NTFSWalker
NTFSWalker is a simple, straightforward, and most importantly free utility for analyzing and "walking through" NTFS partitions on any media readable by your computer, including hard disks, memory cards, USB flash drives, and floppy disks. NTFSWalker takes you through the low-level structure of the file system, and lets you view deleted files, regular files, as well as detailed attributes for each file.
How does it work?
NTFSWalker has its own drivers for reading NTFS partitions. It bypasses the Windows file system drivers and reads your disk hardware directly! It allows you to view every record in your file system's MFT in excruciating detail. And I mean excruciating. But that's why you're here, isn't it, you masochist?
This program may be useful to students of computer science (or professors) who are learning about (or teaching) file systems. It is also useful for browsing deleted files, and being able to restore them, from any NTFS volume.
NTFSWalker is a cousin of the better-known program DiskDigger. If recovering lost files is what you're after, DiskDigger is the solution.
Have you found it useful?
...or at least interesting? Then e-mail me a comment or a suggestion. Or, better yet, consider making a donation so I can continue to develop free, quality software, and keep it that way!
Revision history
2009-Apr-22
- Improved detection of disk drives.
- Added ability to select logical drives, as well as disk images.
2009-Apr-21
- Initial release to the Web.
April 22nd, 2009 at 8:37 am
Dmitry,
I wonder if it would be possible to include acquired image files mounted a read-only drive letters in your NTFSWalker and DiskDigger tools.
I work forensics, and having something like this that will allow me to do these things on an image mounted as a read-only volume (ie, G:$$ would be fantastic!
Thanks,
Harlan
April 22nd, 2009 at 10:20 am
That's precisely what I'm working on for the next release of the tools. You'll have the ability to work with any drive letter or image file.
April 23rd, 2009 at 4:10 pm
Hi Dmitry,
I have a drive with 3 partitions. NTFSWalker read the primary system partition just fine. However, the other two are both logical drives within an extended partition and they do not show up in the scan list. Just thought I'd let you know... Don't know if it's bug, or some kind of limitation due to the nature of these partitions.
Also, this might be a crazy feature request--can you make it so selected mft entries can be deleted? Or "blanked out" I suppose...
Nice program though, thanks!
April 23rd, 2009 at 4:19 pm
Yes, support for extended partitions is something I'm working on. As for overwriting MFT records, I think I'd rather keep the utility "read-only" for the time being. I like to give my tools as little liability potential as possible; I'm sure you understand.
Maybe in a future release, when the app is more mature.
April 30th, 2009 at 7:37 am
Very nice App!
Should NTFSWalker work with w2k? Right from the start i get two error boxes Warning: error while getting information about the drive "\\.\PhysicalDrive1":The network request is not supported. and Warning: error while getting information about the drive "\\.\E:":The network request is not supported.
E: is flash drive.
Then NTFSWalker starts nicely, i can use it, but when at the MFT Records tab i scroll to the end, i start to get access violation message boxes, infinitely.
May 2nd, 2009 at 1:18 pm
ITS TOTALLY GREAT ......THAT'S WHAT I NEED ..... THANK YOU VERY MUCH.
August 7th, 2009 at 5:06 pm
Hi, Dmitry,
I would agree with Nicky's comments, this is exactly what I needed. Have you thought about the ability to sort columns for easier search and management of the output?
December 3rd, 2009 at 5:11 am
sir,
your software simply superb, iam delighted, thanks
December 26th, 2009 at 5:01 am
Hello there, good evening.
I would to say thanks for your hard work.
Those of your applications is very usefull & simple to use.
But the most important thing is clean from virus & free application.
I really enjoy use them.
Thank you.
February 7th, 2010 at 8:44 am
[...] http://dmitrybrant.com/ntfswalker Escrito por: bombates última edición: 07 Feb 2010 @ 13:44 Email • Permalink Tags: herramientas, recuperar archivos eliminados Categorías: Útiles Previous Responses to this post » (None) Post a Comment Clic para cancelar respuesta. [...]
March 1st, 2010 at 3:07 pm
[...] Download [Translate] [...]
March 6th, 2010 at 3:06 am
[...] Just select any drive and then explore further as you see on the screen. You can download NTFS Walker from here. [...]
March 6th, 2010 at 3:05 pm
[...] Mit dem NTFSWalker könnt ihr euch die MFT-Tabellen eurer mit NTFS formatierten Festplatte anschauen. Ihr wisst [...]
June 10th, 2010 at 1:31 pm
Stumbled across your software. Looks promising. Can you include the option to sort by the different column headers? Or the ability to export the listing into a csv file? Thanks.
September 21st, 2010 at 8:45 am
[...] uses its own NTFS driver, which means it runs independent from the operating system in this regard.NTFSWalker is a free software that is compatible with 32-bit and 64-bit editions of the Windows operating [...]
September 21st, 2010 at 3:56 pm
[...] NTFSWalker është një software i lirë që është në përputhje me 32-bit dhe 64-bit botimet e sistemit operativ Windows. Kërkesa portativ është në dispozicion për shkarkim në faqen e internetit të zhvilluesit. [...]
September 21st, 2010 at 4:05 pm
[...] Descarga NTFSWalker Tweet Compartir [...]
September 21st, 2010 at 9:19 pm
[...] NTFSWalker is a free software that is compatible with 32-bit and 64-bit editions of the Windows operating system. The portable application is available for download at the developer’s website. [...]
September 22nd, 2010 at 1:58 am
[...] è compatibile con sistemi operativi Windows a 32 e 64bit! Download NTFSWalker Articoli similiWindows: 7 fantastici software gratuiti per recuperare i file [...]
September 22nd, 2010 at 8:08 am
[...] DmitryBrant.com NTFSWalker <img style="position: absolute; left: 0px; top: 0px; right: 0px; bottom: 0px; margin: auto;"> __________________ Written very small on the back pocket of a girl's jeans -"If you can read this, you're WAY too close <img style="position: absolute; left: 0px; top: 0px; right: 0px; bottom: 0px; margin: auto;"> [...]
September 22nd, 2010 at 11:20 am
No puedo opinar sobre un programa, que aún no me lo he bajado y probado.
Jordi Viader
Saludos.
Jordi Viader
September 27th, 2010 at 7:57 am
[...] in tools NTFSWalker Was scouting around the Internet and found this tool called NTFSWalker from [...]
October 23rd, 2010 at 1:53 pm
[...] Descargar NTFSWalker [...]
November 14th, 2010 at 1:09 am
[...] NTFSWalker is a free software that is compatible with 32-bit and 64-bit editions of the Windows operating system. The portable application is available for download at the developer’s website. Ads [...]
November 24th, 2010 at 3:40 pm
[...] There is a tool called NTFSWalker which can browse the MFT records of the NTFS, but is unable to make any changes to them. Question [...]
January 13th, 2011 at 7:52 am
Hi,
Nice program. I did a short test and it does the job. I came across the program via the following review: http://blogs.techrepublic.com.com/products/?p=1564&tag=nl.e026
They do mention a problem with flash drives, but I assume this will someday be fixed.
Also, it would really be nice if one could sort on columns once everything is listed.
That would make it much easier to find a deleted file instead of having to scroll through the whole list.
January 14th, 2011 at 11:55 am
FYI
While trying to open the zip file using WinZip 8,
I get the message
"Cannot open file: It does not appear to be a valid archive.
If you downloaded this file, try downloading the file again."
I have tried multiple downloads (6 at the latest count) with the same results.
Regards
Aumor
January 14th, 2011 at 2:01 pm
[...] The ability to recover deleted files from an NTFS file system is something any good consultant should have in their back pocket. This also applies to the ability to recover files from a machine that has been rendered unbootable. There are plenty of tools available for that task, but few of them are as simple as the free tool NTFS Walker. [...]
January 18th, 2011 at 4:04 pm
This is very good, thank you!
November 25th, 2011 at 1:23 am
hey,dude,could you show me the source code?
I need it very much,my boss ask me to write some feature about NTFS File system...
April 18th, 2012 at 7:06 pm
[...] Image Analysis TSK Tools - I’ve used mmls and fls mostly, but blkls is extremely useful, as well ProDiscover, Basic Edition - Not a full suite, but very useful AntiVirus Scanners (ClamWinPortable, SysClean, Malwarebytes) Timeline Creation Tools (TSK tools, pasco, Perl scripts, etc.) – Perl scripts available from the Win4n6 Yahoo Group Internet Evidence Finder (JADSoftware) – also, check out theEncrypted Disk Detector Carving – foremost, scalpel, PhotoRec DiskDigger - from Dmitry Brant; also check out NTFSWalker [...]