How GDriveKit works
A technical overview of how GDriveKit detects and groups duplicate files using MD5 checksums from the Google Drive API.
Content-based deduplication
GDriveKit does not match files by name or size alone - it uses the MD5 checksum that Google Drive computes and stores for every file. Two files with the same MD5 are byte-for-byte identical, regardless of their names, locations, or modification dates.
This means GDriveKit correctly identifies:
- Files renamed after copying (
report.pdfandreport-copy.pdf) - Files moved to different folders (
/archive/photo.jpgand/photos/photo.jpg) - Files uploaded multiple times with the same content
And it avoids false positives: two files named notes.txt with different content will never be grouped together.
What data GDriveKit reads
GDriveKit uses the Google Drive API to fetch file metadata only. It does not download file content. The fields it reads per file are:
| Field | Used for |
|---|---|
id | Unique identifier for deletion |
name | Display in results |
size | Calculate wasted space |
mimeType | Filter out Google Docs native formats |
md5Checksum | Grouping duplicates |
modifiedTime | Picking the "keep" candidate |
parents | Showing the folder path |
ownedByMe | Preventing deletion of files you don't own |
Google Docs, Sheets, Slides, and Forms do not have an MD5 checksum (they are not binary files). GDriveKit skips these automatically.
Grouping algorithm
- Fetch all file metadata matching the scan scope
- Build a map:
md5 → list of files - Discard any MD5 with only one file (no duplicate)
- For each group, sort by
modifiedTimedescending - the most recently modified file is the "keep" candidate - Mark all other files in the group as duplicates
Scope limitations
- Google Docs native files (Docs, Sheets, Slides, Drawings): not scanned - no MD5
- Files you don't own in "Shared with me": flagged read-only - GDriveKit will not offer to delete them
- Files in Team Drives / Shared Drives: requires elevated Drive API scopes; not yet supported in beta
Deletion model
GDriveKit uses files.trash from the Google Drive API, not files.delete. This means:
- Deleted files go to Google Drive Trash, not permanent deletion
- You have 30 days to restore from Trash in Google Drive
- To permanently reclaim storage, you must empty Trash from Google Drive directly
GDriveKit never calls files.delete (permanent, unrecoverable). This is intentional.
Privacy
- Your file content is never downloaded or sent to GKit servers
- Only file metadata (the fields listed above) passes through GKit during a scan
- Scan results are stored in your GKit account database for history access
- OAuth tokens are encrypted at rest and scoped to the minimum required permissions