WizTree Guides

How to use some of WizTree's advanced features

Advanced File Search


WizTree has many advanced file searching capabilities. You can search for files by name, size and date. To search for files, first complete a scan of a drive or folder, then select the "File View" tab. Enter your search details into the "File Search Filter". By default WizTree only shows the first 1000 matching results but you can change this by setting the "Max files to display" setting. Note that displaying "ALL" files can be slow if there are a very large number of files.


Wildcards

Use a * (asterisk) to match and one or more characters. Use a ? (question mark) to match any single character. For example, to search for all files that start with the letters "da", type in:
da*

To find all files starting with the letter a with "d" as the 3rd letter, type in:
a?d*

To file all files with a particular extension, e.g. all mp3 files:
*.mp3


Multiple Search Items (AND/OR)

Separate multiple search terms with a space. The space acts like an "AND" operator. For example to seach for files of type ".mp3" that also contain the word "dance", type in:
*.mp3 dance

If your search term has a space in it use double quotes around it, e.g.:
*.mp3 "dance hits"

Use the vertical pipe (|) symbol as an "OR" operator for multiple search items. E.g. to find all .mp3 and .wav files:
*.mp3|*.wav

To find all .mp3 and .wav files that contain the word "dance":
*.mp3|*.wav dance

Do not put spaces between the vertical pipe character and the search terms.


Filtering

All files ("Tree View" and "File View") can be filtered by clicking on the little "filter" icon under the "Scan" button (or press Ctrl+Shift+F). This will toggle the "include" and "exclude" filters on and off.

The "Include Filter" will include only matching files in the results.
The "Exclude Filter" will exclude any matching files from the results.

Click on the "Apply Filter" button (or press Enter after making a filter change) to apply any filter changes made. Files can be matched on file name only or entire path by selecting the appropriate radio button in the filter section. If your search contains a backslash then the files will alway be matched by entire path.


The "exclude filter" is applied while scanning, so it can greatly reduce the scanning time of very large drives if configured to exclude certain folders. Suppose you wanted to exclude the "C:\Windows", "C:\Program Files" and "C:\Program Files (x86)" folders from the scan. You would do this by setting the "exclude filter" as follows:
"C:\Windows\"|"C:\Program Files\"|"C:\Program Files (x86)\"
The trailing backslash is included otherwise folders like "C:\Windows Apps" would also be matched and excluded. Quotes are used as some of the folders have spaces in them. The vertical pipe means "OR", so files that contain the text "C:\Windows\" OR "C:\Program Files\" OR "C:\Program Files (x86)\" will be excluded.

Searching by File Size, Date and Time

Use operators "=", ">", ">=", "<", "<=" to filter files based on size or modified date. NB: Don't put any spaces between operators and values!
e.g. to find files less than 100 bytes in size:
<100
Append a 'k', 'm', 'g', or 't' to the number to search in Kb, Mb, Gb, Tb
e.g. to find files between 500MB and 1Gb:
>=500m <=1g
'kb', 'mb', 'gb', 'tb' can also be used, e.g.:
>=500mb <=1gb

To filter by "allocated" size, use "a=", "a>", etc.
e.g. To find files with allocated size between 100MB and 200MB:
a>=100m a<=200m
e.g. to find files with 0 allocated size and greater than zero file size:
a=0 >0

To filter by date, specify a date in the format: yyyy/mm/dd
e.g. Filter files modified before 2020/01/01:
<2020/01/01

Use the constant "today" to reference today's date. Optionally add or subtract a number of days from this constant.
e.g. to find files modified in the last 7 days:
>=today-7

e.g. to find all files larger than 1gb that were modified in the last month (last 30 days):
>=1gb >=today-30

Place the search item in quotes to force a file name search.
e.g. to find file names that contain "=0" instead of displaying files with zero size:
"=0"

WizTree 4.27 and above also supports searching by file time:

Example 1: To find files modified at exactly 1pm (any day):
=13:00:00
or use am/pm like this:
=1:00pm

Example 2: To find files modified at 3am or earlier (any day):
<=3am

Use the "NOW" filter variable for the current date/time.

Example 3: To find files modified in the last 5 minutes, use filter:
>NOW-5
(find all files with modified date greater than time now minus 5 minutes)
Use a 's', 'm' (default) or 'h' suffix to indicate seconds, minutes or hours.

Example 4: To find files modified in the last 1 hour:
>NOW-1h

Example 5: Find files modified more than one hour ago, but less than 4 hours ago:
<NOW-1h >NOW-4h

Similar results can be achieved by subtracting seconds, minutes or hours from the "TODAY" filter variable:
>TODAY-5m
This will show all files modified in the last 5 minutes. Use an 'h', 'm' or 's' suffix to indicate hours, minutes or seconds


Searching by File Name Length and File Path Length

Use search terms "namelen" and "pathlen" along with operators "=", ">", ">=", "<", "<=" to search for files based on name or path length.

e.g. to find files with path length (includes filename) larger than 200:
pathlen>200

e.g. to find files with path length (includes filename) between 100 and 180:
pathlen>=100 pathlen<=180

e.g. to find files with file name of 1 character:
namelen=1


NOT (!) Operator

Start the search expression with an exclamation mark (!) to find files that don't match the expression.
e.g. to find files that don't contain "windows":
!windows

e.g. to find all files that contain "music" but are not of type mp3:
music !*.mp3

e.g. to find files that are between 1 and 100 bytes in size, but not 50:
>=1 <=100 !=50

If using quotes, put the exclamation mark before the quotes:
!"dance music"


Searching for Files or Folders only

To display only folders in search results, type in:
=folder

To display only files in search results, type in:
=file

Regular Expression Search (regex)

WizTree 4.13 and later supports regular expression search.


Type in a forward slash (/) followed directly by the regular expression you wish to use, e.g.:
/[0-9]{4}-[0-9]{2}-[0-9]{2}\.csv$

If the regular expression contains spaces, enclose it in double quotes, like this:
/"[0-9]{4} [0-9]{2} [0-9]{2}\.csv$"

Match File Name Only

If this option is selected the search will only be applied to the file name (the path is not searched)


Match Entire Path

If this option is selected the search will be applied to the entire path. If the search term contains a "\" (backslash) then the search will be performed on the entire path regardless of the current "match" setting.


Finding Duplicates

WizTree is able to locate duplicate files based on file name, size and optionally modified date. To locate duplicates, select the "File View" tab and select the desired duplicate detection method from the "duplicate files" drop down menu". Note that WizTree does not compare the file contents so take care to ensure that you only delete true duplicates.

If WizTree detects a duplicate file, it will have a little plus (+) symbol next to it. Click on the plus to display all other matching duplicates directly beneath the file. Another quick way to locate duplicates is to click on the "duplicates only" checkbox, or sort the list by "Dup Count" or "Dup Size" (click on the column headers to sort).



Exporting WizTree File Data to CSV File


Press Ctrl+Alt+E or right click on a file/folder and select "Export to CSV file...". The selected files and/or folders will be exported to a comma separated value file (.CSV format). The information exported will depend on which view is currently active (Tree View or File View). If no files or folders are selected then ALL files and folders will be exported.

e.g. If the main "C:\" folder is selected, then the entire contents of C:\ will be exported


If "C:\Windows" and "C:\Users" are both selected then the contents of both of these folders will be exported


Format is as follows:
File Name, Size, Allocated, Modified, Attributes, Files, Folders


For folders, the file name will always end with a "\", e.g. "C:\Windows\"
For folders, the Size and Allocated fields will be the total size of all files and folders contained within that folder.
For files, the Size and Allocated fields will be for that individual file only.
The "Allocated" value will be prefixed by a leading 0 if the file is a "hard link", indicating that it does not take up any additional space on the hard drive and should not be counted as part of the total space used.
Modified date is in format "yyyy/mm/dd HH:mm:ss"
Attributes is stored as a value and is a combination of the following values added together:
1 = Read Only (R), 2 = Hidden (H), 4 = System (S), 32 = Archive (A), 2048 = Compressed (C)
e.g. If a file is Read Only and Hidden it will have attribute value = 3 (1 + 2)
The Files and Folders values only apply to folders and show the total number of files and folders within that folder.


Copying file/folder data to Clipboard


Press Ctrl+Alt+C or right click on a file/folder and select "Copy file and size info to clipboard". File size and name information will be copied to the clipboard in a human friendly format, suitable for pasting into emails, support forum posts, or text documents. The files will be indented to match the current tree structure, and only currently visible files within the selection will be included.


For example, if you expand the "C:\Users" folder within the tree by clicking on the "+" next to it, and then right click on it and select "Copy file and size info to clipboard", you will get something like this copied to the clipboard:


            64.82 GB    C:\Users
            59.15 GB      C:\Users\Bob
             5.62 GB      C:\Users\Public
            19.99 MB      C:\Users\UpdatusUser
            15.75 MB      C:\Users\Mcx1
            11.07 MB      C:\Users\DefaultAppPool
             2.70 MB      C:\Users\Default
           174 Bytes      desktop.ini
                   0      C:\Users\Default.migrated
                   0      C:\Users\Default User
                   0      C:\Users\All Users

If this function is used on the "File View" then file and size information for the currently selected files will be copied to the clipboard, in a format similar to the following:


             6.75 GB  C:\pagefile.sys
             3.81 GB  C:\System Volume Information\{579260ea-c771-11e7-9c10-b4749f719216}
             3.21 GB  C:\Users\Bob\VirtualBox VMs\XP\Snapshots\{086cc618-9a46-438b-acf1-d90f001990b7}.vdi
             2.93 GB  C:\hiberfil.sys
             2.23 GB  C:\$RECYCLE.BIN\S-1-5-21-4195858667-1952806270-3254110446-1001\$RYF1ZAO.vdi

Command Line CSV Export


As of WizTree 3.18 it's now possible to automatically export file data to CSV file via the command line.


For 32 bit Windows:
wiztree.exe "drive/folder" /export="filename" [/filter="filespec"] [/filterexclude="filespec"] [/filterfullpath=0|1] [/admin=0|1] [/exportfolders=0|1] [/exportfiles=0|1] [/sortby=sortoption] [/exportmftrecno=0|1] [/exportUTCTime=0|1]

for 64 bit Windows:
wiztree64.exe "drive/folder" /export="filename" [/filter="filespec"] [/filterexclude="filespec"] [/filterfullpath=0|1] [/admin=0|1] [/exportfolders=0|1] [/exportfiles=0|1] [/sortby=sortoption] [/exportmftrecno=0|1] [/exportUTCTime=0|1]


(Note that 32 bit wiztree.exe will auto launch wiztree64.exe with the same parameters if it detects it's running on 64 bit Windows)


"Drive/folder" can be a drive letter like "C:" or a folder name like "C:\Windows"

Use %d and/or %t in export filename to include current date and time. %d will be replaced with date in YYYYMMDD format, %t will be replaced with time in HHMMSS format. Note that %d and %t will only work when running WizTree directly from the command prompt - if you're using them in a batch or command file (.bat/.cmd) you need to double the percent sign, like this: %%d and %%t.


Filter option can be used to export only files matching the file specification, e.g. "*.mp3". The entire path and file name is used when matching. Separate multiple file extensions with | (pipe)
e.g. "*.mp3|*.wav|*.ogg"


FilerExclude is similar to filter but will exclude any files that match the file specification.


Use the /filterfullpath to control whether filtering is performed on the full path including file name (default), or file name only. This option is only available in WizTree 4.13 or later


Use the /admin flag to set desired admin mode (fast MFT file scanning is only available when running as administrator - use the /admin=1 parameter). To set WizTree up to run with Administrator rights via Windows Scheduler you will have to configure it to "run with highest privileges" and select an administrator user account to run it. Running it this way will prevent the Windows UAC popup from appearing.


By default both files and folders will be exported. Use the exportfolders / exportfiles parameters to disable file and/or folders from export. e.g. to prevent folders from being exported:
/exportfolders=0


sortoption can be
0 = sort by file name (default)
1 = sort by file size (desc), file name
2 = sort by allocated size (desc), file name
3 = sort by modified date (desc) [requires WizTree 4.13 or later]


The MFT record number can be included in the export data file by using the exportmftrecno parameter. This record number can be used as a unique file ID number. Note that the MFT record number is only valid when exporting an entire NTFS formatted drive and when WizTree is launched with administrator rights.


By default WizTree will export file dates/times using the local system time settings. To export UTC time (as used internally by NTFS), use the exportUTCTime parameter.


Use Quotes when setting filters containing spaces via command line

As of WizTree version 4.11, command line parameters for /filter and /filterexclude now support literal double quotes. This is useful when filtering paths containing spaces, to prevent the filter from treating the space as an "AND" operator.

Use a single quote character to represent the double quote, like this:
WizTree64.exe /filter="'C:\Program Files\'|'C:\Program Files (x86)\'"
The example above would set the "include filter" to
"C:\Program Files\"|"C:\Program Files (x86)\"
The filter above will match files names containing "C:\Program Files\" OR "C:\Program Files (x86)\"

Two single quotes in a row will be treated as one literal single quote:
WizTree64.exe /filter="'C:\Program Files\'|'C:\Program Files (x86)\'|'C:\Bob''s Folder'\"
This would set the "include filter" to
"C:\Program Files\"|"C:\Program Files (x86)"|"C:\Bob's Folder\"

Without the quotes the filtering will not work as expected:
C:\Program Files\|C:\Program Files (x86)\
This would match any file names containing "C:\Program" AND ( "Files\" OR "C:\Program" ) AND "Files" AND "(x86)\"

Previously the way to work around this problem was to replace the spaces with wildcard question marks, like this:
WizTree64.exe /filter="C:\Program?Files\|C:\Program?Files?(x86)\"

Advanced export options:

      /exportalldates=1 - Will export Last Accessed and Created Dates for each file
      /exportallsizes=1 - Will export total size and allocated size of folder (excluding sub folders)
      /exportsplitfilename=1 - Will export the root,folder,filename,extension separately
      /exportdrivecapacity=1 - Will export the total drive capacity (on first record only)
      /exportpercentofparent=1 - Will export the "percentage of parent" value
      /exportmaxdepth=n - Will set the maximum folder depth to be exported, where n is a number. Default is 0 (no limit).


To export file types:
wiztree.exe "drive/folder" /exportfiletypes="filename" [/admin=0|1] [/filter="filespec"] [/filterexclude="filespec"] [/sortbyfiletypes=sortoptionfiletypes]

or

wiztree64.exe "drive/folder" /exportfiletypes="filename" [/admin=0|1] [/filter="filespec"] [/filterexclude="filespec"] [/sortbyfiletypes=sortoptionfiletypes]


/exportfiletypes can be used together with /export parameter to export 2 csv files based on the same scanned data.


sortoptionfiletypes can be
0 = sort by file name
1 = sort by file size (desc), file name (default)
2 = sort by allocated size (desc), file name


Examples:

Export all files and folders in C: drive to "C:\temp\exportYYYYMMDD_HHMMSS.csv", running with admin rights (to enable MFT scan):

From command prompt:
wiztree64.exe "C:" /export="c:\temp\export%d_%t.csv" /admin=1
In batch/cmd (.bat/.cmd) file:
wiztree64.exe "C:" /export="c:\temp\export%%d_%%t.csv" /admin=1


Export all *.mp3 and *.wav files (excluding folders) in C:\Users to "c:\temp\audiofilesYYYYMMDD_HHMMSS.csv", using non administrator mode:

From command prompt:
wiztree64.exe "C:\Users" /export="c:\temp\audiofiles%d_%t.csv" /filter="*.mp3|*.wav" /admin=0 /exportfolders=0
In batch/cmd (.bat/.cmd) file:
wiztree64.exe "C:\Users" /export="c:\temp\audiofiles%%d_%%t.csv" /filter="*.mp3|*.wav" /admin=0 /exportfolders=0

Export all files and folders containing the word "test" excluding the D:\Temp folder on the D: drive to "f:\export\testfiles.csv":
wiztree64.exe "D:" /export="f:\export\testfiles.csv" /filter="test" /filterexclude="d:\temp\"

Export all file types in C: drive to "C:\temp\exportfiletypesYYYYMMDD_HHMMSS.csv", excluding "C:\temp" folder, running with admin rights (to enable MFT scan):
wiztree64.exe "C:" /exportfiletypes="c:\temp\exportfiletypes%d_%t.csv" /admin=1 /filterexclude="c:\temp\"

To call wiztree.exe from a batch file script, use start /wait wiztree.exe to wait for the export to complete before moving on to the next line. If you're using 64 bit Windows then use start /wait wiztree64.exe as wiztree.exe will launch wiztree64.exe automatically and return immediately.

e.g. for Windows 32:
start /wait wiztree.exe "D:" /export="f:\export\testfiles.csv" /filter="test"

and for Windows 64:
start /wait wiztree64.exe "D:" /export="f:\export\testfiles.csv" /filter="test"


Command Line Treemap Image Export


Set image file name (use %d and %t for current date and time in file name, %%d / %%t if used in batch/command file):
/treemapimagefile=<png image file name>

Set image width (default is 1920 if omitted):
/treemapimagewidth=<image width (numeric)>

Set image height (default is 1080 is omitted):
/treemapimageheight=<image height (numeric)>

Export image in gray scale. Defaults to 0 if omitted
/treemapimagegray=0|1

Show free space on tree map. Defaults to 1 if omitted
/treemapimagefreespace=0|1

Show allocated space on tree map. Defaults to 0 (shows file size) if omitted
/treemapimageshowallocated=0|1

e.g. To export the entire C: drive to an image file of size 1024x768 using allocated space, without free space included:

From command prompt:
WizTree64.exe C: /treemapimagefile="C:\temp\cdriveimage_%d.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1
In batch/cmd (.bat/.cmd) file:
WizTree64.exe C: /treemapimagefile="C:\temp\cdriveimage_%%d.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1

Exporting of the image file can be combined with exporting CSV data as well, e.g.:

From command prompt:
WizTree64.exe C: /export="C:\temp\cdrive_%d_%t.csv" /treemapimagefile="C:\temp\cdrive_%d_%t.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1
In batch/cmd (.bat/.cmd) file:
WizTree64.exe C: /export="C:\temp\cdrive_%%d_%%t.csv" /treemapimagefile="C:\temp\cdrive_%%d_%%t.png" /treemapimagewidth=1024 /treemapimageheight=768 /treemapimagefreespace=0 /treemapimageshowallocated=1

Command Line MFT Dump


As of WizTree version 3.22 it's possible to dump the MFT file via command line.

For 32 bit Windows:
wiztree.exe "drive" /dumpmftfile="filename"

For 64 bit Windows:
wiztree64.exe "drive" /dumpmftfile="filename"

(Note that 32 bit wiztree.exe will auto launch wiztree64.exe with the same parameters if it detects it's running on 64 bit Windows)


Use %d and %t in filename to have them replaced by the current system date and time (YYYYMMDD and HHMMSS format).


For example, to dump the MFT file for drive D:

From command prompt:
wiztree.exe "D:" /dumpmftfile="c:\mftdumps\ddrive%d%t.MFT"
In batch/cmd (.bat/.cmd) file:
wiztree.exe "D:" /dumpmftfile="c:\mftdumps\ddrive%%d%%t.MFT"

Command Line Installer Options


As of WizTree version 4.05 the following command line parameters are supported by the installer

Set the supporter code license on install:
/supportercode=xxxx-xxxx-xxxx-xxxx

Set the "always run as admin" setting:
/runasadmin=TRUE|FALSE

Set the "check for updates" setting:
/checkforupdates=TRUE|FALSE

e.g. wiztree_x_xx_setup.exe /supportercode=1234-5678-abcd-1234 /runasadmin=false /checkforupdates=false

This example will do a silent install, will not create a desktop icon, set WizTree to not run as admin by default, disable update checks, and set the license code automatically:
wiztree_x_xx_setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /MERGETASKS=!desktopicon /runasadmin=false /checkforupdates=false /supportercode=xxxx-xxxx-xxxx

The WizTree installer is built using InnoSetup. A full list of command line parameters supported by InnoSetup is available here.

Configuring options via the registry (only applies to WizTree 4.27 and later):

Most of WizTree's configuration options can be set via the registry - useful for mass deployments (only works with the installed version when installed to the system's "Program Files"/"Program Files (x86)" folder).

Add settings to the HKEY_LOCAL_MACHINE\Software\Antibody Software\WizTree\ConfigOverride\frmWizTreeMain key. Setting names should match those used in the WizTree3.ini file and all value types should be of type "REG_SZ" (string). Open the WizTree3.ini file with a text editor to see all of the various options - the option names in the file are mostly self explanatory.

e.g. to set the "run as admin" option to false create a "REG_SZ" value named "actRunAsAdmin_Checked" in the
HKEY_LOCAL_MACHINE\Software\Antibody Software\WizTree\ConfigOverride\frmWizTreeMain registry key and set the value to "FALSE"

To make a setting "read only", prefix the name in the registry with an exclamation point (!), e.g. !actRunAsAdmin_Checked

When the installed version of WizTree starts (does not matter which user is logged in), it will first look to the registry and set its settings accordingly. If WizTree is being run by a user with admin rights, it will also update these registry settings when it's closed unless the registry setting is "read only" (!).

The installer will automatically create the necessary registry entries if it's run with command line parameters /supportercode=xxxx-xxxx-xxxx-xxxx, /runasadmin=TRUE/FALSE, or /checkforupdates=TRUE/FALSE

To set runasadmin / checkforupdates to read only, use:
/!runasadmin=TRUE/FALSE, or /!checkforupdates=TRUE/FALSE