DiskSleuth
Reads the NTFS MFT directly to enumerate millions of files, then renders a treemap of exactly where the space went.
Actively maintained · MIT licensed
The Windows toolbox that respects your machine.
I want to know how it actually works under the hood — so I build the tool that proves it.
15 open-source utilities for sysadmins, engineered in Rust. Single portable executables, offline-first, zero telemetry. Built and shipped by one engineer — see exactly how.
Build the tool, learn the system.
The fastest way to learn how a system really works is to build a tool against it — read the MFT yourself, parse the event log yourself, merge the timelines yourself. The toolbox is the evidence: each one started as a question about how Windows actually behaves.
15 tools · 100% Rust · 0 telemetry · MIT · runs offline · no admin required
01 Sleuth Family
The diagnostic core of the toolbox.
Three tools for the three questions every incident starts with — where did the disk go, what do the logs say, what did Windows record.
LogSleuth
Auto-detects every vendor log format and merges them into one colour-coded chronological timeline.
EventSleuth
Queries the Windows Event Log API on background threads and virtual-scrolls 100k+ events without the MMC snap-in freezing.
1
INFO 12:04:07.221 nginx GET /api/health 200 8ms2
INFO 12:04:07.884 app session f41f2 opened3
WARN 12:04:08.012 app retry 2/3 upstream timeout4
ERROR 12:04:08.240 worker job 9c2 failed: disk full5
# merged from 3 sources, sorted by timestamp6
INFO 12:04:08.301 logsleuth --follow ./logsLogSleuth · 3 sources merged · 1,284,551 lines · regex /timeout/ · 2 errors
02 Featured Tools
Utility portable exe
PSForge
A Tauri desktop PowerShell editor built for the paste-run-debug loop: clean AI- or web-copied scripts, run with F5 against PowerShell 5.1 or 7, and copy a Markdown debug bundle of output, exit code, and PSScriptAnalyzer findings straight back into the chat.
TypeScriptRustTauriWindowsmacOSLinux
Monitoring portable exe
QuickProbe
Probes mixed Windows/Linux fleets over WinRM and SSH with explicit PSSession cleanup, one-click RDP, and AD/LDAP discovery — credentials in DPAPI, data in local SQLite, no agent on targets.
RustTauriWindows
Search portable exe
AllTheThings
Reads the NTFS Master File Table directly to index millions of files in seconds, then tails the USN change journal for live results as you type — no admin, no waiting for Windows Search.
RustTauri
Analysis portable exe
PSTInsight
Parses the on-disk PST format directly in Rust—no Outlook, MAPI, or COM—so you can browse the folder tree, read mail, and export messages to EML/TXT/MSG on a box that has never seen Outlook.
RustTypeScriptTauri
Security portable exe
SwatCrypt
XChaCha20-Poly1305 STREAM encryption with memory-hard Argon2id key derivation, wrapping one or many files and folders into a single tamper-evident .swc bundle from a GUI or scriptable CLI with per-user Explorer context menus — single portable .exe, no admin.
Rustegui
03 Field Notes
Parsing Every Log Format: The Timestamp Problem in LogSleuth
Every application writes logs differently, and timestamps are a disaster. Here's the 15-heuristic fallback chain LogSleuth uses to parse them, and why it has to exist.
Reading the MFT Directly: How DiskSleuth Scans a Drive in Seconds
Walking the directory tree is slow. When elevated, DiskSleuth reads the NTFS Master File Table directly — a million files in a few seconds instead of minutes.
What's Actually Holding This File? Two Approaches to Windows File Locks
The 'file in use' dialog tells you nothing useful. SMB locks and local process handles are completely different problems — most tools only solve one of them.