ntfsdebug − Efficiently dump the metadata contents of an NTFS volume.
ntfsdebug device|image
ntfsdebug will efficiently extract all relevant metadata from an NTFS volume and dump it to standard output. It works at disk sector level and copies only the used data. Unused disk space becomes zero. ntfsdebug can be useful to exact the metadata snapshot of an NTFS file system for developers to investigate and troubleshoot users’ issues using the clone without the risk of destroying the original file system.
The exit code is 0 on success, non−zero otherwise.
Dump NTFS metadata on /dev/sda1 to a compressed metadata image:
ntfsdebug /dev/sda1 | bzip2 > sda1.img.bz2
Dump NTFS metadata on /dev/sda1 to a compressed metadata image in a system with less memory e.g. for 20 MB memory use:
ntfsdebug /dev/sda1 --mem 20 | bzip2 > sda1.img.bz2
Dump NTFS metadata on /dev/sda1 to a compressed metadata image but also collect a full NTFS Journal ($LogFile), use:
ntfsdebug /dev/sda1 --logfile | bzip2 > sda1.img.bz2
Dump NTFS metadata to a remote host, using ssh. Please note that ssh may ask for a password.
ntfsdebug /dev/sda1 | bzip2 | ssh host ’cat > sda1.img.bzip2’
If you find a problem then please send an email describing it to ntfs-support@tuxera.com.
ntfsdebug is part of the Tuxera NTFS package.