It could be useful to have a small utility to do this cleanup / unreferenced resources report. The main challenge is being able to access all content from the website, in order to locate the resources that are used. What would be the best approach?

- Use an external spider
   -> difficulty to access all content: restricted content, private content for one user

- Use the module export functionality, call it on all active modules
   -> not all modules support export / import

- Use the search index
   -> not all modules support search indexing

- Scan entire database data for urls
   -> problem with data that has been deleted but still in database (such as a 'deleted' flag on the row)

Seems like the best approach would be to scan the entire database data. Thoughts?

The IIS7 SEO toolkit acts as a spider that will browse your website anonymously and follow all links it finds. It will not browse content that is visible only to certain roles or certain users. That may be important or not to you, depending on your website's content. If you have such content, not placed in a specific location, you risk deleting referenced content.

If you scan the entire database content, you may may find links to resources that have been deleted. If you empty the recycle bin, it should help. Other than that, it depends on the modules you are using and if any of these modules do not delete data but instead keep a deleted flag. I don't think there are many modules that actually do this. But it can, and you risk keeping too many resources (but these resources are still referenced, so it may not be a bad idea to keep them).