WizTree Guides: Analyze Disk Usage on Windows

Advanced File Search

WizTree includes powerful search tools for tracking down files by name, size, and date across your Windows storage. To search, first scan a drive or folder, then open the "File View" tab and type your query into the "File Search Filter". By default only the first 1000 matches display, but you can raise this limit with the "Max files to display" setting - just note that showing "ALL" results can be slow when a drive holds a huge number of files.

Wildcards

Use an * (asterisk) to match one or more characters, and a ? (question mark) to match any single character. For instance, to find every file whose name starts with "da", type:
da*

To find files that start with "a" and have "d" as the third letter, type:
a?d*

To find files by extension, e.g. every mp3 file:
*.mp3

To find files that have no extension at all:
*.

Multiple Search Items (AND/OR)

Separate search terms with a space to act as an "AND" condition. For example, to find ".mp3" files that also contain the word "dance", type:
*.mp3 dance

If a search term itself contains a space, wrap it in double quotes, e.g.:
*.mp3 "dance hits"

Use the vertical pipe (|) as an "OR" operator between search terms. E.g. to find both .mp3 and .wav files:
*.mp3|*.wav

To find .mp3 and .wav files that also contain the word "dance":
*.mp3|*.wav dance

Don't add spaces around the vertical pipe character between search terms.

Filtering

You can filter files in both "Tree View" and "File View" by clicking the small "filter" icon beneath the "Scan" button, or pressing Ctrl+Shift+F. This switches the "include" and "exclude" filters on and off.

The "Include Filter" keeps only matching files in the results.
The "Exclude Filter" removes any matching files from the results.

Click "Apply Filter" (or press Enter after editing a filter) to apply your changes. You can match on file name only or the full path using the radio buttons in the filter section. If your search text includes a backslash, WizTree automatically matches against the entire path.

The "exclude filter" is applied during the scan itself, so it can noticeably speed up scanning very large drives when set to skip specific folders. For example, to leave the "C:\Windows", "C:\Program Files" and "C:\Program Files (x86)" folders out of the scan, set the "exclude filter" like this:
"C:\Windows\"|"C:\Program Files\"|"C:\Program Files (x86)\"
The trailing backslash matters - without it, folders like "C:\Windows Apps" would also get excluded by mistake. Quotes are needed because some folder names contain spaces. The vertical pipe works as "OR", so any path containing "C:\Windows\" OR "C:\Program Files\" OR "C:\Program Files (x86)\" gets skipped.

Searching by File Size, Date and Time

Use the operators "=", ">", ">=", "<", "<=" to filter by size or modified date. Note: don't add spaces between an operator and its value!
e.g. to find files smaller than 100 bytes:
<100
Add a 'k', 'm', 'g', or 't' suffix to search in KB, MB, GB or TB
e.g. to find files sized between 500MB and 1GB:
>=500m <=1g
You can also spell out 'kb', 'mb', 'gb', 'tb', e.g.:
>=500mb <=1gb

To filter by "allocated" size instead of file size, use "a=", "a>", etc.
e.g. to find files with allocated size between 100MB and 200MB:
a>=100m a<=200m
e.g. to find files with zero allocated size but a file size above zero:
a=0 >0

To filter by date, enter a date using the format yyyy/mm/dd
e.g. to find files modified before 2020/01/01:
<2020/01/01

Use the keyword "today" to reference the current date, and optionally add or subtract days from it.
e.g. to find files modified within the last 7 days:
>=today-7

e.g. to find files larger than 1GB that were modified in the last month (last 30 days):
>=1gb >=today-30

Wrap a search term in quotes to force a file-name search.
e.g. to find file names containing "=0" instead of showing zero-size files:
"=0"

WizTree 4.27 and later also supports searching by file time:

Example 1: to find files modified at exactly 1pm, on any day:
=13:00:00
or write it with am/pm instead:
=1:00pm

Example 2: to find files modified at 3am or earlier, on any day:
<=3am

Use the "NOW" filter variable to reference the current date and time.

Example 3: to find files modified in the last 5 minutes, use this filter:
>NOW-5
(this finds files with a modified date later than "now minus 5 minutes")
Add an 's', 'm' (default) or 'h' suffix for seconds, minutes or hours.

Example 4: to find files modified within the last hour:
>NOW-1h

Example 5: to find files modified more than one hour ago but less than four hours ago:
<NOW-1h >NOW-4h

You can get similar results by subtracting seconds, minutes or hours from the "TODAY" filter variable:
>TODAY-5m
This shows every file modified in the last 5 minutes. Use an 'h', 'm' or 's' suffix for hours, minutes or seconds

Searching by File Name Length and File Path Length

Combine the "namelen" and "pathlen" keywords with operators "=", ">", ">=", "<", "<=" to search by file name or path length.

e.g. to find files whose path length (including the file name) is over 200 characters:
pathlen>200

e.g. to find files with a path length (including the file name) between 100 and 180 characters:
pathlen>=100 pathlen<=180

e.g. to find files whose name is just 1 character long:
namelen=1

NOT (!) Operator

Start a search expression with an exclamation mark (!) to find files that don't match it.
e.g. to find files that don't contain "windows":
!windows

e.g. to find files containing "music" that aren't mp3 files:
music !*.mp3

e.g. to find files sized between 1 and 100 bytes, excluding exactly 50:
>=1 <=100 !=50

When using quotes, place the exclamation mark before them:
!"dance music"

Searching for Files or Folders only

To show only folders in the results, type:
=folder

To show only files in the results, type:
=file

Regular Expression Search (regex)

WizTree 4.13 and later lets you search using regular expressions.

Type a forward slash (/) immediately followed by your regular expression, e.g.:
/[0-9]{4}-[0-9]{2}-[0-9]{2}\.csv$

If your regular expression contains spaces, wrap it in double quotes, like this:
/"[0-9]{4} [0-9]{2} [0-9]{2}\.csv$"

Match File Name Only

With this option enabled, the search checks only the file name and ignores the rest of the path.

Match Entire Path

With this option enabled, the search checks the complete file path. If a search term contains a "\" (backslash), WizTree always searches the full path regardless of this setting.

Finding Duplicates

WizTree can spot duplicate files by comparing name, size and, optionally, modified date. To find them, open the "File View" tab and pick a detection method from the "duplicate files" drop down menu. WizTree doesn't compare actual file contents, so double-check matches carefully before deleting anything.

A small plus (+) symbol appears next to any file WizTree flags as a duplicate. Click it to reveal the matching copies listed beneath the file. You can also check the "duplicates only" box, or sort by "Dup Count" or "Dup Size" by clicking those column headers.

Exporting WizTree File Data to CSV File

Press Ctrl+Alt+E, or right-click a file or folder and choose "Export to CSV file...". The selected items are saved to a comma separated value (.CSV) file. What gets exported depends on which view is active (Tree View or File View). If nothing is selected, every file and folder is exported.

e.g. selecting the main "C:\" folder exports the entire contents of your C: drive

Selecting both "C:\Windows" and "C:\Users" exports the contents of both folders

Format is as follows:
File Name, Size, Allocated, Modified, Attributes, Files, Folders

For folders, the file name always ends with a "\", e.g. "C:\Windows\"
A folder's Size and Allocated fields reflect the combined total of every file and folder it contains.
A file's Size and Allocated fields describe that single file only.
A leading 0 before the "Allocated" value flags a "hard link" - meaning it uses no extra hard drive space and shouldn't be counted toward the total.
Modified date follows the format "yyyy/mm/dd HH:mm:ss"
Attributes are stored as a single number, combining these values:
1 = Read Only (R), 2 = Hidden (H), 4 = System (S), 32 = Archive (A), 2048 = Compressed (C)
e.g. a file that is Read Only and Hidden gets attribute value 3 (1 + 2)
The Files and Folders columns apply only to folders, showing how many files and folders each one contains.

Copying file/folder data to Clipboard

Press Ctrl+Alt+C, or right-click a file or folder and choose "Copy file and size info to clipboard". This copies file names and sizes in an easy-to-read format ready to paste into emails, forum posts, or text documents. Entries are indented to match the tree structure, and only files currently visible within your selection are included.

For example, expand the "C:\Users" folder by clicking the "+" next to it, then right-click it and choose "Copy file and size info to clipboard". You'll end up with something like this on your clipboard:

64.82 GB C:\Users 59.15 GB C:\Users\Bob 5.62 GB C:\Users\Public 19.99 MB C:\Users\UpdatusUser 15.75 MB C:\Users\Mcx1 11.07 MB C:\Users\DefaultAppPool 2.70 MB C:\Users\Default 174 Bytes desktop.ini 0 C:\Users\Default.migrated 0 C:\Users\Default User 0 C:\Users\All Users

Using this same command from "File View" copies size and name details for the currently selected files, in a format similar to this:

6.75 GB C:\pagefile.sys 3.81 GB C:\System Volume Information\{579260ea-c771-11e7-9c10-b4749f719216} 3.21 GB C:\Users\Bob\VirtualBox VMs\XP\Snapshots\{086cc618-9a46-438b-acf1-d90f001990b7}.vdi 2.93 GB C:\hiberfil.sys 2.23 GB C:\$RECYCLE.BIN\S-1-5-21-4195858667-1952806270-3254110446-1001\$RYF1ZAO.vdi

Command Line CSV Export

Since WizTree 3.18, you can automate CSV exports of your file data straight from the command line.

(Note: on 64-bit Windows, wiztree.exe automatically launches wiztree64.exe with the same parameters.)

"Drive/folder" accepts a drive letter such as "C:" or a full path like "C:\Windows"

Use %d and/or %t in the export filename to insert the current date and time. %d is replaced with the date (YYYYMMDD format) and %t with the time (HHMMSS format). These placeholders only work when running WizTree directly from the command prompt - inside a batch or command file (.bat/.cmd) you must double the percent signs, like this: %%d and %%t.

The filter option lets you export only files matching a given pattern, e.g. "*.mp3". Matching checks the entire path and file name. Separate multiple extensions with a | (pipe)
e.g. "*.mp3|*.wav|*.ogg"

FilterExclude works like filter, but leaves out any files matching the pattern instead.

Use /filterfullpath to choose whether filtering checks the full path plus file name (the default) or the file name alone. This switch requires WizTree 4.13 or later

Use the /admin flag to control admin mode (fast MFT-based scanning only works when running as administrator, via /admin=1). To run WizTree with admin rights from Windows Task Scheduler, configure the task to "run with highest privileges" using an administrator account. This avoids triggering the Windows UAC prompt.

By default, both files and folders are exported. Use the exportfolders / exportfiles parameters to skip either one. e.g. to leave folders out of the export:
/exportfolders=0

sortoption accepts:
0 = sort by file name (default)
1 = sort by file size (desc), file name
2 = sort by allocated size (desc), file name
3 = sort by modified date (desc) [requires WizTree 4.13 or later]

Add the exportmftrecno parameter to include each file's MFT record number in the export, which can serve as a unique file ID. This number is only meaningful when exporting a full NTFS drive with WizTree running as administrator.

By default, exported dates and times use your local system settings. To export UTC time instead (how NTFS stores it internally), add the exportUTCTime parameter.

Use Quotes when setting filters containing spaces via command line

Starting with WizTree 4.11, the /filter and /filterexclude command line parameters accept literal double quotes. This helps when filtering paths that contain spaces, so the space isn't treated as an "AND" operator.

Use a single quote character to stand in for a double quote, like this:
WizTree64.exe /filter="'C:\Program Files\'|'C:\Program Files (x86)\'"
This sets the "include filter" to
"C:\Program Files\"|"C:\Program Files (x86)\"
This filter matches file names containing "C:\Program Files\" OR "C:\Program Files (x86)\"

Two single quotes in a row are treated as one literal single quote:
WizTree64.exe /filter="'C:\Program Files\'|'C:\Program Files (x86)\'|'C:\Bob''s Folder'\"
This sets the "include filter" to
"C:\Program Files\"|"C:\Program Files (x86)"|"C:\Bob's Folder\"

Without quotes, filtering won't behave the way you'd expect:
C:\Program Files\|C:\Program Files (x86)\
Instead it would match file names containing "C:\Program" AND ( "Files\" OR "C:\Program" ) AND "Files" AND "(x86)\"

The older workaround was to replace spaces with wildcard question marks, like this:
WizTree64.exe /filter="C:\Program?Files\|C:\Program?Files?(x86)\"

Advanced export options:

/exportalldates=1 - adds Last Accessed and Created dates for each file
/exportallsizes=1 - adds total size and allocated size for each folder (not counting sub folders)
/exportsplitfilename=1 - splits the path into root, folder, filename and extension columns
/exportdrivecapacity=1 - adds the total drive capacity, on the first record only
/exportpercentofparent=1 - adds the "percentage of parent" value
/exportmaxdepth=n - limits the folder depth exported, where n is a number; 0 means no limit.

To export a breakdown by file type:
wiztree.exe "drive/folder" /exportfiletypes="filename" [/admin=0|1] [/filter="filespec"] [/filterexclude="filespec"] [/sortbyfiletypes=sortoptionfiletypes]

wiztree64.exe "drive/folder" /exportfiletypes="filename" [/admin=0|1] [/filter="filespec"] [/filterexclude="filespec"] [/sortbyfiletypes=sortoptionfiletypes]

/exportfiletypes can be combined with /export to generate two CSV files from a single scan.

sortoptionfiletypes accepts
0 = sort by file name
1 = sort by file size (desc), file name (default)
2 = sort by allocated size (desc), file name

Examples:

Export every file and folder on the C: drive to "C:\temp\exportYYYYMMDD_HHMMSS.csv", running with admin rights to enable MFT scanning:

From command prompt:
wiztree64.exe "C:" /export="c:\temp\export%d_%t.csv" /admin=1
In batch/cmd (.bat/.cmd) file:
wiztree64.exe "C:" /export="c:\temp\export%%d_%%t.csv" /admin=1

Export all *.mp3 and *.wav files (skipping folders) from C:\Users to "c:\temp\audiofilesYYYYMMDD_HHMMSS.csv", without admin mode:

From command prompt:
wiztree64.exe "C:\Users" /export="c:\temp\audiofiles%d_%t.csv" /filter="*.mp3|*.wav" /admin=0 /exportfolders=0
In batch/cmd (.bat/.cmd) file:
wiztree64.exe "C:\Users" /export="c:\temp\audiofiles%%d_%%t.csv" /filter="*.mp3|*.wav" /admin=0 /exportfolders=0

Export files and folders containing "test" from the D: drive, skipping the D:\Temp folder, to "f:\export\testfiles.csv":
wiztree64.exe "D:" /export="f:\export\testfiles.csv" /filter="test" /filterexclude="d:\temp\"

Export a file type breakdown for the C: drive to "C:\temp\exportfiletypesYYYYMMDD_HHMMSS.csv", skipping the "C:\temp" folder, running with admin rights for MFT scanning:
wiztree64.exe "C:" /exportfiletypes="c:\temp\exportfiletypes%d_%t.csv" /admin=1 /filterexclude="c:\temp\"

When calling wiztree.exe from a batch script, use start /wait wiztree.exe so the script waits for the export to finish before continuing. On 64-bit Windows use start /wait wiztree64.exe instead, since wiztree.exe launches wiztree64.exe and returns immediately.

e.g. for 32-bit Windows:
start /wait wiztree.exe "D:" /export="f:\export\testfiles.csv" /filter="test"

and for 64-bit Windows:
start /wait wiztree64.exe "D:" /export="f:\export\testfiles.csv" /filter="test"

Command Line Treemap Image Export

Set the image file name (use %d and %t for the current date and time, or %%d / %%t inside a batch/command file):
/treemapimagefile=<png image file name>

Set the image width (defaults to 1920 if omitted):
/treemapimagewidth=<image width (numeric)>

Set the image height (defaults to 1080 if omitted):
/treemapimageheight=<image height (numeric)>

Export the image in grayscale; defaults to 0 if omitted
/treemapimagegray=0|1

Show free space on the treemap; defaults to 1 if omitted
/treemapimagefreespace=0|1

Show allocated space on the treemap; defaults to 0 (file size) if omitted
/treemapimageshowallocated=0|1

e.g. to export the entire C: drive as a 1024x768 image using allocated space, without showing free space:

From command prompt:
WizTree64.exe C: /treemapimagefile="C:\temp\cdriveimage_%d.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1
In batch/cmd (.bat/.cmd) file:
WizTree64.exe C: /treemapimagefile="C:\temp\cdriveimage_%%d.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1

You can combine the image export with a CSV data export, e.g.:

From command prompt:
WizTree64.exe C: /export="C:\temp\cdrive_%d_%t.csv" /treemapimagefile="C:\temp\cdrive_%d_%t.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1
In batch/cmd (.bat/.cmd) file:
WizTree64.exe C: /export="C:\temp\cdrive_%%d_%%t.csv" /treemapimagefile="C:\temp\cdrive_%%d_%%t.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1

Command Line MFT Dump

Since WizTree 3.22, you can dump the MFT file directly from the command line.

On 32-bit Windows:
wiztree.exe "drive" /dumpmftfile="filename"
On 64-bit Windows:
wiztree64.exe "drive" /dumpmftfile="filename"

(Note: on 64-bit Windows, wiztree.exe automatically launches wiztree64.exe with the same parameters)

Use %d and %t in the filename to insert the current system date and time (YYYYMMDD and HHMMSS format).

For example, to dump the MFT file from drive D:

From command prompt:
wiztree.exe "D:" /dumpmftfile="c:\mftdumps\ddrive%d%t.MFT"
In batch/cmd (.bat/.cmd) file:
wiztree.exe "D:" /dumpmftfile="c:\mftdumps\ddrive%%d%%t.MFT"

Command Line Installer Options

Since WizTree 4.05, the installer supports these command line parameters

Set the supporter code license during install:
/supportercode=xxxx-xxxx-xxxx-xxxx

Set the "always run as admin" option:
/runasadmin=TRUE|FALSE

Set the "check for updates" option:
/checkforupdates=TRUE|FALSE

e.g. wiztree_x_xx_setup.exe /supportercode=1234-5678-abcd-1234 /runasadmin=false /checkforupdates=false

This example performs a silent install, skips the desktop icon, disables run-as-admin by default, turns off update checks, and applies the license code automatically:
wiztree_x_xx_setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /MERGETASKS=!desktopicon /runasadmin=false /checkforupdates=false /supportercode=xxxx-xxxx-xxxx

The WizTree installer is built with InnoSetup. See the full list of InnoSetup command line parameters here.

Configuring options via the registry (WizTree 4.27 and later only):

Most WizTree settings can also be configured via the registry, which is handy for mass deployments (this only works with the installed version placed in the system's "Program Files"/"Program Files (x86)" folder).

Add settings under the HKEY_LOCAL_MACHINE\Software\Antibody Software\WizTree\ConfigOverride\frmWizTreeMain key. Setting names should match those in the WizTree3.ini file, and every value should use the "REG_SZ" (string) type. Open WizTree3.ini in a text editor to see the available options - most are self-explanatory.

e.g. to set "run as admin" to false, create a "REG_SZ" value named "actRunAsAdmin_Checked" under the
HKEY_LOCAL_MACHINE\Software\Antibody Software\WizTree\ConfigOverride\frmWizTreeMain registry key registry key, and set its value to "FALSE"

To make a setting "read only", add an exclamation point (!) before its name in the registry, e.g. !actRunAsAdmin_Checked

Whenever the installed version of WizTree starts (regardless of which user is logged in), it checks the registry first and applies those settings. If an admin user is running WizTree, it will also update the registry settings on exit, unless that setting is marked "read only" (!).

The installer creates these registry entries automatically when run with the command line parameters /supportercode=xxxx-xxxx-xxxx-xxxx, /runasadmin=TRUE/FALSE, or /checkforupdates=TRUE/FALSE

To make runasadmin / checkforupdates read only, use:
/!runasadmin=TRUE/FALSE, or /!checkforupdates=TRUE/FALSE