Searching Offline File Systems

FolderSizes 7 introduced an powerful feature called Snapshots, which allow you to capture the metadata state of an entire file system for further analysis at a later date and time. Snapshots are useful for a wide variety of purposes, but today we’ll focus on the ability to search a file system even after it’s no longer online.

We’ll start by first using the Snapshot feature within FolderSizes 7 to capture the state of a file system point. Please note that Snapshots can be generated from any available file system node – a drive, folder, network share, or even multiples of any of the above. For this example, we’ll capture the entirety of the host system’s D drive.

Start by selecting Snapshot | Create New Snapshot from the main window within FolderSizes.

The Snapshot Generator window will appear. As mentioned above, we’re capturing the state of the local data drive (with a drive letter of “D”) in this example, and writing the resulting Snapshot (.fssx) file to a temporary folder on the local C drive.

Clicking the Create Snapshot button will begin the capture process. The amount of time required and the size of the resulting Snapshot (.fssx) file will depend upon the amount of data stored on the D drive (in addition to other variables such as disk speed, etc.). In the case of our example, the FolderSizes Snapshot feature captured the state of 11,238 folders and 1,516,277 files within an elapsed time of 3 minutes and 26 seconds.

I would like to point out that FolderSizes has built-in support for scheduling the generation of Snapshots. This not only allows the capture to take place during non-business hours (if desired), but also easily enables the accumulation of regular Snapshot (.fssx) files for later use (e.g. trend analysis, data archival, etc.).

Now that we have a Snapshot (.fssx) data file, it can be used in place of the equivalent live file system within FolderSizes. You can generate folder reports, file reports, and searches against the Snapshot data file, but in this case we’re going to try a search.

We start the FolderSizes Search tool and use the New Path button to browse for our newly created Snapshot file.

As you can see above, we’ve designated the Snapshot file as a search path. In fact, you can easily search multiple Snapshot files using this method just by adding them to the list. You can even search a combination of Snapshot files and live search paths at once.

Now we’ll switch to the Search Rules tab and define a simple file-based search rule that will find any image files within our Snapshot.

With that done, we can close the File Rule Editor and Start the search. Since the Search itself is reading from a single, consolidated Snapshot, it will generally execute very quickly. In the example scenario above, the search found 1,345,085 image files for a total of 10 GB of disk space within 1 mins and 55 seconds.

And so there you have a simple, step-by-step example of how to capture the state of a file system node as an offline Snapshot (.fssx) file, and later search it at will even when the target file system node is no longer available.

Benefits of this technique include:

  • Provide reporting and analysis capabilities to other users that lack access to the target file
    system(s)
  • Create a history of file system state that can be used for historical review or investigation
  • Generate reports even when the target file system(s) are offline or otherwise unavilable

In future articles, we’ll discuss additional capabilities exposed by this amazingly powerful and unique capability of FolderSizes.

posted by Key Metric Software at 7:57 pm

SAFE. TRUSTED. GUARANTEED.

  • 100% malware free
  • 100% spyware free
  • 100% adware free
  • 100% quality software