Cleaning Up

Cleaning Up

WinDirStat can launch Explorer actions, delete files, move files, change NTFS storage features, and start Windows maintenance tools. Review selected paths carefully before running any cleanup command.

Safe Cleanup Workflow

1. Scan the relevant drive or folder.
2. Sort by Physical Size or use the treemap to identify large items.
3. Select a suspicious item and use Select in Explorer or Properties to verify it.
4. Prefer Delete (to Recycle Bin) for ordinary files.
5. Use Refresh Selected after deleting, moving, compressing, or changing files.

Do not delete files from Windows, Program Files, application data, or profile folders unless you know what owns them.

Confirmation Prompts

WinDirStat provides configurable confirmations for potentially destructive actions. Open Options > Settings > Prompts to control confirmations for deletion, emptying the Recycle Bin, hardlink deduplication, removing Mark-of-the-Web, disabling hibernation, removing shadow copies, component-store cleanup, changing folder dates, and removing empty folders. Review the listed targets before confirming. Custom cleanups have their own confirmation setting.

What Not to Delete

Do not use WinDirStat as a substitute for an uninstaller or Windows cleanup tool. Large files under system and application folders often belong to Windows, drivers, games, development tools, package managers, virtual machines, or cloud sync software.

For common space recovery, prefer these approaches before manual deletion:

Situation	Safer first action
Installed applications are large	Use Launch Program & Features or Windows Settings to uninstall them.
Windows component storage is large	Use Component Store Cleanup.
Recycle Bin is large	Use Empty Recycle Bin.
Downloads or media are large	Review in Explorer, then move or delete known files.
Virtual disks are large	Clean space inside the VM first, then use Optimize VHD Files for .vhdx files.

Basic Item Actions

Command	Shortcut	Use it for
Open	Enter	Open the selected file or folder.
Select in Explorer	Ctrl+E	Open Explorer and select the item.
Copy Path	Ctrl+C	Copy selected path or paths to the clipboard.
Command Prompt	Ctrl+P	Open Command Prompt at the selected item's folder.
PowerShell	Ctrl+S	Open PowerShell at the selected item's folder.
Properties	Alt+Enter	Open Windows file properties.
Move to	Ctrl+M	Move selected items to a chosen folder.
Delete (to Recycle Bin)	Delete	Move selected items to the Recycle Bin.
Delete Permanently	Shift+Delete	Delete selected items without using the Recycle Bin.
Empty Folder		Delete the contents of selected folders while leaving the folders.
Remove Empty Folders		Remove empty folders beneath the selection, including empty nested folders.

Permanent deletion is not easily reversible. Use it only when Recycle Bin deletion is inappropriate.

Remove Empty Folders removes directories themselves; Empty Folder removes their contents. Remove Empty Folders preserves the scan root and removes candidates from the bottom up. Windows must still consider each directory empty.

Remove Empty Folders skips reparse-point branches and directories with unreadable attributes, including selections beneath those branches, to avoid removing folders in a link target.

Windows Cleanup Tools

Command	What it does	Notes
Empty Recycle Bin	Empties Recycle Bins for local drives.	WinDirStat updates Recycle Bin entries afterward when possible.
Disable Hibernate File	Disables Windows hibernation and removes hiberfil.sys from the system drive.	Do not use this if you rely on Hibernate or Fast Startup. Administrative rights may be required.
Run Windows Disk Cleanup Utility	Starts cleanmgr.exe.	Use it for Windows-managed cleanup categories.
Microsoft Storage Settings	Opens Windows Storage Sense settings.	Available where Windows provides this settings page.
Launch Program & Features	Opens the Windows app removal control panel.	Use it to uninstall software instead of deleting application folders manually.
Component Store Cleanup	Runs DISM cleanup commands.	/AnalyzeComponentStore reports. /StartComponentCleanup cleans. /ResetBase is more aggressive and prevents uninstalling existing component updates.
Remove Cached Roaming Profiles	Requests removal of cached profiles configured for roaming.	Intended for managed machines. Review the listed profile paths and user impact first.
Remove Local Profiles	Removes unloaded, non-special local user profiles.	Use with care on shared systems.
Remove Volume Shadow Copies	Deletes existing Volume Shadow Copies.	This can remove restore points and previous-version data.

Profile removal lists the affected paths in a file-deletion warning and shows progress while deleting. Deleting a profile removes its local data; review the profile paths before accepting the warning.

Storage Actions

Command	What it does	Use with care because
Compress > LZNT1	Applies standard NTFS compression.	Best for ordinary NTFS compression compatibility.
Compress > XPRESS4K/8K/16K	Applies modern Windows file compression.	Useful for read-mostly files; compatibility and CPU cost vary.
Compress > LZX	Applies stronger modern compression.	Best for rarely changed files; can be slower to access.
Compress > No compression	Removes compression or external backing.	Physical size may increase.
Sparsify File	Converts long zero-byte ranges into sparse ranges.	Some tools copy sparse files as fully allocated files.
Optimize VHD Files	Compacts selected .vhdx files.	Works best after free space inside the virtual disk has been zeroed or trimmed.
Remove Mark-Of-The-Web Tags	Deletes Zone.Identifier alternate data streams.	This removes Windows "downloaded from the internet" warnings. Only use it for files you trust.
Deduplicate with Hardlink	Replaces selected duplicate files with hardlinks to a retained source.	Hardlinked paths share one underlying file; edits affect all links.

Compression and sparse operations are file-system features. They reduce physical allocation only when the file system and file contents allow it.

Run Deduplicate with Hardlink from completed duplicate results, with at least two files selected on the same logical volume. When multiple hash groups are selected, each group retains its own source, and the confirmation lists replacement targets. The command is disabled for groups identified by sparse hashing; turn off sparse hashing and rescan to obtain full-content matches before deduplicating those files.

Tools Menu

The Tools menu includes analysis and maintenance actions:

Command	What it does
Start File Watcher	Shows a tab that records created, deleted, modified, and renamed files under the scanned target.
Scan Permissions	Reads accessible file and folder permission entries.
Storage Analytics	Groups files by last-change age and estimates tiered storage costs.
Recover Deleted Files	Searches local NTFS, exFAT, and FAT drives for recoverable deleted files; requires elevation. See Recovering Deleted Files.
Change Folder Dates to Last Change	Sets folder modification times to the Last Change values in the scan.
Create Shadow Copy	Creates a client-accessible Volume Shadow Copy for the selected drive.
Defragment Volume	Runs DEFRAG.EXE <drive>: /O.
Check Disk	Runs CHKDSK.EXE <drive>: /F.

Maintenance tools may require elevation. Check Disk and defragmentation can take time and may affect system responsiveness.

Change Folder Dates to Last Change works through the selected folders and their descendants; without a selection it uses the scan tree. It writes the aggregated Last Change value shown by WinDirStat, which reflects changes in the folder tree. It changes folder timestamps without changing file timestamps or contents. Review a fresh, appropriately filtered scan before applying it. The operation shows progress and can be cancelled.

See Advanced Topics for permission scanning, cost estimates, and storage feature details.

Custom Cleanups

Open Options > Settings > Cleanups to define custom cleanup commands. A custom cleanup can be enabled for drives, folders, files, or UNC paths.

Useful placeholders:

Placeholder	Meaning
%p	Full path
%n	File or directory name without path
%sp	Subdirectory full path when recursing
%sn	Subdirectory name without path when recursing

Enable confirmation prompts for commands that delete or modify files. Quote path placeholders when spaces are possible, for example "%p". Choose whether to show the console window and wait for completion. Refresh policies are no refresh, refresh this entry, or refresh this entry's parent; refreshing requires waiting for the command to finish. Recursive commands always wait for completion. They enumerate directories on disk, visit children before their parent, and include the selected root; the current scan's file filters do not limit that directory enumeration.

Custom cleanups support an arbitrary number of entries. Use + to add, − to remove, and the up/down arrows to reorder entries on the Cleanups settings page.