# ntfs-read.py

> A read-only NTFS explorer for accessing and extracting files from NTFS volumes.
> Part of the Impacket suite.
> More information: <https://github.com/fortra/impacket>.

- Open an NTFS volume for exploration (e.g., `C:\.\\` or `/dev/disk1s1`):

`ntfs-read.py {{volume}}`

- Extract a specific file from an NTFS volume (e.g., `\windows\system32\config\sam`):

`ntfs-read.py -extract {{\windows\system32\config\sam}} {{volume}}`

- Enable debug output:

`ntfs-read.py -debug {{volume}}`

- Display help:

`ntfs-read.py --help`