Architecture advice for a Windows filesystem observability tool

help
1

Hi everyone! :waving_hand:

I'm building an open-source Windows filesystem tracking tool in Rust called DiskTracker, and I'd love some architecture feedback.

The main problems I'm trying to solve are:

  • Why did my C: drive suddenly lose 10 GB?

  • I deleted files, but why didn't my free space come back?

  • Which folder keeps growing over time?

  • What exactly changed since yesterday?

Instead of rescanning the disk every time, it listens to the NTFS USN Journal and continuously tracks filesystem changes.

Current features:

  • Real-time file tracking

  • Instant file search

  • File/folder mutation history

  • Snapshot diffing

  • Storage growth analytics

I also experimented with adding an LLM. Right now it mainly orchestrates my existing CLI tools—it doesn't do anything magical on its own.

The reason I added it was for higher-level questions such as:

  • "I uninstalled an application yesterday. Are there still leftover files?"

  • "Why didn't deleting this folder free any space?"

  • "Which files were actually created during an application installation?"

  • "What most likely caused my storage to increase this week?"

My idea was that the LLM could:

  • use web search or known installer information to understand what files an application is expected to create,

  • combine that with my filesystem history,

  • call the appropriate CLI commands,

  • and correlate everything into a single explanation.

After getting some feedback, I'm questioning whether an LLM is even the right solution. If the same correlation engine can be built deterministically (rules, heuristics, event correlation, etc.), I'd actually prefer that and remove the AI entirely.

How would you design something like this? Is there a better architecture for correlating filesystem events, installs/uninstalls, and leftover files without relying on an LLM?

I'd really appreciate any guidance from people who've worked on filesystem, observability, or systems tools. Thanks!

github: github.com/pratham15541/disktracker

2

LLM is good, but remember that thousand other people can use it and create a similar tool, so unless you have a concrete customer who's willing to pay, you just waste time. But sure, the time costs nothing when you use LLM. So, if you create the tool for a personal use, go ahead.