
FindNTFS, version 2.05 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 2006.

Lists the content of an NTFS partition, or copies files.

FindNTFS <disk number> <cylinder> <head> <sector> 
         [ <log file>  files | dirs | summary ]
         [ copy  [ <dir number> ... [ max <max file size> ] ] ]

[ noboot [ <search offset MB> ]  |  backupboot [ <partition sectors> ] ]
[ mirror | nomftrecord ]  [ kb <cluster KB>]
[ showsys ] [ showdel ] [ root ] [ alt ]  [ *<copy extension> ]

Disks are numbered from 1. The partition cylinder, head, sector address
most often can be found using the Findpart program. Use the 'Start CHS'
address. LOG file extension must be .txt. If 'copy' is selected, files
are copied to current directory, and to subdirectories to current
directory. To stop after current directory, press Esc. If directory
numbers are entered, only these directories and subdirectories to them
are copied. Up to 10 directory numbers can be entered. The numbers are
in the search output in front of the directory name. If as example *.doc
is used, only *.doc files are copied. Five extensions can be entered.

Keep the original partition until the integrity of copied files
is verified. If partitions are overlapping, file copying can damage
data. If you are in doubt, then do only copy to another physical disk,
which is known to be OK. Also it should be known that the target
partition cannot contain old deleted copies of lost files.

If 'backupboot' is used without partition sectors, a search is done for
the backup boot sector. The 'noboot' option ignores boot sectors.
If the 'mirror' option is used with the 'noboot' option, the search
offset should be somewhat below the expected half partition size.

The 'mirror' option uses the MFT mirror record if available. The
'nomftrecord' option ignores the MFT and mirror file record. Can be used
for a partition that was accidently formatted. The 'kb' option is usually
not needed. The 'showsys' and 'showdel' options shows system and deleted files.

The 'root' option skips search, and uses the root directory. The 'alt' option
makes alternative choices during search.

The screen is printed using the console codepage. Log files are written using
the Windows codepage.

For alternative NTFS search, type 'FindNTFS findfile'.
