DiskSleuth

The question is always the same: where did the disk space go? DiskSleuth answers it for Windows without making you wait on an indexing service or wade through a folder tree by hand. Pick a drive or folder, scan it, and the biggest directories and files are in front of you in seconds.

The treemap gives you the visual lay of the land; the tree and largest-file views give you the exact paths and sizes. On NTFS it can read the Master File Table directly when elevated, so even a million-file volume scans in a few seconds instead of minutes.

What it does

• Scans folders and drives in parallel.
• Displays a SpaceSniffer-style treemap for visual size analysis.
• Shows sortable tree and largest-file views.
• Includes an NTFS MFT fast-scan path on Windows.
• Finds stale data that has not been modified recently.
• Uses a native Rust/egui desktop UI.
• Ships as a single Windows executable.

Requirements

• Windows.
• A normal user account for ordinary folder scanning.
• Administrator rights may be useful for scanning protected system paths or full drives.
• Rust only if building from source.

Install

Download the latest release from:

https://github.com/Swatto86/DiskSleuth/releases

DiskSleuth is intended to be lightweight and portable. Download the release asset, run it, and choose a folder or drive to scan.

First scan

1. Open DiskSleuth.
2. Choose a folder or drive.
3. Start the scan.
4. Watch the scan progress while results populate.
5. Use the treemap, tree view, and largest-file panels to find space-heavy areas.

The treemap is best for spotting large clusters quickly. The tree/table view is better when you need exact paths and sizes.

Main concepts

Scan root

The scan root is the drive or folder you choose. DiskSleuth reports sizes relative to that root and keeps the root as the top-level node.

Treemap

The treemap turns disk usage into rectangles. Larger rectangles consume more disk space. Click or select areas to drill into the corresponding folder or file.

Top files

The largest-file view surfaces the biggest individual files. Use this when a few giant files are more important than overall folder structure.

Stale files

The stale file workflow helps identify old data by modification age. This is useful for cleanup reviews, migration planning, or archive candidates.

NTFS fast scan

On Windows NTFS volumes, DiskSleuth can use lower-level filesystem metadata to accelerate scans. Ordinary directory walking remains available where the fast path is not appropriate.

Typical workflows

Find the biggest folders

1. Scan a drive root, such as C:\.
2. Sort by size in the tree/table view.
3. Expand the largest folders.
4. Use the treemap to spot unusually large nested areas.

Find large files

1. Run a scan.
2. Open the largest-files view.
3. Sort descending by size.
4. Open the containing folder before deleting or moving anything.

Review stale data

1. Scan the target folder or share.
2. Use stale-file filters.
3. Review last modified dates and paths.
4. Export or manually act on candidates outside DiskSleuth.

Build from source

git clone https://github.com/Swatto86/DiskSleuth.git
cd disksleuth
cargo build --release
target\release\DiskSleuth.exe

Run tests:

cargo test

Enable verbose logging when debugging scan behavior:

$env:RUST_LOG="debug"
target\release\DiskSleuth.exe

Troubleshooting

Some folders show access denied

Run DiskSleuth as Administrator or scan a narrower folder where your account has read permission.

A scan is slower than expected

Network paths, antivirus scanning, spinning disks, very deep trees, and permission errors can slow ordinary directory walking. Prefer local NTFS volumes for the fastest path.

Results changed during scanning

Disk usage can change while a scan is running. Re-run the scan when measuring active build folders, caches, or downloads.

Links

• GitHub: https://github.com/Swatto86/DiskSleuth
• Releases: https://github.com/Swatto86/DiskSleuth/releases