Scanning

Scanning

Scanning builds the result tree that all other views use. Good scan choices make the results faster, more accurate, and easier to understand.

Choose a Target

Target	Use it when
All Local Drives	You want a whole-PC overview of local storage. Network drives, SUBST drives, and MTP devices are not included in this option.
Individual Drives	You want specific drives or MTP devices, including removable, network, optical, or RAM drives shown in the list.
Individual Folders	You want to inspect one or more folders or UNC paths together.
Command-line path	You want to start a scan from a script, shortcut, terminal, or Explorer context menu.

The drive list shows each accessible drive's total space, free space, and used percentage. Double-clicking a drive in the list starts a scan for that drive.

Multiple Folders

Choose Individual Folders and use the browse button to select folders together, or use the add-folder button to append more folders. You can also enter paths separated by |:

C:\Projects|D:\Archives|\\server\share\Reports

The selected folders appear together in one scan. Folder history stores each folder separately. In the history list, select an entry and press Delete to remove it.

WinDirStat also shows volume and free-space statistics for administrative share drive paths such as \\server\C$, when Windows permits the query.

Portable Devices

Connected MTP devices appear alongside drives in the Select Drives dialog. Choose Individual Drives and select the device; All Local Drives does not include MTP devices.

WinDirStat scans the folders and files exposed by the device through Windows. Keep the device connected and accessible for scans, refreshes, and file operations. Capacity and free-space information depend on what the device reports. MTP file sizes use the reported content size for both logical and physical size, so the physical column is not a separate measure of device allocation.

MTP scanning does not use NTFS acceleration. Filesystem-specific commands such as compression, hardlink creation, console launch, and permissions scanning are unavailable for these items. To refresh an MTP file, refresh its containing folder or the device. Duplicate detection and Compute Hash can read device files when the device exposes a readable content stream.

Elevated Scans

Running elevated can improve scan completeness and enables features that require administrative access. WinDirStat can prompt you to relaunch elevated, and File > Run Elevated can relaunch the current scan target with administrator rights.

Use elevation when:

• You are scanning protected system folders.
• You want accelerated scanning on local NTFS drives.
• You need cleanup actions that require administrative rights.
• You want WinDirStat to enable Backup and Restore privileges for more complete reads.

When WinDirStat is elevated, it can also copy user drive mappings so mapped network drives remain available.

Accelerated Scanning

Use accelerated scanning reads the NTFS Master File Table directly for drive scans. This can be much faster than walking every folder through normal directory enumeration.

Use accelerated scanning when:

• The target is a local NTFS drive.
• WinDirStat is running elevated.
• You want the fastest full-drive scan.

WinDirStat falls back to normal scanning if accelerated scanning cannot be used. Folder-only scans, network scans, and non-NTFS volumes use the normal scanner.

Duplicate Scans

Enable Scan for duplicate files in the Select Drives dialog before starting the scan. Duplicate detection first groups files by logical size, then hashes matching-size files to confirm duplicate content.

Duplicate scanning can be expensive on large drives. If cloud-file skipping is enabled, WinDirStat avoids reading cloud placeholders so duplicate detection does not force files to download.

Choose the duplicate hash algorithm in Settings > Advanced, including xxHash (XXH3). Optional sparse hashing reduces reads for files over 64 MiB. These matches are labeled Probable duplicates because only parts of each file are read. See Search, Filters, and Duplicates before acting on sampled matches.

Filters

Filters are scan-time rules. They can include or exclude folder paths and file names, and exclude files by logical size or age since last modification. Filters are saved settings, so remember to clear them before a broad scan. Applying changed filtering settings to an open scan starts a fresh scan with those rules.

Use the < and > comparisons to choose which sizes or ages to exclude. A separate Ignored by Dropbox option in Settings > Advanced, disabled by default, can exclude files and folders marked as ignored by Dropbox.

Use the filter button in the Select Drives dialog, or open Options > Settings > Filtering. See Search, Filters, and Duplicates for examples.

Reparse Points and Exclusions

By default, WinDirStat excludes volume mount points, junctions, directory symbolic links, and file symbolic links. This avoids double-counting and prevents scans from following paths that can loop back into already-scanned locations.

Only disable these exclusions when you understand the folder structure and want WinDirStat to follow those links.

Scan Controls

Command	Use it for
Suspend	Pause scan worker threads temporarily.
Resume	Continue a suspended scan.
Stop	Cancel the current scan.
Refresh Selected	Rescan the selected item or subtree.
Refresh All	Rescan the full target.

Refresh after cleanup actions when you want the tree, extension list, and treemap to reflect current disk contents.

Stop also cancels accelerated scans while NTFS MFT records are being loaded.