DFIRHub

TreeSize

TreeSize - Scan History

  • Apps
  • 1 path
  • scanhistory.xml
  • Per-user data
  • Version 1
  • Andrew Rathbun

Paths on disk

1 path

Paths use Windows environment variable syntax

Notes

TreeSize is a program similar to WinDirStat which allows the user to enumerate their computer's file system in a variety of ways

ScanHistory.XML will provide listings that look similar to this

<SCANS>

<Root path="\\HOSTNAME\C$\">

<Path>\\HOSTNAME\C$\</Path>

<Date>44148.3234845949</Date>

<Version>8.0.2.1505</Version>

<SizeData Size="210610089818" Allocated="187592699904" Files="678331"/>

<Freespace>814266826752</Freespace>

</Root>

For each scan ran, there will be an entry in this file

References

1 link