Windirstat how to use
Once you know what files you care about, it's also possible to get an idea of when they were copied to the User Layer.
#Windirstat how to use Offline#
We have previously seen Windows hide large amounts of data in \Windows\CSC (where Roaming Profiles and Offline Files store cached files) and \Windows\Temp.
#Windirstat how to use full#
WinDirStat using the Local System Account, and you will finally get a full view of your filesystem. After you have downloaded, unblocked and unpacked both of those packages, run this: To get WinDirStat to see everything, you need to use PsExec from the Microsoft SysInternals suite. WinDirStat is a pretty easy to use tool that will give you a report of the usage of your filesystem for every folder it can reach. To get around this, you need to run your analysis as the Local System account.ĭownload these two tools - WinDirStat and PsExec: If you look at the disk properties and see all 8GB in use, but when you right-click and get Properties on all the directories in the root, you only see 1.5GB in use, then Windows is hiding things from you because you don't have rights to view the directories. However, since the full Windows permissions still apply to the User Layer disks, you may find that Windows is lying to you about space. Look for your file with a last access time that is in 1601. Probably the easiest way to see this is to run CMD, and use "dir /ta" to run "dir" while displaying the last access time.
![windirstat how to use windirstat how to use](https://i.pinimg.com/originals/ad/31/37/ad313707a73b51008dad8116ca585220.jpg)
"Last Access Time" is not displayed by default in Explorer to "DIR" from a CMD prompt. User Layer disks are simply normal NTFS filesystems, and they contain only the files actually created, modified or deleted in the desktop.Ī deleted file appears as a normal, zero-byte file with the same name, in the same location, with the Last Access Time set to at 12:41AM.
![windirstat how to use windirstat how to use](https://i.ytimg.com/vi/-5ZYc7qye4g/maxresdefault.jpg)
That will allow you to directly inspect the data on the User Layer disk(s). (If you are using Unidesk version 2, follow this article. Obviously you would not want to leave your User Layer folders open to access by any user. You will need to access it from a machine and user account that has permissions to read and write files on that specific folder of your file share. Have the user logout so their User Layer VHD is no longer locked, and then you can use Disk Management, "Attach VHD", from virtually any Windows system to get access to their VHD. First, to get access to the User Layer disks, you need to find the VHD on your File Share.