Hello everyone,

I have heard it said many times that it is extremely difficult to access NTFS hard disks, and indeed the Linux folks are still working on this problem. I was therefore pleasantly surprised to come across this little DOS utility called readntfs.exe available for free download at

www.ntfs.com

which can show all the files on an NTFS partition and copy them to other FAT drives on the system. It cannot write to the NTFS partition, only read, but even so this is a big step forward from not even seeing that an NTFS disk is present on the system. It would be nice to see how this is achieved, since somewhere in this 400 KB exe file must be code that can read any file from an NTFS partition into memory, which would allow DOS to execute programs or load data from such a partition - any good disassemblers or crackers out there?

The BBS here does not allow posting of exe files, so I am posting the file's web site here for any who may be interested in using or studying its code or even reverse-engineering it - I just hope that if anybody successfully isolates the code to read files into memory they will post it here. Happy hunting

Roberto

as far as i know reading NTFS is already possible (linux kernel know it i think) but writing isn't possible now... I always wondered why, is the code so obfuscated or what?

Hi Vid,

It is pretty difficult yes - I know that Linux kerel in some distributions (not all) can read NTFS, and there is a beta version that can write, but it comes with a major health warning - this could corrupt your file system! I have never seen the Linux source code that handles it, but I bet it's long and all in C, which is not really my cup of T. There is automatic zip-style compression, there are encrypted files, there are hidden files, some files have their attributs in the file itself while others have there's in special file attribute tables, with the data incuded within the attributes - anyone would think Microsift don't want us to run any other operating system but Windows I have not heard of it being done from DOS before, so I was quite surprised to stumble upon this little tool - I just wish I knew how they did it.

hello guys,
i believe there are some m$ licensing problems with the ntfs under open source os es.
this might be a reason there isn't much support.
Anyway, i recommend you ext3fs under linux.

The guys at sysinternals.com make a free NTFS for DOS utility (read-only) AND a commercial one with NTFS writing ability.
I saw the write-enabled at work once, if I remember correctly it requires you to provide a copy ntoskrnl.exe which is then executed under DOS (!!), with quite some emulation work done by the utility, I imagine. Hat off to sysinternals, some kickass coders there.

Cheers,

+L

There is a DOS utility can read or write NTFS partition.

NTFSDOS Professional Edition
NTFS File System Driver for DOS v5.0
Copyright (C) 1999-2003 Winternals Software LP
www.winternals.com

*** Warning: You must use MS-DOS version 7.0 or higher if you desire
to access files using long file names.

Illegal option: /?
Valid options:
/L:<letter>... Select drive letter(s) to use
/N:<code-page> Select NLS code page
/T=[+|-]hh[:mm[:ss]] Set timezone info
/C:<size> Set disk cache size (KB)
/S[path] Spawn a program rather than TSR
/P<directory> Specify directory containing the NT files to load

I've read that NTFS is supposed to be better managed(?) than FAT, but Microsoft still says most people should analyze their drives at least every month or so. Supposedly, the difference after defragging will only be obvious with older systems. Any clarifications on this?

Here's a NTFS spec; it's very obfuscated, I think:
http://www.linux-ntfs.org/content/view/103/42/