WinDirStat is a storage analyzer that scans a Windows drive or selected folder and shows which files consume its space. It presents the same scan in three connected views: a directory tree, a list grouped by file extension and a colored treemap where larger rectangles represent larger files. WinDirStat reads filesystem records and can launch cleanup actions on selected items. It does not compress data automatically or decide which personal files are safe to remove.
The treemap shows scale
Every rectangle belongs to one file. Its area follows the selected size measure, while its color identifies the extension group. Clicking a large rectangle selects the corresponding file in the directory tree. This makes an unexpected disk image or video visible even when it sits several folders deep.
The visual area can represent logical size or physical size. Logical size is the length applications see. Physical size reflects storage allocation and can differ for compressed files, sparse files and clusters with unused space. Changing that measure can rearrange the treemap without any file changing on disk.
Folders explain totals
The directory tree adds file sizes beneath each folder so the user can expand the path behind a large branch. The extension list answers a different question by collecting file types across the scan. A machine with many small cache files may show no single dominant rectangle while the parent directory still occupies substantial space.
Access permissions affect the totals. A standard scan may fail to read protected system or another user’s directories. Running WinDirStat with administrative rights can reveal more data, but it also gives cleanup commands more authority. A difference between a normal and elevated scan does not mean the first one fabricated space; it means Windows withheld parts of the tree.
Hardlinks complicate size
Two directory entries can point to the same stored data through hardlinks. Counting each name as independent logical content can overstate how much physical storage deletion will recover. WinDirStat can track hardlinks and display logical or physical measures, but the distinction still matters when interpreting duplicate-looking paths.
Duplicate detection uses file hashes rather than filenames alone. Matching hashes identify equal content at the time of the scan. They do not establish which copy belongs to an installed program, a backup or a synchronized folder. Removing the wrong copy can break a workflow even though another identical byte sequence exists elsewhere.
Cleanup changes the disk
WinDirStat can open a file’s location, move it or call deletion actions. Selection follows the active tree or treemap item, so confirming the full path and parent folder comes before deletion. A large file under a system, recovery or application directory may be necessary despite looking expendable.
Recycle Bin deletion and permanent deletion have different recovery consequences. Files larger than the available Recycle Bin allowance may also bypass the expected safety net. WinDirStat does not know whether a virtual-machine disk contains irreplaceable work or whether an installer cache is still required for repair.
A scan becomes stale
The result describes the filesystem while WinDirStat scanned it. Downloads, logs and running virtual machines can change afterward. A saved scan remains a snapshot for comparison or later inspection; reopening it does not query the drive again. Refreshing or rescanning is necessary before treating an old total as current.
Long scans also compete with active disk work. Pausing or stopping the scan avoids reading heavily used storage at the wrong time, but an incomplete tree cannot account for the whole target. The drive’s Windows properties remain the final check for total used and free capacity.
