`): + +`ntfs-read.py -extract {{\windows\system32\config\sam}} {{volume}}` + +- Enable debug output: + +`ntfs-read.py -debug {{volume}}` + +- Display help message: + +`ntfs-read.py --help`