A timesaver: find out where the disk space went, look inside, and clean up without leaving the screen, with every key run for real on a sample folder of about 480 MiB.
▶Prefer to watch? This short video explains what ncdu is for, then runs it on a real Ubuntu 24.04 machine with a sample folder, with on-screen captions and no voiceover. Click to play, or watch it on YouTube.
ncdu: a disk usage browser for the terminal. It scans a folder and shows what takes the space, biggest first.
ncdu scan the current folder and browse the result
Enter Left go into the folder under the cursor, go back up
s n g i sort by size, sort by name, show percentages, show details of one item
d q delete the item under the cursor (it asks first), quit
ncdu (NCurses Disk Usage) reads a directory tree once and shows it as a list: one line per item with its size, a bar that shows its share of the folder, and its name. The biggest item is on top. You move with the arrow keys, open a folder with Enter, and go back with the left arrow, so a full disk becomes a few key presses: find the big folder, go in, find the big file. You can also delete from inside the list. It needs no desktop, it works over SSH, and a saved scan can be opened later on another machine.
This page is the written version of the Timesavers video. Every key and option below was run for real, in an Ubuntu 24.04 container with ncdu 1.19 from the Ubuntu package, on a made-up folder of 33 files (about 480 MiB: logs, database backups, media files, caches, old releases and temporary files). The screens shown are the real screens from that run. The section "What was not run" lists what was not tried.
What ncdu is for
Use ncdu when a disk is filling up and you do not know why:
where did the space go? the list is sorted by size, with a bar for each item
what is inside that folder? Enter goes in, the left arrow comes back
how old, how big exactly? i shows the details of one item
get rid of it d deletes from inside the list, after asking
check a server without scanning it twice save the scan to a file and open the file later
It does not replace du in scripts: du prints a list once, ncdu is for looking around. It does not tell you whether a file is safe to delete. That is your decision, and d deletes for real (see the section on delete). It scans one directory tree at a time and shows what was on the disk when the scan ran. After you delete something it updates its own totals, but it does not watch for other changes made by other programs. To see them, scan again.
Install
ncdu is in the Ubuntu package archive:
$ sudo apt install ncdu
$ apt-cache policy ncdu | head -3
ncdu:
Installed: 1.19-0.1
Candidate: 1.19-0.1
$ ncdu --version
ncdu 1.19
(The lab ran apt-get as root inside the container; the two lines above are the real output.) The version in the Ubuntu 24.04 archive is 1.19. This page is only about 1.19, as the lab ran it. A newer major version (2.x) exists and was not tried.
The sample folder
The lab folder ~/srv is made up for this page. Nothing in it is real, and every file is just zeros of the stated size:
$ cd ~/srv && find . -type f -printf '%10s %p\n' | sort -k2
5242880 app/releases/1.0/app.tar
2097152 app/releases/1.0/assets.bin
5242880 app/releases/1.1/app.tar
2097152 app/releases/1.1/assets.bin
5242880 app/releases/1.2/app.tar
2097152 app/releases/1.2/assets.bin
67108864 backups/db-2026-10-01.sql.gz
69206016 backups/db-2026-10-08.sql.gz
70254592 backups/db-2026-10-15.sql.gz
9437184 cache/session.db
225280 cache/thumbs/t1.jpg
225280 cache/thumbs/t2.jpg
225280 cache/thumbs/t3.jpg
225280 cache/thumbs/t4.jpg
225280 cache/thumbs/t5.jpg
225280 cache/thumbs/t6.jpg
225280 cache/thumbs/t7.jpg
225280 cache/thumbs/t8.jpg
81788928 logs/access.log
42991616 logs/access.log.1
6291456 logs/app.log
12582912 logs/error.log
3276800 media/photos/IMG_0001.jpg
3407872 media/photos/IMG_0002.jpg
3538944 media/photos/IMG_0003.jpg
3670016 media/photos/IMG_0004.jpg
3801088 media/photos/IMG_0005.jpg
3932160 media/photos/IMG_0006.jpg
28311552 media/video/demo.mp4
50331648 media/video/launch.mp4
19922944 tmp/core.dump
8 tmp/notes.txt
3145728 tmp/upload.part
For comparison, du gives the same picture as one list:
$ du -h --max-depth=1 | sort -rh
484M .
198M ./backups
138M ./logs
96M ./media
23M ./tmp
22M ./app
11M ./cache
du rounds each size up (198M where ncdu says 197.0 MiB). ncdu shows one decimal and the unit, and the bar makes the order obvious without reading the numbers. The difference between du and ncdu is not the numbers, it is that ncdu lets you go in.
Scan and look
Go to the folder and run ncdu. It scans and then shows the result. The scan of this small folder took no visible time. On a big disk it shows a progress screen until it is done:
$ cd ~/srv
$ ncdu
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [##############] /backups
137.0 MiB [######### ] /logs
95.6 MiB [###### ] /media
22.0 MiB [# ] /tmp
21.0 MiB [# ] /app
10.7 MiB [ ] /cache
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
From the top: a title line with the version, a line with the path being shown, then one row per item. Each row has the size, a bar that shows its size relative to the biggest item, and the name. A name that starts with / is a folder, so /backups is a folder with 197.0 MiB inside it. The last line is the total disk usage, the apparent size, and the number of items (46 here, counting the folders and files below the starting folder). An item with no / in front of it is a file.
Go in and come back
Enter (or the right arrow) opens the folder under the cursor. The left arrow (or h) goes back up. j and k move down and up, the same as the arrow keys. The first row of a folder you have entered is /.., which is the way back:
keys: Enter
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv/backups -----------------------------------------------------------------------
/..
67.0 MiB [##############] db-2026-10-15.sql.gz
66.0 MiB [############# ] db-2026-10-08.sql.gz
64.0 MiB [############# ] db-2026-10-01.sql.gz
*Total disk usage: 197.0 MiB Apparent size: 197.0 MiB Items: 3
Three database backups, about the same size each. Press the left arrow, move down to /logs and press Enter:
keys: Left, Down, Enter
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv/logs --------------------------------------------------------------------------
/..
78.0 MiB [##############] access.log
41.0 MiB [####### ] access.log.1
12.0 MiB [## ] error.log
6.0 MiB [# ] app.log
*Total disk usage: 137.0 MiB Apparent size: 137.0 MiB Items: 4
This is how you find a big file in a few steps: the biggest folder first, then the biggest thing inside it. The cursor stays on the item you came from when you go back, so you do not lose your place.
Sort and show more
The list starts sorted by size, biggest first. n sorts by name, and pressing the same key again reverses the order. s sorts by size again, and pressing s a second time reverses it. After n, then s, then s:
keys: n
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
21.0 MiB [# ] /app
197.0 MiB [##############] /backups
10.7 MiB [ ] /cache
137.0 MiB [######### ] /logs
95.6 MiB [###### ] /media
22.0 MiB [# ] /tmp
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
keys: s, s
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
10.7 MiB [ ] /cache
21.0 MiB [# ] /app
22.0 MiB [# ] /tmp
95.6 MiB [###### ] /media
137.0 MiB [######### ] /logs
197.0 MiB [##############] /backups
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
(A third s goes back to biggest first.) g changes what is shown next to the size. One press replaced the bar with the percentage of the folder; a second press showed the percentage and the bar together (the screens after this one are in that state). The third press was not run. One press gave this:
keys: g
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [ 40.8%] /backups
137.0 MiB [ 28.3%] /logs
95.6 MiB [ 19.8%] /media
22.0 MiB [ 4.6%] /tmp
21.0 MiB [ 4.3%] /app
10.7 MiB [ 2.2%] /cache
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
Two more keys change the columns. a switches between disk usage and apparent size (the marker * on the last line moves to the one in use), and c shows how many items are in each folder:
keys: a (then a again to go back)
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [ 40.8% ##############] /backups
137.0 MiB [ 28.3% ######### ] /logs
95.6 MiB [ 19.8% ###### ] /media
22.0 MiB [ 4.6% # ] /tmp
21.0 MiB [ 4.3% # ] /app
10.7 MiB [ 2.2% ] /cache
Total disk usage: 483.4 MiB *Apparent size: 483.4 MiB Items: 46
keys: c
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [ 40.8% ##############] 3 /backups
137.0 MiB [ 28.3% ######### ] 4 /logs
95.6 MiB [ 19.8% ###### ] 10 /media
22.0 MiB [ 4.6% # ] 3 /tmp
21.0 MiB [ 4.3% # ] 10 /app
10.7 MiB [ 2.2% ] 10 /cache
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
Disk usage is the space the item takes on the disk, in whole blocks. Apparent size is the number of bytes in the file. They are the same here, because the sample files are not sparse and have no tiny files. They can differ a lot for sparse files, for many small files, and on some filesystems: ncdu run on /usr/share in the lab showed this at the bottom:
*Total disk usage: 5.9 MiB Apparent size: 4.5 MiB Items: 1031
(5.9 MiB on the disk for 4.5 MiB of data. With 1031 small files, the most likely reason is that every file takes whole blocks on the disk.) M sorts by modification time. The help window says this needs the -e option (see "Save the scan and look later"); M was only run with -e. C sorts by the number of items. t switches between listing folders before files and listing everything mixed. In the lab, pressing t at the top level changed nothing visible, because that level holds only folders, so how it looks in a mixed list was not tried.
Details of one item
i opens a window with the details of the item under the cursor, and another i closes it. For the /logs folder:
keys: i
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [ 40.8% ##############] /backups
137.0 MiB [ 28.3% ######### ] /logs
95.6 MiB [ 19.8% ###### ] /media
22.0 MiB [ 4.6% # ] /tmp
21.0 MiB [ 4.3% ┌───Item info──────────────────────────────────────────────┐
10.7 MiB [ 2.2% │ │
│ Name: logs │
│ Path: /home/ubuntu/srv │
│ Type: Directory │
│ │
│ Disk usage: 137.0 MiB (143.659.008 B) │
│ Apparent size: 137.0 MiB (143.659.008 B) │
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
and for a file inside it (here with the percentage view on):
keys: Enter, Down, i
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv/logs --------------------------------------------------------------------------
/..
78.0 MiB [ 56.9% ##############] access.log
41.0 MiB [ 29.9% ####### ] access.log.1
12.0 MiB [ 8.8% ## ] error.log
6.0 MiB [ 4.4% ┌───Item info──────────────────────────────────────────────┐
│ │
│ Name: access.log │
│ Path: /home/ubuntu/srv/logs │
│ Type: File │
│ │
│ Disk usage: 78.0 MiB (81.788.928 B) │
│ Apparent size: 78.0 MiB (81.788.928 B) │
│ │
│ Press i to hide this window │
*Total disk usage: 137.0 MiB Apparent size: 137.0 MiB Items: 4
Name, the folder it is in, the type, the disk usage and the apparent size, each in MiB and in bytes (written with points as separators here, which is how the lab's locale printed them). The help text says -e enables extended information. This window with -e was not opened in the lab.
Delete from inside
d deletes the item under the cursor. It asks first:
keys: d
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv/logs --------------------------------------------------------------------------
/..
78.0 MiB [ 56.9% ##############] access.log
41.0 MiB [ 29.9% ####### ] access.log.1
12.0 MiB [ 8.8% ## ] error.log
6.0 MiB [ 4.4% # ] app.log
┌───Confirm delete─────────────────────────────────────────┐
│ Are you sure you want to delete "access.log"? │
│ │
│ │
│ yes no don't ask me again │
└──────────────────────────────────────────────────────────┘
*Total disk usage: 137.0 MiB Apparent size: 137.0 MiB Items: 4
The question names the item. The choices are yes, no, and "don't ask me again". The dialog opens on no: in the lab, pressing d and then Enter at once deleted nothing, and the file was still there afterwards. Use the left arrow to move to yes and press Enter. Then the item is gone and the totals change at once:
keys: Left, Enter
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv/logs --------------------------------------------------------------------------
/..
41.0 MiB [ 69.5% ##############] access.log.1
12.0 MiB [ 20.3% #### ] error.log
6.0 MiB [ 10.2% ## ] app.log
*Total disk usage: 59.0 MiB Apparent size: 59.0 MiB Items: 3
and back at the top, /logs is smaller:
keys: Left
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [ 48.6% ##############] /backups
95.6 MiB [ 23.6% ###### ] /media
59.0 MiB [ 14.6% #### ] /logs
22.0 MiB [ 5.4% # ] /tmp
21.0 MiB [ 5.2% # ] /app
10.7 MiB [ 2.6% ] /cache
*Total disk usage: 405.4 MiB Apparent size: 405.4 MiB Items: 45
The file really is gone from the disk (ls -l ~/srv/logs no longer lists it). The 45 items on the last line are one fewer than before. This is a plain delete, the same as rm: there is no trash can and no undo. If you delete a folder, everything in it goes. Do not use d on a system you cannot afford to break, and look at the name in the question every time. ncdu -r (read-only) switches deleting off. In the lab it showed this when d was pressed:
$ ncdu -r
keys: Enter, Down, d
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help [read-only]
--- /home/ubuntu/srv/backups -----------------------------------------------------------------------
/..
67.0 MiB [##############] db-2026-10-15.sql.gz
66.0 MiB [############# ] db-2026-10-08.sql.gz
64.0 MiB [############# ] db-2026-10-01.sql.gz
┌───Message────────────────────────────────────────────────┐
│ │
│ Deletion feature disabled. │
│ │
*Total disk usage: 197.0 MiB Apparent size: 197.0 MiB Items: 3
The "don't ask me again" choice was not used, and deleting a whole folder was not run.
Leave, and open a shell
q leaves ncdu and gives the prompt back. The screen you were looking at is gone, so note the names you need before you press it:
keys: q
ubuntu@timesaver:~/srv$ ncdu
ubuntu@timesaver:~/srv$
b opens a shell, in the folder ncdu is showing, and exit brings you back to the same ncdu screen. In the lab it was started at the top folder, and pwd printed /home/ubuntu/srv. The shell was only tried there, not inside a subfolder:
keys: b, then pwd, then exit
ubuntu@timesaver:~/srv$ ncdu
ubuntu@timesaver:~/srv$ pwd
/home/ubuntu/srv
ubuntu@timesaver:~/srv$
and after exit
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [##############] /backups
137.0 MiB [######### ] /logs
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
The ncdu screen looked the same as before. Whether ncdu notices changes made in the shell was not tried.
Save the scan and look later
Scanning a big disk takes time, and you may not want to do it on a busy server twice. -o saves the scan to a file instead of showing it. -f reads such a file and shows it as if it had just been scanned. In the lab:
$ ncdu -x -o ~/srv.json ~/srv; echo status=$?; ls -lh ~/srv.json; head -c 300 ~/srv.json; echo
ubuntu@timesaver:~/srv$ ncdu -x -o ~/srv.json ~/srv; echo status=$?; ls -lh ~/srv.json; head -c 300
~/srv.json; echo
/home/ubuntu/srv/media/photos/IMG_0001.jpg 4 files
status=0
-rw-r--r-- 1 ubuntu ubuntu 2.5K Oct 21 01:17 /home/ubuntu/srv.json
[1,2,{"progname":"ncdu","progver":"1.19","timestamp":1792545462},
[{"name":"/home/ubuntu/srv","asize":4096,"dsize":4096,"dev":241},
[{"name":"media","asize":4096,"dsize":4096},
[{"name":"photos","asize":4096,"dsize":4096},
{"name":"IMG_0001.jpg","asize":3276800,"dsize":3276800},
{"name":"IMG_0002.jp
ubuntu@timesaver:~/srv$
(The line with a path and "4 files" is the scan progress line that -o prints while it works. Without -0 it prints one. -0 turns the scan screen off completely.) The file is plain JSON, 2.5 KiB for 46 items. Open it:
$ ncdu -f ~/srv.json
keys: (the title line now ends with [imported])
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help [imported]
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [##############] /backups
137.0 MiB [######### ] /logs
95.6 MiB [###### ] /media
22.0 MiB [# ] /tmp
21.0 MiB [# ] /app
10.7 MiB [ ] /cache
*Total disk usage: 483.4 MiB Apparent size: 483.4 MiB Items: 46
Nothing is scanned, and the sizes are the ones from the moment of the scan. The file can be copied to another machine and opened there. It also compresses well, and ncdu can read standard input with -f -:
$ ncdu -0 -o- ~/srv | gzip > ~/srv.json.gz
$ zcat ~/srv.json.gz | ncdu -f- -0 -o /dev/null
-rw-r--r-- 1 ubuntu ubuntu 2.5K Oct 21 01:17 /home/ubuntu/srv.json
-rw-r--r-- 1 ubuntu ubuntu 576 Oct 21 01:17 /home/ubuntu/srv.json.gz
zcat | ncdu -f-: exit 0
(The last command was only checked for an exit status of 0, which means ncdu could read the file. Browsing it that way, and the -o- form at the start, were run only as shown.) With -e, the scan also keeps the times of modification, and M can sort by them. In the lab the order did change when M was pressed (the first press put /logs last, and a second press reversed the order), but the list itself has no column for the time, so the order is all you see. -x keeps a scan on one filesystem. In the lab it ran on the sample folder, which is on one filesystem, so it changed nothing. It did not run on a folder that has another disk mounted inside.
Leave things out
--exclude PATTERN leaves out names that match the pattern, and it can be given several times. Quote patterns that have a star so the shell does not change them. The lab scan without the backups and without any log file:
$ ncdu --exclude backups --exclude '*.log*' ~/srv
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
95.6 MiB [##############] /media
22.0 MiB [### ] /tmp
21.0 MiB [### ] /app
10.7 MiB [# ] /cache
4.0 KiB [ ] /logs
< 0.0 B [ ] backups
*Total disk usage: 149.4 MiB Apparent size: 149.4 MiB Items: 43
Both the backups and the logs are left out: /logs is still listed but holds only the folder itself (4.0 KiB), and the backups are marked with < at the left, which the help window explains as "File or directory is excluded from the statistics". The total is now 149.4 MiB. This is the way to look at everything but the part you already know about, or to skip a folder that holds another disk (-x does that by filesystem) or a huge cache. --exclude-caches skips folders that hold a CACHEDIR.TAG file, -X reads patterns from a file, and --exclude-kernfs skips /proc and the like. The last three were not run.
The e key shows or hides hidden files. The lab put a 5 MiB file called .hidden-cache in the folder: hidden files were listed on first view, and the key switched that off.
keys: (start)
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [##############] /backups
137.0 MiB [######### ] /logs
95.6 MiB [###### ] /media
22.0 MiB [# ] /tmp
21.0 MiB [# ] /app
10.7 MiB [ ] /cache
5.0 MiB [ ] .hidden-cache
*Total disk usage: 488.4 MiB Apparent size: 488.4 MiB Items: 47
keys: e
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [##############] /backups
137.0 MiB [######### ] /logs
95.6 MiB [###### ] /media
22.0 MiB [# ] /tmp
21.0 MiB [# ] /app
10.7 MiB [ ] /cache
*Total disk usage: 488.4 MiB Apparent size: 488.4 MiB Items: 47
(Both screens show the total 488.4 MiB and 47 items: the hidden file counts in the total, but in the second view its row is hidden.) In ncdu 1.19 hidden files are shown at first, so if you cannot see a dot file, press e.
Units and the keys on the help screen
--si shows sizes in powers of 1000 (MB) instead of 1024 (MiB). The same folder:
$ ncdu --si ~/srv
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
206.6 MB [##############] /backups
143.7 MB [######### ] /logs
100.3 MB [###### ] /media
23.1 MB [# ] /tmp
22.0 MB [# ] /app
11.2 MB [ ] /cache
*Total disk usage: 506.9 MB Apparent size: 506.9 MB Items: 46
(Same folder, 506.9 MB against 483.4 MiB; the bytes are the same.) The help screen is on ? and has three pages, which you switch with 1, 2 and 3: the keys, the meaning of the marks at the left of a row, and an About page. The first page in the lab:
keys: ?
ncdu 1.19 ~ Use the arrow keys to navigate, press ? for help
--- /home/ubuntu/srv -------------------------------------------------------------------------------
197.0 MiB [ 48.6% ##############] /backups
95.6 MiB [ 23.6% ###### ] /media
59.0 MiB [ 14.6% ┌───ncdu help─────────────────1:Keys───2:Format───3:About──┐
22.0 MiB [ 5.4% │ │
21.0 MiB [ 5.2% │ up, k Move cursor up │
10.7 MiB [ 2.6% │ down, j Move cursor down │
│ right/enter Open selected directory │
│ left, <, h Open parent directory │
│ n Sort by name (ascending/descending) │
│ s Sort by size (ascending/descending) │
│ C Sort by items (ascending/descending) │
│ M Sort by mtime (-e flag) │
│ d Delete selected file or directory │
│ t Toggle dirs before files when sorting │
│ -- more -- │
│ Press q to close │
└──────────────────────────────────────────────────────────┘
*Total disk usage: 405.4 MiB Apparent size: 405.4 MiB Items: 45
and the options of the program:
$ ncdu --help
ncdu <options> <directory>
-h,--help This help message
-q Quiet mode, refresh interval 2 seconds
-v,-V,--version Print version
-x Same filesystem
-e Enable extended information
-r Read only
-o FILE Export scanned directory to FILE
-f FILE Import scanned directory from FILE
-0,-1,-2 UI to use when scanning (0=none,2=full ncurses)
--si Use base 10 (SI) prefixes instead of base 2
--exclude PATTERN Exclude files that match PATTERN
-X, --exclude-from FILE Exclude files that match any pattern in FILE
-L, --follow-symlinks Follow symbolic links (excluding directories)
--exclude-caches Exclude directories containing CACHEDIR.TAG
--exclude-kernfs Exclude Linux pseudo filesystems (procfs,sysfs,cgroup,...)
--confirm-quit Confirm quitting ncdu
--color SCHEME Set color scheme (off/dark/dark-bg)
What was not run in the lab
The r key (rescan) was not run. The b shell was only tried at the top folder. The t key changed nothing visible at the top level (only folders there), so its effect in a mixed list was not seen. The detail window with -e (owner, permissions, times) was not opened. Deleting a whole folder, and the "don't ask me again" choice, were not run. The options -L (follow symlinks), -X (patterns from a file), --exclude-caches, --exclude-kernfs, --confirm-quit, --color, -1 and -2 (scan screens) were not run. -x was run only on a folder on a single filesystem. A large disk, millions of files, a slow disk and a scan of / on a real server were not tried (the sample folder has 33 files), so how long a real scan takes is not known from this lab. Scans over SSH were not run, only a saved file read in the same machine. ncdu 2.x and other install routes were not tried. Everything ran in an Ubuntu 24.04 container with ncdu 1.19 from the Ubuntu package.
Common problems and tips
I cannot see a dot file I know is there. In 1.19 hidden files are shown on first view; press e to hide or show them, and look at the item count on the last line.
ncdu says Deletion feature disabled. It was started with -r. Start it without that option.
The numbers differ from du. du rounds sizes up and ncdu shows disk usage with one decimal. Press a to see the apparent size, which is what du --apparent-size counts.
The disk is full but ncdu on / does not add up. Another disk may be mounted inside the folder, or a deleted file may still be open by a program. Use -x to keep to one filesystem, and compare with df. (This lab did not reproduce either case.)
I deleted the wrong thing. There is no undo. Look at the name in the question every time, and use ncdu -r when you only want to look.
Tips. Use -o to save the scan first when you have to scan a busy server, and read the file at your leisure. Start with the biggest folder, then the biggest thing inside it, and use i if the name does not tell you what it is. Use --exclude to leave out what you already know.
