Garia.Net
Administrator tools for admins by admins
- G-Scan: Hey look mom im on TV. (Admin, 4 hours ago)
Tools
G-Scan Fast disk analysis tool for admins 1.12.1 740 KB
Overview
2.8 s
a full scan of a 1.82 TB drive
1,376,677
files read straight from the MFT
0.23%
from what Windows itself reports
740 KB
one executable, no runtime, no install needed
G-Scan is built for speed: it reads a whole NTFS drive straight from its master file table instead of asking Windows for folder listings. Use it the way the job asks for, on the machine in front of you or one across the network.
| Interface | A web page on your own machine. Nothing is scanned until you choose a target. |
| Command line | gscan.exe "D:\data" opens straight into a scan; --server, --agent and --show-key do the rest. |
| Service | The agent runs as a Windows service. Open any machine that has it from your browser. |
| API | Every button is one HTTP call with JSON, for automation and third-party tools. |
| Deployment | An MSI with real properties for SCCM, Intune, GPO and NinjaOne. |
Scans disks, folders, WSL, network shares and Linux over SSH
C:\ D:\data WSL \\SERVER\C$ \\NAS\share user@host:/path
What you get
| Advice | What can go, with the gigabytes attached, and what to leave alone. |
| Explorer | Two panes, like Windows Explorer: a folder tree, and the contents of the open folder by size with each item’s share. Every folder level has its own colour on both sides. Driven by the keyboard. |
| Duplicates | Confirmed by reading the files, within one scan or across the scans you keep in the list. |
| File types | Which kinds of file take the space. |
| Export | File types, files and advice as CSV. |
| Map | A zoomable treemap. |
| Delete | Recycle Bin by default, system paths refused, everything logged. |
Without administrator rights it walks folders at about 175,000 files a second and reports what it could not read, instead of quietly showing less.
Examples
Scan a folder right away
gscan.exe "D:\data"
Hand it to a user without installing anything
Copy gscan.exe to their machine and let them start it. As a standard user it walks folders and reports the part it could not read; one click on Restart as administrator switches to turbo mode.
One install for the whole team, on a jump host
gscan.exe --server --token <key> --port 8443
Anyone on the network opens http://jumphost:8443/, enters the key once, and scans the host’s disks, any \\SERVER\C$, any NAS share and any Linux host, several at the same time. G-Scan does no TLS itself: keep it on a management network or put a reverse proxy in front.
An agent on a server you check every week
gscan.exe --agent --port 7777
gscan.exe --show-key
Export the file types of a scan to CSV
$r = Invoke-RestMethod 'http://127.0.0.1:7666/api/scan' -Method Post -Body @{ path = 'D:\data'; kind = 'folder'; label = 'data' }
do { Start-Sleep 1; $j = (Invoke-RestMethod 'http://127.0.0.1:7666/api/jobs') | Where-Object id -eq $r.id } while ($j.state -eq 'scanning')
Invoke-WebRequest "http://127.0.0.1:7666/api/export?id=$($r.id)&what=types" -OutFile types.csv
Read the agent key straight into a script
$key = & "C:\Program Files\GariaNetTools\G-Scan\gscan.exe" --show-key
Install (MSI)
Install options
An MSI with real properties, so it goes out through SCCM, Intune, GPO or NinjaOne without a wrapper script. Double-clicked it is a wizard; with /qn only the properties count. Per-machine, 64-bit, and uninstalling removes the service, the firewall rule, the shortcuts, the context menu and the registry keys.
msiexec /i G-Scan-1.12.1-x64.msi /qn
msiexec /x G-Scan-1.12.1-x64.msi /qn
| Property | Default | Meaning |
|---|---|---|
| INSTALLFOLDER | %ProgramFiles%\GariaNetTools\G-Scan | Install location |
| UIPORT | 7666 | Port of the local web interface |
| AGENT | 0 | 1 installs the remote agent as a Windows service |
| AGENTPORT | 7777 | Port of the agent and of its firewall rule |
| TOKEN | — | Key for the agent; left out, the agent makes its own |
| CONTEXTMENU | 1 | Analyse with G-Scan on folders and drives |
| DESKTOPSHORTCUT | 0 | Shortcut on the desktop |
| ALWAYSADMIN | 0 | 1 always starts G-Scan as administrator |
| SERVICEACCOUNT | — | Account for the agent service; empty is LocalSystem |
| SERVICEPASSWORD | — | Password for that account; not needed for a gMSA |
Everything at once
msiexec /i G-Scan-1.12.1-x64.msi /qn ^
INSTALLFOLDER="D:\Tools\G-Scan" ^
UIPORT=8100 AGENT=1 AGENTPORT=8101 TOKEN=<key> ^
CONTEXTMENU=1 DESKTOPSHORTCUT=0
The setup wizard, silently
G-Scan-1.12.1-setup.exe /VERYSILENT /DIR="D:\Tools\G-Scan" /PORT=8100 /AGENTPORT=8101
G-Scan-1.12.1-setup.exe /VERYSILENT /TASKS="desktopicon,contextmenu,agent"
The web interface listens on 127.0.0.1 only, so it needs no firewall rule. The agent’s rule is inbound TCP on AGENTPORT, private profile, local subnet, and only exists with AGENT=1.
Service account
Which account the agent runs as
By default the agent service runs as LocalSystem: it always works and it can read every file. Choose anything else with one thing in mind: an agent exists to read everything, and what an account cannot read is missing from the answer.
| SERVICEACCOUNT | When | Password |
|---|---|---|
| (empty) → LocalSystem | The default; always works | none |
| DOMAIN\svc_gscan$ | A fleet in AD: a gMSA in the local Administrators group | AD rotates it |
| DOMAIN\user | When it has to be a named account | yours to manage |
| NT SERVICE\GScanAgent | Only if you grant that SID the rights yourself | none |
msiexec /i G-Scan-1.12.1-x64.msi /qn AGENT=1 SERVICEACCOUNT="CONTOSO\svc_gscan$"
The installer grants the account Log on as a service itself, and keeps SERVICEPASSWORD out of the installation log. A virtual account is low-privileged by design, so turbo mode is unavailable under it.
SYSTEM is not a superset of you. It reaches other machines as the computer account, so a UNC path you can open may be refused. Its SSH keys live in C:\Windows\System32\config\systemprofile\.ssh; a password with the scan avoids that. And what it deletes goes to SYSTEM’s recycle bin and log.
API
Everything the interface does, from a script
Plain HTTP with JSON, no SDK. Every button in the page is one call, which makes G-Scan easy to build into automation and third-party tools. Against an agent, send the key as X-GScan-Token. The Postman collection has an example for every call, and it also ships in the installation folder under api.
# start a scan
$r = Invoke-RestMethod 'http://127.0.0.1:7666/api/scan' -Method Post `
-Body @{ path = 'C:\'; kind = 'drive'; label = 'C:' }
# wait for it
do {
Start-Sleep -Milliseconds 400
$j = (Invoke-RestMethod 'http://127.0.0.1:7666/api/jobs') | Where-Object id -eq $r.id
} while ($j.state -eq 'scanning')
# the findings, as codes with numbers
$res = Invoke-RestMethod "http://127.0.0.1:7666/api/result?id=$($r.id)"
$res.advice | Select-Object code, bytes
| Endpoint | Does |
|---|---|
| GET /api/hello | Is it there, does it want a key, may it be shut down |
| GET /api/targets | Drives, WSL, machine, version, whether turbo is available |
| GET /api/browse?p= | The folders inside a path, live, without a scan |
| POST /api/scan | Start a scan: path, kind, label, and for SSH optionally password |
| GET /api/jobs | Every scan with its progress |
| GET /api/cancel?id= | Stop a running scan |
| GET /api/result?id= | The outcome: tree, largest files, types, advice |
| GET /api/dirs?id=&p= | Any folder at any depth, with totals |
| GET /api/files?p= | The files in one folder, live from disk |
| GET /api/ext?id=&e= | Where one file type sits, and its largest files |
| GET /api/export?id=&what= | CSV of types, files or advice |
| POST /api/delete | Delete, with dryrun=1 first |
| POST /api/emptybin | Empty the Recycle Bin and report what it freed |
| POST /api/cleanup | Empty the folders of one finding: temp files or Windows updates |
| GET /api/verifydups?id= | Confirm suspected duplicates by reading them |
| POST /api/dupsacross | Duplicates across every finished scan; GET for progress and the result |
| GET /api/reveal?p= | Open Windows Explorer there, on that machine |
| GET /api/forget?id= | Drop a result and free its memory |
| POST /api/elevate | Restart with administrator rights, local only |
| POST /api/quit | Shut down; an agent refuses |
A Linux host over SSH, with a password
curl -s -H "X-GScan-Token: $KEY" -X POST \
-d "kind=ssh" -d "label=web01 /var" \
--data-urlencode "path=admin@web01:/var" \
--data-urlencode "password=$SSH_PW" \
http://server:7777/api/scan
The password reaches ssh.exe through askpass, not its command line, and is not kept with the scan. Findings come back as codes such as recyclebin, tempfiles and duplicates, so a script can set thresholds without parsing sentences.
Changelog
1.12.1 – 11 September 2026
The colours per level are back, now on both sides
The first attempt at a clearer explorer had a colour per folder level; the two panes of 1.12.0 left it out. He asked for it back – and with two panes it does more than it did in one list, because the same colour now ties the left to the right.
- Left: every folder icon has the colour of its level – Program Files blue, a folder in it orange, then green, purple, pink and yellow – and a line in that colour runs along everything below an open folder. The open folder’s row is tinted in its own colour.
- Right: the header and the rows carry a tint in the colour of the open folder, each step of the path has a small square in its level’s colour, and the subfolders have their icon in the colour they have on the left.
- The root of the scan has no colour. Hover, selection and the marks from a finding stay stronger than the tint. In the dark theme the tints are stronger, because the light theme’s would disappear there.
The Advice button on the overview is filled
Advice → under the findings on the overview is now a filled button, like New scan – it is the step most people take next.
Verified
- On C: (1,421,489 files), Program Files and three levels down to StarCitizen, light and dark: blue, orange and green match between the tree, the path and the contents; no script errors.
- The overview of a fresh scan (1,429,153 files): Advice → under the findings is filled blue, the same as New scan in the header.
- The MSI unpacked with
msiexec /a:gscan.exe(1.12.1.0),Readme.html,API.mdand the Postman collection are identical to the build and the sources.
1.12.0 – 11 September 2026
The explorer answers "where am I" and "what is in here" separately
Expanding Program Files made it hard to see what fell under it: every row looked the same, sixty subfolders pushed the rest of the drive out of view, and scrolling lost the folder you had opened. A first attempt – a colour per level, and the open folder’s row staying at the top – made the list readable, but it treated the symptom. Four levels down it was four coloured lines, four stacked headers and blocks longer than the screen.
So the explorer is now two panes, the way Windows Explorer, TreeSize and WizTree do it:
- Left, a folder tree: folders only, compact, each with its size. The open folder is marked and the chain to it is expanded.
- Right, the contents of that one folder: folders and files together by size, under a header that says where you are – C:\ › Program Files · 195 GB · 13,3% of C:\ · 402,580 files – with an up button. What falls under Program Files is simply what stands on the right.
- Share is per folder now. In Program Files, Roberts Space Industries is 58.6% rather than 7.8% of the drive; the header carries the share of the drive.
- The keyboard: ↑↓ to choose, Enter or → to open, Backspace or ← to go up – landing on the folder you came from – and Space to tick.
- The header, the column titles and the tree stay in place while the contents scroll. The
column titles never did:
overflow:hiddenon the table made it a scroll box of its own. It isoverflow:clipnow. - Rows are 29 px instead of 34, with slightly smaller type and buttons.
- A jump from a finding, from file types or from duplicates across scans opens the folder on the right with the cursor on the file. A target the scan does not know as a folder falls back to the nearest one it does. The ten largest folders on the overview open in the explorer with a click.
Verified
- On C: (1,397,611 files): Program Files shows its contents on the right and is marked in the tree; from StarCitizen, Backspace lands in Roberts Space Industries with the cursor on StarCitizen; scrolled down 900 px, header, column titles and tree stay put; ArrowDown twice puts the cursor on the second row; light and dark theme.
- The finding about files untouched for a year jumps ten levels down into a Hugging Face
cache: the chain expanded, the path shortened to
C:\ › … › snapshots › … › unet, both files marked, the cursor on the first. C:\pagefile.syspassed withoutisFile, as file types does: C:\ on the right, the cursor on pagefile.sys, the up button disabled at the root.- No script errors in any of these runs; an error handler put them on screen had there been any.
1.11.0 – 11 September 2026
Leave a scan out of the duplicates across scans
Duplicates across every scan takes every finished scan in the list, and that is not always what you want: an old scan of a drive that has changed since, or a drive you would rather not touch. Removing a scan from the list was only possible for one that had failed.
Every scan that is no longer running now has a small × at the end of its row in the sidebar – Remove from list. The row stays one line. The text button that failed scans got in 1.10.0 is gone from the sidebar, so the same action looks the same on every row; the error screen keeps its button.
Removing a scan also drops an earlier across-scans result, because that result counted the scan and its sums are no longer true. The server throws it away – or, when the search is still running, keeps nothing when it finishes – and the page offers the search again.
The API and the papers, for SSH
- API.md has a section on scanning Linux over SSH: a
curlexample with--data-urlencodefor the password (an&or+in it would otherwise arrive changed), how the password travels, the error codes, and wherevolumeSizeandvolumeFreecome from over SSH. - Postman has two SSH requests, one with a key and one with a password taken from the
new collection variable
sshPassword; result and forget say what changed. - Administrator.md has Linux hosts: a key or a password – per account the tool runs
under, and what it means in server mode. README, Readme.html and
docs/service-account.mdfollow.
Installers no longer pile up
tools/bouw.ps1 builds exe, setup and msi in one go and keeps only the current version’s
installers in installer\uit; released versions hang on their GitHub release. -Versie
raises the number in every place at once – both spellings in gscan.rc included, the one
missed twice on the way to 1.10.1 – and refuses a number that is not higher, because at
an equal number Windows Installer leaves the old exe in place. It checks the number in
the finished exe before it builds the installers, and -WhatIf shows all of it without
doing anything.
Verified
bouw.ps1 -Versie 1.10.2 -ZonderBouwenon a copy of the seven files: exactly the version strings changed, line endings and BOM untouched;-WhatIfchanged nothing; an equal number was refused.bouw.ps1 -Versie 1.11.0for real: exe1.11.0.0, setup and msi built, and the nine installer files of 1.9.3, 1.10.0 and 1.10.1 removed; the screenshot in the same folder left alone.- Two folder scans and a failed SSH scan: after duplicates across every scan the server
returned
{"groups":[],...,"running":false}; removing one scan made that{"running":false}. - The sidebar in Dutch: a × at the end of both rows, dimmed on the one not selected; a
click on the second × removed the failed scan from
/api/jobsand from the page, and the overview stayed on the remaining scan.
Download
Release 1.12.1
11 Sep 2026 · Windows x64 · no .NET · no VC++ runtime · EN NL FR ES PT
SHA-256 .msi 7b7eeb16b808aa7c0d554e06c6295c9c7707fcc321002863c2a38a5c512bcf2f
SHA-256 .exe 83f18fe98a6b721881ea9a9f6c0a99458f838d040be31a87547024fc376849fd
Reviews of G-Scan
Be civilNo links280 charactersChecked before it appears
Hey look mom im on TV.



