Microsoft

Review: Recover files with NTFS Walker

NTFS Walker is a portable application that contains its own NTFS drivers that allow it to "walk through" the entire file structure, bypassing the need for the Windows operating system.

The ability to recover deleted files from an NTFS file system is something any good consultant should have in their back pocket. This also applies to the ability to recover files from a machine that has been rendered unbootable. There are plenty of tools available for that task, but few of them are as simple as the free tool NTFS Walker.

NTFS Walker is a portable application (it can be used from a thumb drive) that contains its own NTFS drivers that allow it to "walk through" the entire file structure, bypassing the need for the Windows operating system. Once NTFS Walker has read your system it will then allow you to view every record on the file system's Master File Table. And when you view a record you can actually get very detailed information about the file to be recovered.

Specifications

Who's it for?

NTFS Walker is an ideal tool for anyone who needs to perform file recover or data forensics. This is especially true when having a portable tool can make your job not only easier, but possible. But don't think NTFS Walker is just for forensics specialists. This tool is a viable solution for anyone that needs a quick solution for file recovery - even from deleted files.

What problem does it solve?

NTFS Walker enables the user to recover files that have either been deleted or exist on a hard drive that is not bootable but the file system is still readable. And to make this tiny application even more versatile, it is portable so it can be run from a thumb flash drive.

Key features

  • Simple to use interface
  • Included NTFS drivers
  • Save recovered files to external drive
  • Preview window allows you to view images and files with contextual data
  • View file hex data in preview pane
  • Recover deleted files
  • Extended partition support coming in future releases
  • Check modification dates of files
  • Deleted files clearly marked with red X

What's wrong?

There is a pretty nasty bug in the application that applies if you are trying to recover files from a thumb drive. If you scroll to the very bottom of the file listing on such a drive you will start getting a seemingly infinite amount of access violation warnings. Once this happens you might as well manually shut down your machine and start all over.

Competitive Products

Bottom line for business

This tiny, free application can really be a life saver in the event of a hard drive that won't boot or the deletion of critical files. And with it's simple to use interface and portability you'll be hard-pressed to find a competitive tool at the same cost. Any consultant or admin should seriously consider making NTFS Walker a regular part of their tool kit. Just don't use this tool to recover files on flash drives or you'll find yourself doing more hard shutdowns than you prefer.

User rating

Have you encountered or used NTFS Walker? If so, what do you think? Rate your experience and compare the results to what other TechRepublic members think. Give your own personal review in the TechRepublic Community Forums or let us know if you think we left anything out in our review.

Read our field-tested reviews of hardware and software in TechRepublic's Product Spotlight newsletter, delivered each Thursday. We explain who would use the product and describe what problem the product is designed to solve. Automatically sign up today!

About

Jack Wallen is an award-winning writer for TechRepublic and Linux.com. He’s an avid promoter of open source and the voice of The Android Expert. For more news about Jack Wallen, visit his website getjackd.net.

Editor's Picks