Whirlpool File Checker is a tiny portable tool which can identify new or modified files on your PC, perhaps useful if you'd like to know exactly what's been happening on your system recently.

The program works by calculating the hashes (digital fingerprints) for your files, and storing them in Alternate Data Streams. The down side of this technique is it only works on NTFS drives. But by way of compensation, the hashes stay with the files, even if you copy or move them to another folder or volume.

Whirlpool File Checker arrives as a very small stand-alone executable, just 42KB, so it's no surprise that the interface looks, well, basic. But it's easy enough to use. To get started, click "Add Files/ Folders", select a folder tree to scan (use your Documents folder, as a test), click Start, and wait as your files are scanned.

Once the process is complete, you'll see a list of "Files without Hashes" - files that don't have any associated hashes. Click "Create Hashes" and Whirlpool File Checker calculates a hash for each file (it uses "a strong 512-bit hash function", apparently) and saves this in its Alternate Data Stream.

To see how the program works, create a new file in your Documents folder (or whatever folder you scanned), and change one or two others.

Finally, relaunch Whirlpool File Checker, choose the same folder and click Start. The program then creates hashes for every scanned file, and compares them with the stored hash.

If there is no stored hash then it's probably a new file, and is listed in the "Files without Hash" box.

And if there is a stored hash, but it doesn't match the new calculation, then the file has changed, and it's listed in the "Altered Files" box.