Navigation:

Documentation:

Other:

Link Collection:

~~CLOUD:30~~

Table of Contents

About ntfscluster

ntfscluster is a happy part of ntfsprogs. Its goal is to find what file is using some cluster or a range of clusters on an NTFS partition.

The -i (info) command

The -i option is the default command of ntfscluster. 

ntfscluster -i /dev/hda1
or
ntfscluster /dev/hda1

Example output: 

bytes per sector        : 512
bytes per cluster       : 4096
sectors per cluster     : 8
bytes per volume        : 18835562496
sectors per volume      : 4598526
clusters per volume     : 574815
initialized mft records : 111664
mft records in use      : 92738
mft records percentage  : 83
bytes of free space     : 6685261824
sectors of free space   : 13057152
clusters of free space  : 1632144
percentage free space   : 35
bytes of user data      : 12029034496
sectors of user data    : 23494208
clusters of user data   : 2936776
percentage user data    : 63
bytes of metadata       : 121266176
sectors of metadata     : 236848
clusters of metadata    : 29606
percentage metadata     : 0

The -c and -s commands

The -c and -s commands print what files are using a set of clusters (-c) or sectors (-s) that. 

ntfscluster -qc 10000-10002 /dev/hda1

Example output: 

Inode 1234 /foo.txt
Inode 4321 /bar.doc

The -I and -F commands

Print what clusters are occupied by a specific file, either by inode number (-I) or filename (-F). 

ntfscluster -I 0 /dev/hda1
or
ntfscluster -F \$MFT /dev/hda1

Example output: 

Dump: /$MFT
    0x10 - resident
    0x30 - resident
    0x80 - non-resident
             VCN     LCN     Length
               0       10    27916
    0xb0 - non-resident
             VCN     LCN     Length
               0        2        8
 
ntfscluster.txt · Last modified: 2009/02/09 21:32 (external edit)