WizTree Fast NTFS MFT Scans Explained: Admin Setup, Folder Modes and WinDirStat

That makes WizTree useful for answering the perennial Windows question: “Where did all my storage go?” But the stopwatch result needs boundaries. It is one author’s reported experience, not a guaranteed completion time—and the article’s contrast with WinDirStat needs an important correction.

Why reading the MFT saves time​

Microsoft describes the Master File Table, or MFT, as an NTFS structure containing information about files, including their sizes, timestamps, permissions and data contents or locations. Every file on an NTFS volume has at least one MFT entry. This is part of the filesystem itself, not an index WizTree must create beforehand.

Reading that existing metadata gives WizTree an efficient way to assemble a whole-volume inventory. Antibody Software explicitly says the utility reads the MFT directly when scanning NTFS-formatted drives. Think of it as consulting the warehouse inventory rather than visiting every aisle to ask what is on each shelf.

There is a crucial distinction here: mapping a 1TB drive is not the same as reading 1TB of file contents. The reported sub-second scan concerns a storage inventory, not a complete examination of every document, video or application binary. Microsoft’s description of the MFT explains why metadata can supply the information needed for that inventory.

Nor does the technique make file count irrelevant. Microsoft documents that the MFT grows as files are added, and a file can require additional records. Consequently, reading and processing the table still involves work that varies with the metadata involved. Direct MFT access changes the scanning method; it does not repeal arithmetic.

The takeaway: WizTree’s advantage is an efficient route to filesystem information, not a promise that every drive finishes in one second.

The WinDirStat comparison needs updating​

XDA portrays WinDirStat as an example of slow, directory-by-directory scanning. That is not a complete description of the project today.

WinDirStat’s official website lists multithreaded scanning and direct NTFS scanning where available among its features. A blanket claim that WinDirStat necessarily uses only the older traversal approach therefore risks misleading readers choosing between the two utilities.

This does not invalidate Singh’s WizTree result. It does mean that a fair performance comparison must identify the application version, selected scan target and scanning mode. Neither an old reputation nor a single stopwatch result establishes a universal winner.

XDA also reports approximately seven seconds for SquirrelDisk on the author’s C: drive, versus 0.9 seconds for WizTree, and names TreeSize as another alternative. Those figures are useful as attributed observations, but the reporting does not provide enough benchmark detail to establish a repeatable ranking across different PCs.

How to use WizTree’s fast NTFS scan​

For Windows users, two prerequisites matter most: an NTFS volume and administrator privileges. WizTree’s official FAQ and command-line guide state that fast NTFS/MFT scanning requires administrator rights.

A practical workflow is:

1. Launch WizTree with administrator rights. Approve elevation only if you trust the installed application and are authorized to administer the PC.
2. Select the whole NTFS volume you want to inspect, such as C:, rather than beginning with an individual folder.
3. Start the scan. A completed scan should populate the file-and-folder results and visual storage map.
4. Inspect the largest items before taking action. Use the inventory to identify candidates for review—not as automatic permission to delete them.

The whole-volume target follows WizTree’s documented MFT behavior, while its guide explains that completed scans can be explored through File View and searched by name, size or date.

For example, after scanning, open File View and enter >1g in the File Search Filter to find files larger than 1GB. Antibody Software documents this size-filter syntax. It is a useful way to turn a colorful storage map into a manageable investigation.

Why a folder scan can behave differently​

WizTree does not invariably use the MFT. Its release notes explain that selecting a folder normally uses the Windows API, an approach the developer says is generally quicker for small to medium-sized folders.

Since WizTree 4.20, the utility has offered an option under Options → Tweaks called “Scan MFT (if possible) when a folder is selected for analysis.” The developer also documents holding Ctrl when the scan starts to request MFT scanning for a selected folder. For very large folders, reading the whole table can be faster.

If a scan is unexpectedly slow, first check:

• Whether WizTree has administrator rights.
• Whether the selected target is a whole NTFS volume or a folder.
• Whether you are comparing the same target and scan mode.

Non-NTFS and network drives are supported, according to Antibody Software, but that does not establish that they receive the same direct-MFT speed advantage.

Reading the results without creating a new problem​

WizTree distinguishes Size from Allocated. Size describes the file’s data size; Allocated describes the disk space reserved to store it. Compressed files can have a smaller allocated size than their logical file size, so the distinction matters when investigating actual storage consumption.

Do not expect the sum of listed files to reconcile perfectly with Windows’ used-space figure, either. WizTree’s FAQ explains that NTFS structures such as directory indexes and file-security information consume space without appearing as ordinary files in its results. A discrepancy is not, by itself, evidence that the scan missed a mysterious giant folder.

Our practical recommendation is to treat the results as diagnostic evidence. Review recognizable personal files, use application uninstallers for unwanted software, and avoid deleting unfamiliar Windows or application files merely because they occupy a large rectangle.

There is another caution for cleanup enthusiasts: WizTree’s guide says its duplicate detection uses names, sizes and optionally modification dates—not file-content comparison. Matching entries should be inspected before deletion.

The useful lesson behind the stopwatch​

Singh’s reported 0.9-second result illustrates how responsive storage analysis can become when a utility uses existing NTFS metadata. It does not establish that every 1TB SSD will produce the same time, that file count no longer matters, or that competing utilities cannot use similar techniques.

The lasting value is simpler: understand the scan mode, give the tool the appropriate permissions, and use the results to investigate before cleaning up. A fast inventory is excellent. A fast, uninformed deletion is considerably less impressive.