Sysinternals Freeware - Mark Russinovich & Bryce Cogswell

Utilities: File and Disk

Last Updated: July 13, 2006

AccesChk v1.02
This tool shows you the accesses the user or group you specify has to files, Registry keys or Windows services.

AccessEnum v1.3
This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.

CacheSet v1.0
CacheSet is a program that allows you to control the Cache Manager's working set size using functions provided by NT. It's compatible with all versions of NT and full source code is provided.

Contig v1.53
Wish you could quickly defragment your frequently used files? Use Contig to optimize individual files, or to create new files that are contiguous.

DiskExt v1.0
Display volume disk-mappings

Diskmon v2.01
This utility captures all hard disk activity or acts like a software disk activity light in your system tray.

DiskView v2.21
Graphical disk sector utility

Du v1.3
View disk usage by directory

EFSDump v1.02
View information for encrypted files

FAT32 for Windows NT 4.0 v1.06
Another first from Sysinternals: a FAT32 file system driver for NT 4.0. Dual booting with Windows 95OSR2 and Windows98 just got more efficient!

Filemon v7.03
This monitoring tool lets you see all file system activity in real-time.

Fundelete v2.02
This utility expands the NT 4.0 Recycle Bin to catch file deleted from command prompts and within programs, and it comes with full source code. Several powerful device driver techniques, including getting a user's SID within a driver, enumerating a directory's contents, and generating IRPs, are demonstrated in source code available for download.

Junction 1.03
Create Win2K NTFS symbolic links

LDMDump v1.02
Dump the contents of the Logical Disk Manager's on-disk database, which describes the partitioning of Windows 2000 Dynamic disks.

MoveFile v1.0
Schedule file rename and delete commands for the next reboot. This can be useful for cleaning stubborn or in-use malware files.

NTFSCHK v1.0
If you dual boot between NT 4 and Windows 2000 then your NTFS drives were upgraded to NTFS v5 and you have had to boot into Windows 2000 to check them. With NTFSCHK you can check your NTFS v5 drives from NT 4.

NTFSDOS v3.02
Access NTFS drives for read-only access from DOS.

NTFSDOS Professional v4.01
Full read/write access to NTFS drives from DOS! Download this free read-only version.

NTFS for Windows 98 v2.0 Read-Only
Yet another first from Sysinternals: a full-blown NTFS file system driver for Windows 95/98!

NTFSInfo v1.0
Use NTFSInfo to see detailed information about NTFS volumes, including the size and location of the Master File Table (MFT) and MFT-zone, as well as the sizes of the NTFS meta-data files.

NTFSFlp v1.0
Ever wondered why you can't put NTFS on a floppy disk? Find out how and why NT stops you from doing it, and use NTFSFlp to bypass NT's preventative measures and create and access NTFS floppy disks.

NTRecover v1.0r
Finally, the utility that NT system administrators have been waiting for. With NTRecover you can access a dead x86 NT system's disks from a good system over a serial connection. You can then salvage data off of the drives using native NT commands and utilities. With the write-version you can even run chkdsk on the dead system's drives! The read-only version is freeware.

PageDefrag v2.32
Defragment your paging files and Registry hives!

PendMoves v1.02
See what files are scheduled for delete or rename the next time the system boots.

PsFile v1.01
See what files are opened remotely

PsTools v2.34
The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.

Remote Recover v2.0
Access unbootable systems from across a LAN or WAN. With Remote Recover you can access a dead x86 NT system's disks from a good system over a TCP/IP connection. You can then salvage data off of the drives using native NT commands and utilities. With the write-version you can even chkdsk, format or partition the dead system's drives! The read-only version is freeware.

SDelete v1.4
Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program. Complete source code is included.

ShareEnum v1.6
Scan file shares on your network and view their security settings to close security holes.

Sigcheck v1.3
Dump file version information and verify that images on your system are digitally signed.

Streams v1.53
Reveal NTFS alternate streams

Sync v2.2
Flush cached data to disk

VolumeId v2.0
Set Volume ID of FAT or NTFS drives