You decide which side is allowed to lose files.
Most dedupe tools hand you a pile of matches and leave you to work out which copy was the real one. DuplicateDuster asks first. The source folders hold what you're keeping; the target folders are the ones being cleaned. Matches are only ever paired across the two, and only the target side gets a checkbox.
The library you trust
Your photo library, the canonical project archive, the NAS share everything else was copied from. Nothing here is ever selectable, and nothing here is ever removed — it is shown alongside each match purely for context, badged keep.
The mess you're clearing
The old laptop's Desktop folder, three generations of manual backup, the downloads directory nobody has opened since 2022. Only these files can be selected, and only these files can be removed.
Folder matches, not just files
When every file under a target folder also exists in the source, the folder itself is reported as a match — and only the topmost one, so `photos/` doesn't bury you in its own subfolders.
System paths refused outright
Windows, Program Files, /usr, /etc and their equivalents are skipped during the scan and refused again at delete time, whatever is selected.
Empty folders cleaned up after
Directories left empty by a cleanup are removed, deepest first — but only if they are genuinely empty. Anything still holding a file you kept stays.
Nothing is deleted until you say so.
Scanning is read-only. Every match is listed with full paths and sizes, the original is rendered without a checkbox at all, and the default way to reclaim space is the recycle bin — reversible, the way a tool that deletes files for a living ought to start.
Four ways to get the gigabytes back.
Deleting isn't always what you want. Sometimes the copy has to be unrecoverable; sometimes it needs to stay exactly where it is, under its own name, without costing you the disk space twice.
Recycle bin
defaultThe copy goes where the OS puts deleted files. Reversible for as long as you haven't emptied it — which is why it's what the app starts on.
Permanent delete
opt-inStraight unlink, no bin. For the case where the recycle bin is the problem — a drive that's already full and can't hold the deleted copies too.
Secure erase
opt-inThree overwrite passes (0xFF, 0x00, random), the filename scrambled through several renames, timestamps zeroed, then unlinked. On Linux it hands off to shred where available.
Hard link
opt-inThe copy is replaced by a hard link to the original: both filenames survive, both paths still open the file, and the duplicate's blocks go back to the filesystem. Same volume only — checked before anything moves.
The honest caveat on secure erase:overwriting assumes the bytes you write land on the bytes you meant to destroy. On SSDs, wear levelling and TRIM mean that isn't guaranteed. This raises the cost of recovery substantially; it does not promise erasure on flash storage, and full-disk encryption is the real answer there. We say so in the app too.
What makes a scanner trustworthy.
Multi-threaded hashing
A worker pool sized at three quarters of your cores, capped at sixteen, fed in batches as threads free up — so one thread drawing a 4 GB video never leaves the others idle.
Folder-level matching
Identical folder trees are reported as a single finding rather than hundreds of file rows, and only the topmost match in a nested run is listed.
Cross-drive matching
Because matching is by content hash, the same file on two different drives is still recognised — a backup volume compares cleanly against the library it was taken from.
Filters that narrow the work
Minimum and maximum size, an include or exclude extension list, skip hidden, skip system. The panel badges itself while any filter is active, so a leftover setting can't quietly explain a thin result.
Read-only by default
A scan never changes anything on its own. You see every match, with full paths and sizes, before deciding what happens to it.
The original has no checkbox
Source-side files are rendered with a keep badge and no way to select them. There is no path through the results screen that removes the copy you nominated as the original.
System paths refused
Windows, Program Files, ProgramData, /usr, /etc and their platform equivalents are skipped during the walk and refused again at delete time, whatever ends up selected.
Links left alone
Symbolic links are never followed and never reported. A tool that deletes files has no business resolving a link and removing what it points at.
Searchable results
Filter the finished result set by path, expand or collapse every group at once, and select all with one control — a hundred thousand matches stay navigable.
Cancel that actually cancels
The stop signal lives in shared memory rather than a message queue, so it reaches threads mid-read instead of waiting for a turn of the event loop that never comes.
Four languages
English, Serbian in both Cyrillic and Latin script, and Russian — switched live, with no restart.
Air-gapped activation
No internet on the machine? Read its device code into the licensing dashboard elsewhere, bring back a licence file, and activate Pro with no network at all.
See where this fits in your workflow.
Creative archives, shared drives, photo libraries and backup sprawl — real scenarios, real numbers.