Whirlpool File Checker finds new and changed files on NTFS drives

Every time you use your PC, files are being created, modified or deleted in the background. For the most part you won’t care, but if you’re worried about malware, or wondering what someone else is doing on your system, then it might be interesting to find out exactly what’s being changed.

Enter Whirlpool File Checker, an open source file integrity checker which can scan a set of files and highlight any which are new, or have been changed.

The program works by calculating the hashes for your files, and storing them in alternate data streams (file system records associated with the file). The down side of this technique is it only works on NTFS drives. But by way of compensation, the hashes stay with the files, even if you copy or move them to another folder or volume.

Whirlpool File Checker arrives as a very small stand-alone executable, just 42KB, so it’s no surprise that the interface looks, well, basic. But it’s easy enough to use. To get started, click "Add Files/ Folders", select a folder tree to scan (use your Documents folder, as a test), click Start, and wait as your files are scanned.

Once the process is complete, you’ll see a list of "Files without Hashes" -- files that don’t have any associated hashes. Click "Create Hashes" and Whirlpool File Checker calculates a hash for each file (it uses "a strong 512-bit hash function", apparently) and saves this in its alternate data stream.

To see how the program works, create a new file in your Documents folder (or whatever folder you scanned), and change one or two others.

Finally, relaunch Whirlpool File Checker, choose the same folder and click Start. The program then creates hashes for every scanned file, and compares them with the stored hash.

If there is no stored hash then it’s probably a new file, and is listed in the "Files without Hash" box.

And if there is a stored hash, but it doesn’t match the new calculation, then the file has changed, and it’s listed in the "Altered Files" box.

Whirlpool File Checker isn’t the most sophisticated of integrity checkers. Its interface is poor, and it’s distinctly short on features (you can’t even export the "Altered Files" list for use elsewhere).

Still, the program is also tiny, fast and free, and a quick and easy way to highlight changed files on your system. If that sounds interesting, go take a look.