DiskSleuth v1.0.2

Bug-fix release from a full codebase sweep.

Fixed

• MFT (admin) scans could silently report wrong directory sizes on volumes where NTFS has reused file record numbers: size aggregation now detects out-of-order trees and uses an order-independent roll-up, so the treemap, tree view, and totals are correct on aged volumes.
• Duplicate MFT records (one per hard-link name) could corrupt the tree's sibling links and freeze the UI in an infinite traversal loop; records are now de-duplicated and each node is wired exactly once.
• An MFT enumeration that returned no records presented an empty drive as a completed scan instead of falling back to the standard parallel scanner.
• Refreshing drives could leave the selection pointing at a removed drive, crashing the next Scan or Monitor click.
• The live write monitor no longer spins idle when ReadDirectoryChangesW fails — it shuts down cleanly and the UI reflects the stopped state — and its kernel notification buffer is now guaranteed to be correctly aligned.
• The parallel scanner no longer creates duplicate directory nodes when a child is discovered before its parent's own entry.
• Files named exactly like an extension ("log", "dat") are no longer miscategorised in the File Types panel.
• MFT file stats no longer follow symlinks/reparse points.

Added

• CSV export: the toolbar Export button now writes scan results to a timestamped CSV in your Documents folder; the status bar shows the outcome.