The ability to recover deleted files from an NTFS file system is something any good consultant should have in their back pocket. This also applies to the ability to recover files from a machine that has been rendered unbootable. There are plenty of tools available for that task, but few of them are as simple as the free tool NTFS Walker.

NTFS Walker is a portable application (it can be used from a thumb drive) that contains its own NTFS drivers that allow it to “walk through” the entire file structure, bypassing the need for the Windows operating system. Once NTFS Walker has read your system it will then allow you to view every record on the file system’s Master File Table. And when you view a record you can actually get very detailed information about the file to be recovered.

Specifications

• Supported operating systems: Windows XP, Vista and Windows 7
• File size: Very small footprint
• Cost: Free
• Additional information and download

Who’s it for?

NTFS Walker is an ideal tool for anyone who needs to perform file recover or data forensics. This is especially true when having a portable tool can make your job not only easier, but possible. But don’t think NTFS Walker is just for forensics specialists. This tool is a viable solution for anyone that needs a quick solution for file recovery – even from deleted files.

What problem does it solve?

NTFS Walker enables the user to recover files that have either been deleted or exist on a hard drive that is not bootable but the file system is still readable. And to make this tiny application even more versatile, it is portable so it can be run from a thumb flash drive.

Key features

• Simple to use interface
• Included NTFS drivers
• Save recovered files to external drive
• Preview window allows you to view images and files with contextual data
• View file hex data in preview pane
• Recover deleted files
• Extended partition support coming in future releases
• Check modification dates of files
• Deleted files clearly marked with red X

Note:

There is a pretty nasty bug in the application that applies if you are trying to recover files from a thumb drive. If you scroll to the very bottom of the file listing on such a drive you will start getting a seemingly infinite amount of access violation warnings. Once this happens you might as well manually shut down your machine and start all over.

This tiny, free application can really be a life saver in the event of a hard drive that won’t boot or the deletion of critical files. And with it’s simple to use interface and portability you’ll be hard-pressed to find a competitive tool at the same cost. Any consultant or admin should seriously consider making NTFS Walker a regular part of their tool kit. Just don’t use this tool to recover files on flash drives or you’ll find yourself doing more hard shutdowns than you prefer.