Free ntfs software for linux

Linux NTFS provides Linux kernel drivers, a multiplatform NTFS library, and tools to create, resize, clone, rescue, query, label and fix NTFS volumes, and to undelete, resize, list, and query files for the filesystem used by Windows XP, 2003, 2000, NT4, and Longhorn.
Linux NTFS also provides support for the Logical Disk Manager (LDM) that controls Windows Dynamic Disks and is used to create software mirrors, stripes, and RAID.
Enhancements:
- Many improvements and fixes were made for all known problems to ntfsmount, ntfscluster, mkntfs, ntfsclone, ntfsinfo, and libntfs.

Data recovery program for NTFS file systems. Reads each block of the hard disk to and retrieves rebuilds file system tree on another partition.
I wrote this program when one of my friends lost valuable data on an NTFS drive. It been used since then in several cases, but not thoroughly tested, especially not WRT the fact that its a data recovery program.
You should have your partition information stored away in advance. This allows reliable retrieval of file info.
Enhancements:
- Dont exit on error reading source drive
- Fixed core dump when attribute list, but no MFT loaded

TSKmount-Fuse is the filesystem of deleted files.

TSKmount, is a free Fuse filesystem written in perl and based on The Sleuth Kit tools. It is intended to provide an easy way to recover deleted files over ext2, fat and ntfs filesystems.

Short HowTo:

Mounting device /dev/hda5 on /tmp/fuse empty directory:

tskmount /dev/hda5 /tmp/fuse
### wait the "Ready" message before going to /tmp/fuse ###


Unmounting filesystem:

fusermount -u /tmp/fuse

See common options:

tskmount --help

FTimes is a system baselining and evidence collection tool. FTimess primary purpose is to gather and/or develop information about specified directories and files in a manner conducive to intrusion analysis.
FTimes is a lightweight tool in the sense that it doesnt need to be "installed" on a given system to work on that system, it is small enough to fit on a single floppy, and it provides only a command line interface.
Preserving records of all activity that occurs during a snapshot is important for intrusion analysis and evidence admissibility. For this reason, FTimes was designed to log four types of information: configuration settings, progress indicators, metrics, and errors. Output produced by FTimes is delimited text, and therefore, is easily assimilated by a wide variety of existing tools.
FTimes basically implements two general capabilities: file topography and string search. File topography is the process of mapping key attributes of directories and files on a given file system. String search is the process of digging through directories and files on a given file system while looking for a specific sequence of bytes. Respectively, these capabilities are referred to as map mode and dig mode.
FTimes supports two operating environments: workbench and client-server. In the workbench environment, the operator uses FTimes to do things such as examine evidence (e.g., a disk image or files from a compromised system), analyze snapshots for change, search for files that have specific attributes, verify file integrity, and so on. In the client-server environment, the focus shifts from what the operator can do locally to how the operator can efficiently monitor, manage, and aggregate snapshot data for many hosts. In the client-server environment, the primary goal is to move collected data from the host to a centralized system, known as an Integrity Server, in a secure and authenticated fashion. An Integrity Server is a hardened system that has been configured to handle FTimes GET, PING, and PUT HTTP/S requests.
The FTimes distribution contains a script called nph-ftimes.cgi that may be used in conjunction with a Web server to implement a public Integrity Server interface. Deeper topics such as the construction and internal mechanics of an Integrity Server are not addressed here.
Main features:
- FTimes is easy to use and fast! The rest is pure gravy...
- FTimes has been written in C and ported to many popular OSes such as AIX, BSDi, FreeBSD, HP-UX, Linux, Solaris, and Windows 98/ME/NT/2K/XP. FTimes does not require additional runtime support such as a script interpreter (e.g., Perl) or a Virtual Machine (e.g., JVM).
- FTimes does not need to be installed on the clients machine. In many cases it can be run from a floppy or CDROM. Because of this, FTimes can be configured such that it is minimally invasive to the target system. This is important when trying to collect evidence of an attack on a live system.
- FTimes has thorough logging. This helps to increase its credibility and admissibility as evidence because the log information can be used to determine the known or potential error rate of the tool under various conditions. FTimes logs four types of information: configuration settings, progress indicators, metrics, and errors.
- FTimes detects and encodes non-printable characters (e.g., white space, carriage returns, etc.) in filenames. This ensures that your view of the output is not artificially altered by the data you are looking at. The URL encoding scheme used also helps you to quickly focus in on anomalous filenames.
- FTimes detects and processes Alternate Data Streams (ADS) when running on Windows NT/2K/XP systems. This is quite useful in cases where the perpetrator has used Alternate Data Streams to hide tools and information.
- FTimes output is delimited ASCII, and therefore, is conducive to analysis. This output can be assimilated using standard database technology as well as a wide array of existing tools. This makes it more flexible than proprietary database schemes that are essentially opaque to the practitioner. Ultimately, this format yields better analysis results because the practitioner is able to manipulate data freely, and peers may independently verify analysis results. Again, this helps to strengthen its credibility and admissibility as evidence.
- FTimes can be deployed as an enterprise solution with all information being transmitted to and preserved on a hardened Integrity Server. This allows for centralized management of data, and avoids the problem of leaving data exposed on a clients system. Data stored on a clients system is vulnerable to malicious modification or destruction.
- FTimes natively supports client initiated HTTP/HTTPS uploads/downloads. This eliminates the need for boundary devices such as firewalls to have a special inbound connection rules. Furthermore, theres a good chance that existing boundary devices already support the required outbound communications path because it is the same as that needed to browse the Web.
- FTimes provides an efficient string search capability (a.k.a. dig mode). This is particularly useful in investigations when the practitioner has a profile of key words or byte strings that are likely to exist somewhere on the target system.
- FTimes optionally supports device file digging (block/character).
- FTimes output is configurable on a per attribute basis. This allows users to develop data in a way thats best suited to their needs.
- FTimes optionally produces directory hashes. This is a significant analysis advantage in situations where content rarely changes. The advantage is that one hash effectively represents the content of all directories and files contained in a given tree.
- FTimes optionally produces symlink hashes.
- FTimes optionally performs file typing via XMagic. When there are hundreds or thousands of unknown hashes, it is difficult to determine which files may have changed as a result of a malicious act. In these situations, type information can be used to categorize files and prioritize the order in which they are examined.
- FTimes has an extremely fast, tunable compare capability. This enables the practitioner to quickly analyze snapshots and determine change.
Enhancements:
Version 3.8.0 is a minor release of FTimes. Generally, code was cleaned up and refined as necessary. Several bugs have been fixed -- see the ChangeLog for details. This release includes support for SHA256 hashes, include/exclude filters, and a number of additional file systems (DATAPLOW_ZFS, NTFS-3G, NWCOMPAT, UDF). HashDig utilities have been updated to support SHA1 and SHA256 hashes, and the
following tools have been been added to the project:
ftimes-crv2dbi.pl, ftimes-dig2dbi.pl, hashdig-find.pl, and tarmap. Note that documentation is no longer built at release time, and that means your build system must include the necessary tools to create the documentation -- see the Requirements Section in README.INSTALL for additional details. Since SF officially discontinued compile farm support on 2007-02-08, this project is no longer able to build/test releases in the manner and scale that it did before. Unfortunately, this may result in platform-specific issues that go unnoticed until they are discovered by someone in the field.

Mint is a small X toolbar that can switch network configurations in a few keystrokes. Mint enables you to change your network configurations in a few keystrokes. It supports DHCP and static addresses, and can execute an authentication script when it changes the configuration. It also displays a clock and a battery meter.
mint displays the name of current network configuration. It also displays a clock and a battery meter. The battery meter shows the percentage of remaining battery life and appends a `+ to the battery life when AC power is connected.
Since it changes network configuration, mint must be run setuid root. It safely invokes the authentication script as the user who started mint, not root.
mint provides a network configuration called "off" to shutdown the network interface. mint displays "?" if it does not recognize the current network configuration. It displays "xx" if the network interface does not exist.
The authentication script is run in the background. When you switch network configuration, mint kills any previously running authentication script. For DHCP configurations, mint does does not run the authentication script if the DHCP request fails.
DHCP support is made by the "dhcpcd" command, which mint expects to find in /sbin. dhcpcd should have come with your Linux distribution; if not you can get it from http://www.phystech.com/download/dhcpcd.html.
Enhancements:
- The beta version of Bianca was released and is available for download. Bianca comes with two brand new themes: Bianca-Blue and Bianca-Green which give the distribution a whole new minty look. Only one panel at the bottom, a Slab-like menu, new default icons. The following applications were added to Bianca: mintMenu, a replacement for the GNOME menu; mintConfig, a Control Center application; mintDisk, a program which automatically mounts FAT32 and NTFS partitions; mintDesktop, which now comes as a package, has a graphical configuration front-end; mintWifi, which now comes as a package.

KANOTIX is a Linux live CD based on Knoppix technology using Debian/sid.

The included XFree86 is from Debian/experimental. The main specs are: GRUB based startup from CD, ACPI support, DMA default on, additional support for DSL modems (Fritz!Card DSL and Eagle USB), optimal for HD install (you get a working Debian/sid install in about 10 minutes!), kernel forcedeth (for nForce NIC), device mapper and some other patches.

Simply boot from CD and enjoy Linux. Some tools may request a root password. As none is set, you have to set one using "sudo passwd" or use "su" in konsole.

Whenever you execute something with root permissions, you should know what you are doing! For web surfing over LAN no root access is required. I am sure you can discover many things to do with it :)

Dont try to write to NTFS partitions using the standard NTFS driver included with the kernel, as its support for writing is very lacking - thus it could destroy the partition and the data in it.

There is a new Captive NTFS driver that does a better job at writing to NTFS, so use it instead. For FAT partitions you can enable write-access with the context menu (right mouse button).

You may not have the rights to modify Linux partitions, use the root mode in konsole if needed. Some links are not working in the menu - that is not my fault - the packages from Debian/sid are very new and may have some little bugs, but you can always use new releases.