Linux NTFS - NTFSCP (8)


ntfscp - overwrite file on an NTFS volume.


ntfscp [options] device source_file destination


ntfscp will overwrite file on an NTFS volume. At present ntfscp can’t create new files. destination can be either file or directory. In case if destination is directory specified by name then source_file is copied into this directory, in case if destination is directory and specified by inode number then unnamed data attribute is created for this inode and source_file is copied into it (WARNING: it’s unusual to have unnamed data streams in the directories, think twice before specifying directory by inode number).


Below is a summary of all the options that ntfscp accepts. All options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don’t take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.
-a, --attribute number
  Write to this attribute.
-i, --inode
  Treat destination as inode number.
-N, --attr-name name
  Write to attribute with this name.
-n, --no-action
  Use this option to make a test run before doing the real copy operation. Volume will be opened read-only and no write will be done.
-f, --force
  This will override some sensible defaults, such as not working with a mounted volume. Use this option with caution.
-h, --help Show a list of options with a brief description of each one.
-q, --quiet
  Suppress some debug/warning/error messages.
-V, --version
  Show the version number, copyright and license ntfscp.
-v, --vebose
  Display more debug/warning/error messages.


All data on NTFS is stored in streams, which can have names. A file can have more than one data streams, but exactly one must have no name. The size of a file is the size of its unnamed data stream. Usually when you don’t specify stream name you are access to unnamed data stream. If you want access to named data stream you need to add ":stream_name" to the filename. For example: by opening "some.mp3:artist" you will open stream "artist" in "some.mp3". But windows usually prevent you from accessing to named data streams, so you need to use some program like FAR or utils from cygwin to access named data streams.


Copy new_boot.ini from /home/user as boot.ini to the root of an /dev/hda1 NTFS volume:

ntfscp /dev/hda1 /home/user/new_boot.ini boot.ini

Copy myfile to C:\some\path\myfile:stream (assume that /dev/hda1 letter in windows is C):

ntfscp -N stream /dev/hda1 myfile /some/path


No bugs are known at present. If you find any bugs, please send an email to


ntfscp was written by Yura Pakhuchiy. ntfscp and this manual page is based on ntfscat and it’s manaul page by Richard Russon, so many thanks to him. Information about named data streams was partly taken from ntfsdoc.


With love to Marina Sapego.


ntfscp is part of the ntfsprogs package and is available from