show_sys_files
In order to see the NTFS metafiles also, the -o option must contain the show_sys_files flag:
$ cd ..
$ sudo umount /mnt/c
$ sudo mount -t ntfs-3g -o show_sys_files /dev/nvme0n1p3 /mnt/c
$ ls /mnt/c/\$*
'$AttrDef'
'$BadClus'
'$Bitmap'
'$Boot'
'$Extend'
'$LogFile'
'$MFTMirr'
'$Recycle.Bin'
'$Secure'
'$UpCase'
'$Volume'
'$Windows.~WS'
streams_interface
streams_interface controls if and how alternate data streams (ADS) can be accessed.
The value can be set to none (which is the default and does not allow accessing data streams), windows or xattr
With windows, a stream is accessed like in Windows, i. e. with a colon (filename:streamname)
With xattr, the named streams are mapped to xattrs and the streams can be accessed with getfattr and setfattr.
$ cd ..
$ sudo umount /mnt/c
$ sudo mount -t ntfs-3g -o show_sys_files,streams_interface=windows /dev/nvme0n1p3 /mnt/c
$ attr -g ntfs.streams.list /mnt/c/\$LogFile
attr_get: Operation not supported
Could not get "ntfs.streams.list" for /mnt/c/$LogFile
… hmm, maybe trying streams_interface=xattrs:
$ sudo umount /mnt/c
$ sudo mount -t ntfs-3g -o show_sys_files,streams_interface=xattr /dev/nvme0n1p3 /mnt/c
$ getfattr /mnt/c/\$Extend/\$UsnJrnl
getfattr: Removing leading '/' from absolute path names
# file: mnt/c/$Extend/$UsnJrnl
user.$J
user.$J
user.$Max