Note: This documentation is actual for the latest version of the utility only. Before the final release, command line options syntax is subject to change and syntax compatibility is not guaranteed between versions 0.x.
Filename Namespace Selection Options
-case -d -deferred -falloc -fDIRS -fFILES -fsize -fsystem -funused -fUSED -JP -nall -ndos -nocache -nposix -nwin32 -outCON -outfile -range -regex -salloc -sd -si -silent -snamespace -ssize -sP
Do not output search result immediately. When this option is supplied, NDFF remembers the files that match search criteria and lists them only after the search is complete.
This option may increase the NDFF performance on small and moderate result sets. This is achieved because NDFF restores file path only when it is going to list it to output. When this option is on, NDFF first sequentially scans all the MFT collection the result, and then restores paths to files, which cause file reads at random places in the MFT. By separating sequential and random seek operations, overall seek distance (and, therefore, time) may be decreased.
On the other hand, when search result is large enough, the memory required to store it may grow so big that the OS may start swapping it out of physical memory. This cancels all the advantages that can be achieved by using this option.
Defines range of the MFT records of interest.
This option is the only way to limit search range. Unfortunately, MFT IDs of files have a little sense in real world where name of the file is the only its identifier.
Although Microsoft does not guarantee the persistence of files' MFT IDs, its ID can hardly change during the file's lifetime. Renaming, rewriting and moving within same partition usually leave MFT ID the same. On the other hand, volume defragementation may change them. Files that have the same MFT ID always have the same contents; they are either different names or paths of the file, or hard links to the same file.
Use -1 (minus one, not the '1' option) as synonym of the largest existing MFT ID.
ndff * -range 25000 26000
ndff * -r 16 -1
ndff * -r 16
Forces case sensitive rules.
By default, NTFS is case insensitive, though it may be treated as case sensitive file system. When this option is on, case sensitive rules are applied to search mask or regex and to reparse point resolving.
Specifies what drive to search.
ndff *.xls -d c:
Note: If drive letter was subst'ed, the partition to which the substituted drive letter is resolved would be searched.
Filename search criteria is specified using regex syntax rather than usual file mask. Regular expression syntax is defined at Boost.Regex Documentation.
Directory caching increases filename paths restoration speed. It uses some amount of memory for that, though. This option disables directory cache and saves memory.
Do not resolve junction points. Specifying this option would speed up result listing.
NDFF supports junction points that graft into the same volume's folders. Find more information about junction points at Microsoft Knowledge Base articles KB262797 and KB205524.
NTFS is Unicode based file system. Names of all files, directories, attributes, etc. are stored in Unicode. Unfortunately, Windows console does not support unicode. This makes NDFF convert all textual information into an ANSI character set. That's why you can sometimes see the '?' symbol instead of a character that cannot be displayed in console.
The usual way to store the utility output to a file is to use standard redirection (piping) operator:
ndff *.xls >>xlsfiles.lst
Although this is the way a file with results can be created, that would be an ANSI text file, and some (ore many) unconvertible characters would be lost.
This option commands NDFF to store result in Unicode file without applying any character conversion procedure to the text.
ndff *.xls -outfile xlsfiles.lst
The -outfile option does not prevent console output. To completely redirect result to a file, use -outCON in junction with it:
ndff *.xls -outfile xlsfiles.lst -outCON
When this option is used, no Unicode/ANSI conversion is applied to the resulting output, thus improving performance on large result sets.
Show MFT IDs. See -range option description for more information on MFT IDs.
Show real file size in bytes.
Show allocated file size in bytes. This is amount of storage capacity used to store corresponding file.
Show namespace of file name displayed. Names of directories in file path may be of different namespaces. See Filename namespace selection options for more information on namespaces.
Show drive letter. By default, this option is disabled because all resulting files are always located on single volume.
Do not show file path. Specifying this option greatly increases performance on large result sets because NDFF does not have to trace all the paths of the files listed.
Do not write summary information before and after found files listing.
In NTFS, files can have several filename attributes, that is, several names. Each name can be used to access the same file. This is the way NTFS supports several character sets that can be used in filenames. These character sets are called namespaces.
Currently, NTFS supports the following namespaces. DOS namespace character set is restricted to MS-DOS file naming rules, so-called 8.3 format. 8.3 format means that files can have between 1 and 8 characters in the file name, then a period, and then 0 to 3 characters as extension. The name must start with a letter or a number and can contain any ASCII characters except the following: '.' '"' '/' '\' '[' ']' ':' ';' '|' '=' ',' '*' '?' ' '
Names in Win32 namespace can contain any number of Unicode characters except '"' '*' '/' ':' '<' '>' '?' '\' '|', and cannot end with '.' or ' '. Names in POSIX namespace can contain up to 255 Unicode characters except for '/'.
Match search pattern against all file names encountered. This may cause multiple names of the same file to appear, e. g. 'some file 1.txt' in Win32 namespace and 'SOMEFI~1.TXT' in DOS namespace.
Match Win32 namespace names.
Match DOS namespace names.
Match POSIX namespace names.
Do not list directories in search result, only files.
Do not list files in search result, only directories.
List only files with real size in the defined range.
ndff *.xls -fs 4096 16384
List only files with allocated size in the defined range.
Unused MFT records are skipped by default. Specifying this option includes them in the result.
Do not list existing files, list only unused file records. Implicitly applies -funused. This option can be useful when searching for deleted files.
By default, NDFF does not show special NTFS files (such as $Quota, $Volume, etc) and files located in special NTFS directories (such as "System Volume Information", $Extend, etc.). Specifying this option enables listing of those files.
| [Main Page] | [Release History & Downloads] | [FAQ] | [Documentation] | [Links] |
Copyright © 2004, 2005 Alexey Birioukov. All rights reserved.