Glossary

Scope: the guide's terms, collected. Each is explained where it first matters; this is the quick-reference copy.

Apparent size — the length of a file's content, the bytes a reader would see. Ignores how the disk stores them. ncdu's other ruler; the a key swaps to it.

Block — the smallest unit a filesystem allocates, 4096 bytes on most modern systems. Files occupy whole blocks, which is why a 1-byte file has 4096 bytes of disk usage.

CACHEDIR.TAG — a marker file whose presence declares a directory's contents to be a cache, safe to discard. Its first line is a fixed signature. Honoured by ncdu's --exclude-caches, backup tools and archivers.

Disk usage — the space a file actually occupies: content rounded up to whole blocks, holes and shared data accounted. ncdu's default ruler, du's too.

Export / import — writing a scan to a file (-o), and browsing a written scan (-f). The export is a dated photograph of a tree; importing never touches the original disk, and deleting is disabled in that view.

Filesystem — one formatted volume of disk, mounted somewhere in the tree. A "disk" in casual speech is usually several. -x keeps a scan inside one.

Firmlink — a macOS APFS mechanism joining the system and data volumes; the F flag marks ones a scan excluded.

Hard link — a second (third, …) name for one inode. All names are the file; the data is freed only when the last name is removed. Flagged H in the browser.

Hole — an unwritten stretch inside a file, recorded as "zeros here" and given no blocks. What makes a file sparse.

Inode — the filesystem's record for one file: size, blocks, times, owner — everything except its name, which lives in directories. Hard links share an inode; the info popup (2.x) shows its number.

Mount — attaching a filesystem at a directory in the tree. The directory below a mount point belongs to a different filesystem than the one above it.

ncurses — the terminal-drawing library ncdu is named after (NCurses Disk Usage); it is what lets a text program have windows, popups and a moving cursor.

Pseudo-filesystem — a filesystem that isn't storage: /proc, /sys and kin report the running kernel instead. Skipped by --exclude-kernfs, flagged ^.

Read-only mode (-r) — browsing with deleting and the shell disabled. The safe way to look at a disk you don't trust yourself with.

Scan / snapshot — the one pass ncdu makes over a tree, and the in-memory picture it builds. The browser always shows the snapshot; r refreshes the current directory.

Sparse file — a file with holes: apparent size far exceeds disk usage. Disk images and scientific data are often sparse, deliberately or otherwise.

Symlink — a small file whose content is a path to somewhere else. Counted as itself by default (flag @); -L measures file links as their targets and never descends into directory links.

Unlink — removing a name. What deleting is, underneath: the data is freed when the removed name was the last one and no program holds the file open.