FolderTrace
FolderTrace is a local-first application for scanning folders and building a structured, persistent inventory of their contents.
Point FolderTrace at a directory. It creates a persistent inventory of the files, detects exact duplicates, and tells you what changed between scans.
It helps answer practical questions about large file collections:
- What files are in this folder?
- Which files are exact duplicates?
- What is stored inside my archives?
- What has changed since a previous scan?
- Can I recreate or verify this collection later?
FolderTrace is designed for general-purpose collections such as downloads, project archives, photo backups, and datasets. Mod folders are a useful example, but not the product's primary focus.
Install
FolderTrace requires Python 3.11 or later.
From PyPI (recommended)
pipx install foldertrace
After installation:
foldertrace --help
foldertrace scan ~/Downloads
foldertrace summary
Latest development version
Install directly from GitHub if you want unreleased changes:
pipx install git+https://github.com/LucasPullinger/FolderTrace.git
Run from source
To run FolderTrace from a local clone:
git clone https://github.com/LucasPullinger/FolderTrace.git
cd FolderTrace
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[test]"
pytest
How it works
FolderTrace recursively scans a selected directory, collects metadata for every file, calculates SHA-256 hashes, optionally inspects supported archives, and stores the resulting manifest locally. It then analyses that manifest to surface duplicates and changes over time.
Select folder
↓
Scan files and collect metadata
↓
Calculate SHA-256 hashes
↓
Inspect supported archives
↓
Store manifest locally
↓
Analyse duplicates and changes
A file record may contain information like this:
{
"path": "/Users/lucas/Downloads/project-final.zip",
"name": "project-final.zip",
"size": 34829102,
"sha256": "a893...",
"modified_at": "2026-09-03T10:24:00+01:00",
"archive": {
"type": "zip",
"file_count": 142
}
}
Features
The first release provides a small, reliable auditing workflow:
- Recursively scan a folder and record each file's path, name, extension, size, and modification date.
- Calculate SHA-256 hashes.
- Detect and report exact duplicate files.
- Recognise and inspect
.zip,.tar, and.tar.gzarchives without extracting them. - Persist scan manifests locally in SQLite.
- Compare a new scan with an earlier one to report added, removed, changed, and unchanged files.
- Identify possible filename-based version groups.
- Export saved scans as JSON or CSV.
- Reuse hashes from unchanged files to speed up repeated scans.
- Exclude unwanted files with glob patterns or a
.foldertraceignorefile. - Summarise file counts and total size by extension.
Archive records can include the number of contained files, total uncompressed size, and contained extensions.
Exact duplicates vs. possible versions
FolderTrace keeps these concepts deliberately separate.
| Finding | Meaning | Confidence |
|---|---|---|
| Exact duplicate | Files have the same SHA-256 hash. | Definitive |
| Possible version group | Filenames suggest related releases, such as tool-v1.0.zip and tool-v2.0.zip. |
Interpretive |
Version grouping is intentionally conservative: a group is only shown when at least one filename contains a version number or date marker. It must never be presented as equivalent to hash-based duplicate detection.
Command-line interface
The application is a CLI:
foldertrace scan ~/Downloads
foldertrace summary
foldertrace scans
foldertrace duplicates
foldertrace archives
foldertrace types
foldertrace versions
foldertrace changes --from 1 --to 2
foldertrace export manifest.json
foldertrace cleanup --keep-latest 3 --yes
Each scan is stored in SQLite at ~/.local/share/foldertrace/foldertrace.db by default. Use foldertrace --help for the complete command reference.
Exclude paths from a scan with repeated glob patterns:
foldertrace scan ~/Downloads --exclude "*.tmp" --exclude ".DS_Store"
You can also create a .foldertraceignore file in the scanned folder:
*.tmp
.DS_Store
.venv/*
node_modules/*
Repeated scans reuse SHA-256 hashes for files whose path, size, and modification time are unchanged. FolderTrace displays progress and reports reused versus newly calculated hashes.
Remove saved scans
cleanup removes scan records from FolderTrace's local database only; it never deletes files from the scanned folder. The --yes confirmation flag is required.
# Delete one saved scan.
foldertrace cleanup --scan-id 1 --yes
# Keep the latest three scans and delete older saved scans.
foldertrace cleanup --keep-latest 3 --yes
# Delete every saved scan from FolderTrace's database.
foldertrace cleanall --yes
An example comparison:
Scan changes: 1 → 2
Added: 12
Removed: 4
Changed: 7
Unchanged: 261
Technology
- Python 3.11+ — application language and standard-library support for filesystem scanning.
- Typer — command-line interface and argument validation.
- Rich — readable terminal tables and scan summaries.
- SQLite — local, serverless storage for persistent scan manifests.
- SQLAlchemy — Python database models and schema creation for the scans and files tables.
- pytest — automated scanner, CLI, hashing, and database tests.
hashlib provides SHA-256 hashing, while zipfile and tarfile inspect supported archives. FolderTrace runs entirely locally and does not require cloud services.
Roadmap
- Add optional GUI support.
- Add specialised plugins, such as a Nexus Mods integration.
- Expand archive-format support, including
.7zand.rar. - Improve scan filtering and reporting.
Non-goals
FolderTrace is not a file manager, backup program, antivirus product, cloud storage system, archive replacement, or mod manager. It analyses and records a collection so that it can be understood, verified, and compared over time.
License
FolderTrace is licensed under the GNU General Public License v3.0 or later (GPL-3.0-or-later). See LICENSE.
Metadata
Release files for foldertrace 0.1.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| foldertrace-0.1.4.tar.gz | 30.6 kB | With provenance | Details for foldertrace-0.1.4.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| foldertrace-0.1.4-py3-none-any.whl | Python 3 | none | any | Details for foldertrace-0.1.4-py3-none-any.whl |
Total release size: 58.6 kB
Release files / foldertrace-0.1.4.tar.gz
| Download URL | foldertrace-0.1.4.tar.gz |
|---|---|
| Size | 30.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a22fb9b1a0a94871bd853e0ec6e834b76182ac81e933c8daafdec9eb11708afc
|
|
BLAKE2b-256 checksum How to use checksums |
fbea4ab4185f42f0e3c4ed6d8ff01a24b433e4f54562b12e264e16c899bb4bbb
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 3, 2026.
Transparency logRelease files / foldertrace-0.1.4-py3-none-any.whl
| Download URL | foldertrace-0.1.4-py3-none-any.whl |
|---|---|
| Size | 28.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
e6ab088c89b901643dad7df978a7aad06d0c7746efeae54657f2422c9a77945c
|
|
BLAKE2b-256 checksum How to use checksums |
5175f81c9d7e138f295490e2a9288ee8a1f9594484d8faa02f084f53987be270
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 3, 2026.
Transparency logSecurity for foldertrace 0.1.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for foldertrace-0.1.4.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 3, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.