FileLens

Right click any file on Windows. Get instant analysis: hashes, strings, hex, PE internals, metadata. All in a compact popup that disappears when you click away.

---

Download

Download FileLens for Windows

Unzip and run filelens.exe --register. No installer, no admin rights, nothing else needed.

Requires Windows 10 or 11.

---

How it works

1. Run filelens.exe once. It registers itself in your right-click menu
2. Right-click any file in Explorer -> Inspect with FileLens
3. A dark popup appears at your cursor with tabs for everything you need
4. Click away and it's gone

That's it. No window management, no app to keep open.

To keep it open: click the pin button (small square next to the X). Pinned windows stay until you close them manually.

To remove from right-click menu: filelens.exe --unregister

Windows 11 note: the entry appears under Show more options (Shift+F10 opens it directly). Integrating with the new Win11 context menu requires a packaged MSIX install and is not currently supported.

---

What it shows

Info — size, timestamps, entropy score with a per-block entropy graph, magic bytes, type detection (PE, ELF, Mach-O, archives, media, and more), extension mismatch warnings. For PE files: architecture, subsystem, imports/exports count, validated Authenticode signature with signer name (WinVerifyTrust), exploit mitigations (ASLR/DEP/CFG/HighEntropyVA), overlay detection, compile timestamp, and version resources (CompanyName, FileVersion, OriginalFilename...).

Hashes — MD5, SHA-1, SHA-256, BLAKE3, CRC32 computed in a single pass. Full width selectable fields, copy buttons, plus one-click VirusTotal / web lookup (only the hash is sent, never the file).

Strings — every printable ASCII and UTF-16 string in the file. Filter by length, search live, sort by offset/length/category/alphabetical, copy all filtered results. Category pills color-code URLs, file paths, registry keys, IPs, and emails. Dedup toggle collapses repeats with count badges.

PE — imphash, section table with per-section entropy and flags, imports grouped by DLL with function names, exports list. Only appears for EXE/DLL files.

Hex — full-file hex dump (virtualized, up to 16 MB shown). Goto offset, hex/text search, and a data inspector that decodes the selected bytes as integers, floats, and timestamps. Zero bytes dimmed, ASCII sidebar.

Zip — archive contents with per-entry size, packed size, compression ratio, and encrypted-entry flagging. Appears for ZIP-based files (zip, docx, jar, apk...).

Meta — PDF properties, Office doc metadata (DOCX/XLSX/PPTX, properly decompressed), JPEG EXIF, PNG chunk data. Only appears for supported formats.

ADS — NTFS alternate data streams and Mark-of-the-Web: zone, referrer URL, and host URL for downloaded files. Only appears when streams exist.

Folders — right-click a folder to get file/folder counts, total size, the largest files, and a size breakdown by extension.

Tabs are smart — you only see what's relevant to the file you're inspecting. Files are memory-mapped and read once, so inspecting multi-GB files is fine. Click the gear in the title bar to configure the default tab, which hashes to compute, and string defaults.

---

Build from source

# Requires Rust stable + MSVC build tools
cargo build --release

Output: target/release/filelens.exe

Optional: place an icon at assets/filelens.ico and it gets embedded into the exe automatically.

---

Adding a new tab

1. Create src/analysis/yourtab.rs implementing the AnalysisTab trait
2. Accept Arc<FileData> (the shared, memory-mapped file contents) and the Arc<AtomicBool> cancel flag in your constructor
3. Add pub mod yourtab; to src/analysis/mod.rs
4. Add Box::new(yourtab::YourTab::new(data.clone(), cancel.clone())) to create_tabs_for() in mod.rs
5. Optionally override relevant_for(&self, path) -> bool to conditionally show the tab

The AnalysisTab trait

pub trait AnalysisTab: Send {
    fn name(&self) -> &str;                                    // Tab label
    fn run(&mut self, path: &Path);                            // Start background work
    fn ui(&mut self, ui: &mut egui::Ui, ctx: &egui::Context); // Draw tab contents
    fn is_loading(&self) -> bool;                              // Show spinner in tab bar
    fn relevant_for(&self, _path: &Path) -> bool { true }     // Show/hide tab per file
}

---

Support

FileLens is free and open source. If it's been useful, a tip is always appreciated but never expected.

---

License

MIT — free to use, modify, and distribute.