Using WinDirStat For Tech Support And Forensic Examination. Please take note that as you hover over the colored blocks, that the paths of the directories and files are visible. This may have forensic value as well when you are ascertaining the legitimacy of a file.

By the by, here are all of the attributes for a file:

R = READONLY
H = HIDDEN
S = SYSTEM
A = ARCHIVE
C = COMPRESSED
N = NOT INDEXED
L = Reparse  Points
O = OFFLINE
P = Sparse File
I = Not content indexed
T = TEMPORARY
E = ENCRYPTED

Also please pardon my German pronunciation, as with: "in die städte gehen" – go into town ;)