Every layer, explained.

02Live index

Scan once. Stay current.

NTFS records every change in its USN change journal. Strata follows it and patches its in-memory index in place, so the map you are looking at is the disk as it is now.

• Deltas, not rescans. Journal records are coalesced per tick, the changed MFT records are re-read, and only the affected entries and their parent folders are updated.
• Silent when idle. Reads block until something changes, so an idle volume costs no CPU: 0 wake-ups in the benchmark.
• Opens at once. Each volume’s index is cached with per-section checksums and caught up from the journal at the next launch; any mismatch falls back to a scan.
• Honest about gaps. A wrapped or recreated journal shows a notice and can trigger a rescan. Volumes indexed by the standard scanner are watched folder by folder.
• Compact. A struct-of-arrays index uses 59.2 B of memory per entry, plus its name.

Change to view

251–265 ms

500,000 new files

1.9 s

04Safe cleanup

Every layer fails closed.

Deletion is the only destructive thing Strata does, so it passes through independent checks, each able to stop it, and lands somewhere you can take it back from.

• A never-delete list in code. Volume roots, the Windows folder, Program Files, every profile root, known-folder roots, boot and paging files, NTFS metadata and more, enforced by the app and again by the elevated helper.
• Every spelling checked. \\?\ and \??\ prefixes, UNC and admin shares, volume GUID paths, mount points, trailing dots and 8.3 short names all resolve to the same protected location.
• Re-verified by file id. Right before acting, the item is opened without following links, and its volume serial, file id, size and modification time must still match the scan.
• Recycle Bin by default. The undo log is written before anything is touched, and a restore puts files back without ever overwriting.
• Locks, named. Restart Manager shows which program holds a file. Closing it is a polite request after you agree, never a kill.

06History and snapshots

See what grew, and when.

Each scan can store a snapshot of folder sizes. Compare any two and Strata lists what grew, what shrank and what appeared, folder by folder.

• Small by design. Snapshots keep aggregate sizes of folders above a threshold (16 MB by default), about 12 bytes per folder, never individual files.
• Self-pruning. Thinned to one a week after 30 days and removed after 90 days by default; both limits are in Settings.
• Kept apart. History lives in its own database, so resetting it never touches your settings or the undo log that restores depend on.

08Activity · opt-in

Which program is filling your disk, right now.

Turn on activity tracking and Strata records which programs write, create and delete files, per folder and per hour, plus the last program that wrote each path.

• Off by default. It needs administrator rights and runs inside the elevated helper as one kernel trace session.
• Light. Tracing stays under a CPU cap (2% by default); above it, Strata samples writes and scales them, and suggests turning tracking off.
• Accurate attribution. Processes are keyed by id and start time, so a reused process id is never blamed for another program’s writes.
• Local and temporary. Activity data stays in the history database and is deleted after 30 days by default, or whenever you clear it.