Vacuon 0.5.0 — rules, look-alikes, a live monitor and preview

Disk space analyzer for Windows. Reads the NTFS MFT straight off the volume, shows the real content of what you are about to delete, and never claims a number it did not measure.

Since 0.4.0: cleanup by rules, a live monitor with a screen, pictures and videos that look alike, and the preview panel.

Download

File	What it is	Size
Vacuon.exe	The app. Download this one.	62 MB
vacuon-cli.exe	Command line, for scripting	36 MB
Vacuon-0.5.0-win-x64.exe	Identical to Vacuon.exe, named for winget, which pins a hash	62 MB
vacuon-cli-0.5.0-win-x64.exe	Identical to vacuon-cli.exe, same reason	36 MB

Portable and self-contained: nothing to install, no .NET runtime needed, runs from a USB stick.

Vacuon-0.5.0-win-x64.exe      1A17D039E055571CF058FA1F894E3E4630134A9057E36FED0EC690B557031AE8
vacuon-cli-0.5.0-win-x64.exe  A59A7B9684072029F1E31B984E1B59C79B4A19D30D1CBFF0A7BF5CC22EB89075

Verify with Get-FileHash .\Vacuon.exe — the two names are the same bytes.

Windows will warn you — that is expected

The file is not code-signed, so Windows shows a blue "Windows protected your PC" screen the first time. Click More info, then Run anyway.

If you would rather not trust an unsigned binary from a stranger, that is the correct instinct. Clone the repository and build it yourself: dotnet build -c Release.

New: cleanup by rules, which calls Microsoft's tools instead of deleting inside Windows

A rule catalogue finds junk by pattern and removes it — into the quarantine by default, so it is still reversible.

• Nothing under %WINDIR% is deleted by hand. The protected-path list refuses everything below the Windows folder and has no override, so the rules that need to work in there call DISM, powercfg and vssadmin instead. That is better for a second reason, not just the first: deleting WinSxS by hand is how people end up unable to install the next update. There is a test that sweeps the whole catalogue looking for any path inside Windows.
• Space freed by a tool is measured, never taken from what the tool says. DISM prints no total, vssadmin prints one that counts differently, and a catalogue's "typical gain" is a number from somebody else's machine. Free space is read before and after. If it went down in between, the result says there is no honest number rather than inventing one.
• Dry-run is structural, not a flag. Execute takes a plan, not a profile, so a file that appeared between planning and execution is not included. There is a test that creates one in the middle.
• A bad rules.json no longer fails in silence. One wrong backslash makes the whole file unreadable, and the only symptom used to be that editing the file changed nothing, forever. Now the app names the file, the line and the character.

Measured on a real machine, dry-run: quick found 2,523 files and 1.2 GiB across 4 rules; deep added 11.1 GiB of npm cache and 3.0 GiB of NuGet.

New: a live monitor that shows what is filling the disk right now

vacuon watch C: reads the USN journal at intervals and shows, per folder, what is being created, deleted and written as it happens. There is a screen for it, a tray icon, and a low-space warning.

• It cannot tell you which process is responsible, and it says so on every run. A USN record carries the file, the folder, the reason and the attributes — it has no process id, because the journal is a filesystem log, not an audit trail. Naming a culprit would mean guessing from the path, and "this folder belongs to Chrome, so it was Chrome" is a plausible invention. Real attribution needs the ETW I/O provider, which is a different piece of work.
• Bytes come from the file's current size, because the journal says that something changed, never how much. A file created and deleted inside the same interval measures zero, and that is correct.
• A journal that dropped records is reported as a gap, not as a quiet interval.
• The trend refuses to guess. It projects "full in about N days" only when it has enough history to mean it.

Scheduled cleanups run through the Windows Task Scheduler and only ever move things to the quarantine. The space guard checks a threshold and deletes nothing.

New: pictures and videos that look alike

A 64-bit dHash over the pixels the thumbnail provider already returns — no image library is linked, so it reads whatever Windows can open. Icons are never hashed, or every .docx would become "the same picture".

Running it on a real disk produced one group of 110 different images announced as the same, and fixing that took three changes, not one:

• A near-uniform image gets no fingerprint. If every cell looks alike, every cell hashes alike. A fingerprint built on nothing should not exist.
• The group is re-checked against the keeper, not against the seed it grew from.
• The aspect ratio has to match within 2%. This is what actually resolved it: 49 different poker felts collapsed into 7 legitimate copies of the same bgr.jpg in language folders. Two versions of one photo have the same shape; assorted felts do not.

Two things were tried, measured and undone: a 256-bit fingerprint (a finer grid picks up detail JPEG moves — three versions of one photo went from 0 bits apart to 27 and 34), and simply lowering the threshold (24 different playing cards at 70 px had a minimum distance of zero, and no threshold separates populations that overlap). What removed them was raising the size floor to 256 KiB — the false positives were never photographs, they were cards, sprites, wordmarks and interface decoration.

The limit is written down rather than hidden: a dHash groups by coarse resemblance, so two pictures of similar composition and identical shape can still land together. The mitigation is the screen — thumbnails side by side, the distance in bits, and nothing is removed unless you tick it.

Videos are compared by sampling frames, with no dependency added. Fingerprints are now cached between runs.

Also here: folders left behind by uninstalled programs, folders NTFS would compress well, and what changed between two scans.

New: the preview panel

• Media details without a media library. Duration, resolution, frame rate, codec and bitrate come from the Windows Property System — the same handlers as the Explorer Details tab. vacuon media <file> prints the same thing.
• Zoom and pan, because a preview scaled to fit cannot answer "which of these two copies is sharper", which is exactly the question being asked before deleting one.
• Syntax colouring for text and code, and a hex view for binary. .log and .csv are deliberately not coloured: there is no syntax there to reveal, and colouring words in a log invents structure that does not exist.
• Gallery mode and side-by-side comparison. Rows answer "how much space"; a grid answers "which one".
• The Windows context menu opens inside Vacuon's menu, not instead of it — the app's own menu carries the quarantine and the delete that respects the protected paths, and replacing it would take away the actions this program exists to offer.
• EXIF camera, date and location. The coordinate is printed to six decimals and stops there, which is about a tenth of a metre and finer than any consumer receiver.

What is deliberately still out

• The embedded video player. Measured before deciding: LibVLCSharp ships 101.8 MB of native libraries in 525 files, of which 325 are plugins that VLC looks for on the filesystem at runtime. In a single-file build they are not on disk. Making it work would mean extracting 325 plugins to %LocalAppData% on first run, and then "portable, copying one file is enough" stops being true. The binary would go from 62 MB to about 160.
• Audio fingerprinting for near-duplicate audio.
• Code signing, so the SmartScreen warning above stays.

Full changelog

v0.4.0...v0.5.0