Most naming conventions follow Helen Custer's book.
I'd recommend the following steps to get started with the NTFS tools:
1. edit config.h. You should make NTFS_VOLUME point to you ntfs partition.
   The other parameters are probably correct, but you should check later on.

2. make. You hopefully get ntdump, ntgrep, ntdir, ntcat and ntfs.o
   If you want to try the kernel module now, continue with 10.

3. Set up a safe working environment. USE OF THESE TOOLS IS AT YOUR OWN
   RISK. I promise that, at the moment, they read only, but you should use
   the tools as a user who has read-only permission to the hard disk, anyways.
   If you are paranoid, make a back-up of everything you don't want to lose.

4. Try
	ntdump --raw | more
   to see whether you can read from the partition at all. My volume has the
   letters 'NTFS' at offset 3, so this is probably a good indication.

5. If the tool says where the master file table is located, verify this claim.
   On my volume, it says
   MFT record at block 0x615, offset 0xC2A00
   Do
   	ntdump --raw --cluster 0x615|more
   to see whether this is really the master file table (should contain the
   Unicode string $MFT as a file name). After the MFT, you will find other
   important infrastructure files.
   If you couldn't find the MFT, you might have a different cluster size.
   Multiply the cluster number given with 1024, 2048, 4096, or 256. Then,
   try
   	ntdump --raw --offset 0xC2A00|more
   If this helps, modify config.h appropriately. I'm not sure whether this
   means a different sector size or a different cluster factor.
   If you still cannot find the MFT, try
   	ntgrep MFT
   or proceed with 6.

6. To find all MFT records, do
	ntgrep -aC FILE|more
   -a (--ascii) searched for ASCII texts rather than Unicode, and -C 
   continues search after the first match. 
   Look at the minimum distance between to adjacent records. If it not
   1024, you should modify config.h.

7. Once you found an interesting
   entry (say at offset 0x12F000), do
   	ntdump --mft -o 0x12F000
   This should give you the list of attributes. Check whether the names
   file dates, and the size of the data attribute are reported correctly.
   Then, look at the data runs. Dump these to see whether file contents
   location is reported correctly.

8. Locate the AttrDef file, even if you had problems with 7. Locate the
   data runs either with the --mft option, or by looking at the hex dump,
   if the prior method fails. Look at the attribute names and numbers
   and compare them to what dump.c uses.

9. To access NTFS from a higher level, use ntdir and ntcat. Try
		ntdir
		ntdir WINNT35
		ntcat WINNT35/WIN.INI

10.If all works well, you can try the kernel file system driver.
   Edit the 'make mount' to mount a NTFS partition. If you have an option,
   don't use the partition from which you boot NT. Change the mount point
   to a directory where you want to see your ntfs partition.
   Become root. make mount. If it complains about wrong versions, you have
   probably a -DMODVERSIONS kernel. Either recompile your kernel without
   module versioning, or try recompiling the module with -DMODVERSIONS.
   In any case, I'd recommend a kernel 1.2.0 or above.
   ls the mount points, vi WINNT35/WIN.INI, and do anything else you usually
   do with files on a file system.
   If it crashes, check /var/adm/debug. If it works, but is unreasonably slow,
   recompile w/o -DDEBUG.

11.Now you are in the position to start improving the ntfs driver. I'm waiting
   for your suggestions :)
