01What it does, and what it doesn't
Be clear on the division of labour before you start, because it saves a lot of confusion. DepotDownloader fetches the raw shipped files exactly as they exist in the depot — and games ship most of their assets packed into container formats: Unity .assets/.resS bundles, Unreal .pak/.utoc/.ucas, Valve .vpk, and countless bespoke archives. DepotDownloader does not open any of those. It is the tool that gets you the files; turning a .pak into viewable models and textures is a separate program (section 05).
What makes it the right first step anyway is two superpowers a plain install doesn't give you:
- Any historical build. Point
-manifestat an old manifest ID and you get that exact past version's files — so you can datamine what a game looked like three patches ago, not just today. The Steam client can't do this; it's the same edge that makes DepotDownloader a downgrade tool. - Inspection without downloading.
-manifest-onlyhands you the full file list — names, sizes, hashes — for pennies of bandwidth, so you can decide what's worth pulling before pulling anything. That's the next section.
The whole datamining pipeline, end to end, is: SteamDB (find the app, depot and manifest IDs) → DepotDownloader (recon, then surgical pull) → an engine extractor (unpack the containers). Let's walk the middle.
02Recon with -manifest-only
The mistake I made first, years ago, was pulling a whole depot just to look at one file — never start a datamining session by downloading a whole depot blind. Start by reading its contents. -manifest-only downloads a human-readable listing instead of any game data:
$ ./DepotDownloader -app 730 -depot 2347770 -manifest ... -manifest-onlyIt writes a file named manifest_<depotid>_<manifestid>.txt into the output folder. Each line is one file, in the form:
Size Chunks File SHA Flags NameSo you get every path, its byte size, and its SHA-1 hash without spending the bandwidth to download it. Read that list, find the handful of files you actually care about — the localization table, the texture pack, that one config — and only then decide what to fetch. For deep coverage of this and the filelist below, the filelists & -manifest-only reference goes further; this guide is the datamining-shaped use of them.
03Surgical pulls with -filelist
Once you know what you want, -filelist pulls only those files instead of the whole depot. You pass it a text file, one pattern per line:
$ ./DepotDownloader -app 730 -depot 2347770 -filelist wanted.txtA plain line in the filelist is an exact, case-insensitive, full-path match — not a substring. textures on its own matches nothing; it has to be the complete path. For anything fuzzier, prefix the line with regex: and it's treated as a regular expression. In practice you'll use regex: for almost everything:
regex:.*\.pak$
regex:^game/citadel/.*\.vtex_c$
regex:.*localization.*\.txt$That pulls every .pak, every Source 2 texture under one folder, and any localization text file — while leaving the multi-gigabyte rest of the depot on Steam's servers.
Combine this with -depot to scope down further. Games split content across depots — binaries in one, assets in another, HD textures and per-language data in their own — and SteamDB's depot list shows the breakdown. If all you want is the asset depot, name just that depot and skip the executables entirely. Between the right depot and a tight regex, a datamining pull is often a few megabytes out of a hundred-gigabyte game.
04The patch diff — what changed in an update
One of the highest-value datamining moves is finding exactly which files a patch touched, so you can ignore the 99% that didn't move and look only at what's new. DepotDownloader doesn't have a built-in "diff two builds" command, but the manual workflow is simple and reliable because of those manifest text files:
- Get the old and new manifest IDs for the depot from SteamDB's manifest history.
- Run
-manifest-onlytwice, once for each — you'll havemanifest_<depot>_<old>.txtandmanifest_<depot>_<new>.txt. - Run any text diff over the two files. Because each line carries a size and a SHA-1, a changed file shows up as a differing hash, and added or removed files show as added or removed lines.
- Take the changed paths, drop them into a
-filelist, and pull only those from the new build.
That's the whole "datamine the patch" loop, and it costs almost nothing until the final step. (Note: steamctl, the Python sibling, has a depot diff command — but it compares one manifest against your local files as an integrity check, not one build against another, so it's not the tool for this particular job.)
05Unpacking: the downstream tools
Now the part DepotDownloader hands off. Once you have the packed files, you open them with an engine-specific extractor. The standard ones, by engine:
| Engine | Files | Tool |
|---|---|---|
| Unity | .assets, .resS, bundles | AssetRipper (actively maintained); AssetStudio (classic, but the original is unmaintained — use a current community fork) |
| Unreal | .pak, .utoc, .ucas | FModel (current standard, built on CUE4Parse); UE Viewer / umodel (great, but lags on the newest UE5) |
| Source / Source 2 | .vpk, *_c | Source2Viewer (VRF) for Source 2 games; VPKEdit or the older GCFScape for VPK browsing |
| Anything else | proprietary archives | QuickBMS with a per-game script |
None of these are affiliated with the engines or with this project — they're community tools, and which one fits depends entirely on the game's engine and version. The honest note: a brand-new release on a bleeding-edge engine version sometimes outruns the extractors for a while, so if a tool can't open your files yet, the engine version may simply be too new.
06Mining responsibly
Datamining sits in a genuine grey area, and the difference between the respected kind and the kind that gets communities locked down is mostly about restraint. A few principles I'd stand behind:
- Inspect what you own. DepotDownloader enforces Steam's ownership rules — it pulls content your account is licensed for, and it does not hand you unreleased builds, other people's content, or password-protected branches you don't have the key to. That boundary is a feature, not an obstacle to route around — and it's one I won't document a way past. This guide is about looking inside games you have, full stop.
- Respect embargoes and spoilers. Finding unreleased characters, story beats or unannounced features in the files doesn't mean it's costless to post them. Leaking unreleased content can genuinely harm a game's launch and the people who made it; sit on spoilers, and honour developers who explicitly ask their community not to datamine.
- Disclose security findings responsibly. If your poking around surfaces something security-sensitive — exposed keys, an exploit — report it privately to the developer first, the same as any responsible disclosure, rather than dropping it publicly.
- It's for inspection, not redistribution. Extracting assets to study, mod, or document is the norm this guide supports; re-hosting a game's art or audio as your own is a copyright matter, not a datamining one.
Used this way, datamining is how a lot of the best modding, wikis and preservation work actually gets done — and DepotDownloader's part in it is the clean, honest one: get the exact files of a build you own, as cheaply as possible, and leave the rest alone. Pair this with the filelist reference for the flag detail and archiving your library for keeping the builds you mine.