ntfsdebug − Efficiently dump the metadata contents of an NTFS volume.
ntfsdebug device|image
ntfsdebug will efficiently extract all relevant metadata from an NTFS volume and dump it to standard output. It works at disk sector level and copies only the used data. Unused disk space becomes zero. ntfsdebug can be useful to exact the metadata snapshot of an NTFS file system for developers to investigate and troubleshoot users’ issues using the clone without the risk of destroying the original file system.
The exit code is 0 on success, non−zero otherwise.
Dump NTFS metadata on /dev/sda1 to a compressed metadata image:
ntfsdebug /dev/sda1 | bzip2 > sda1.img.bz2
Dump NTFS metadata to a remote host, using ssh. Please note that ssh may ask for a password.
ntfsdebug /dev/sda1 | bzip2 | ssh host ’cat > sda1.img.bzip2’
If you find a problem then please send an email describing it to ntfs-support@tuxera.com.
ntfsdebug is part of the Tuxera NTFS package.