NTFSWalker is a free tool for the Windows operating system that can be used to explore and recover data on NTFS partitions. The program can display data of connected partitions, or do the same for drive images if available.
It displays a list of available partitions and drives on startup, and offers to load disk images in the Advanced Tab. Once a drive has been selected it displays the available partitions, and then detailed information about the partition and data contained.
The MFT (master file table) records are displayed on the left sidebar. Here it is possible to select a record to display information about it on the right content side. The content side is divided into the tabs file information, preview and hex data.
File information list all available information about the select file, from creation and modification dates to file attributes, allocated size on the partition, flags and the name namespace.
Preview displays a preview of the selected file if available. This is largely only possible if it is an image or contains textual data. Hex data finally displays the file in hex code.
Existing files are displayed with a file icon in front of their row, while files that have been deleted with a red X. Those files may still be recoverable, especially if the size information is greater than 0 and a name is still displayed for the file.
A right-click on those files, and the selection of Save selected files in the context menu, restores the file on a selected storage device that is currently connected to the computer system.
The major advantage of NTFSWalker over comparable solutions is that it uses its own NTFS driver, which means it runs independent from the operating system in this regard.
NTFSWalker is a free software that is compatible with 32-bit and 64-bit editions of the Windows operating system. The portable application is available for download at the developer's website.
Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.
We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats (video ads) or subscription fees.
If you like our content, and would like to help, please consider making a contribution:
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.