File Search Tool-everything

If you think that my technical article has something to draw from the official post,

Please give me a valuable article to encourage me. Thank you !! My ID: m13666425773 voting address: Medium <web application interface design specifications> PPT version, sent to you. Please take a moment to vote for me for your valuable vote. We can see your vote "User Name" here. Please do not falsely report it! Thank you !! Deadline:

 

 

Recently, a new search software was introduced by experts. As a result, efficient tools have brought about efficient work, and I have learned how it works.

I. Introduction

Name: everything
Category: Hard Disk search
Language: multiple languages (including Chinese)
Official Website: [url] http://xbeta.info/everything-search-tool.htm#/url]
Introduction:
   Everything (Official Website | Chinese homepage | tutorial) is the fastest file search software. The speed is astonishing. Hundreds of thousands of files on a hundred GB hard disk can be indexed within a few seconds. File name search instantly displays the results. It is small and free, supports Chinese, supports regular expressions, and can share search results through HTTP or FTP. If you are not satisfied with the Windows Search Tool, total Commander search, Google Desktop Search, or Baidu hard drive search, if you are using or giving up locate32, it is worth recommending this small file search tool everything, which is free and fast (faster than locate32!

Note the following points:
-Only search for file names, not for file content;
-Only applies to NTFS file systems, not FAT32;
-Perfect support for Chinese characters, but v1.2.x and later must be used

 

Principle:

   According to everything's official website, it can index 1 million files in one minute. It takes only a few seconds to create an index for more than 0.48 million files. Instead of scanning hard disk files one by one, the index directly reads the USN logs of the NTFS file system, since the core principle of everything is built on the underlying mechanism of NTFS, the USN log in the NTFS file system records all the changes the system has made to the files in the NTFS partition. For each volume, NTFS uses the USN log to track information about the files to be added, deleted, and modified. Directly Reading the USN log of the NTFS file system can be very fast, but it can only be processed by file name. If you want to index the content, it's not a second or two seconds. The file format and index information must also be considered. That is to say, if you need to search for all your partitions, all of your partitions need the NTFS format, which is determined by the working principle of the software.

Ii. Principles

USN log:

  USN is the abbreviation of Update Service number journal or change journal. It is a function to record the modified information in the NTFS Volume. When Microsoft launched Windows 2000 that year, when setting up NTFS 5.0, it added some new features and improved the old version of the file system, inviting a reliable Secretary for it, it can monitor the number of changed files and directories in the partition, and record the monitoring object modification time and content. Yes, it is the USN log. When this function is enabled, NTFS uses USN logs to record information about adding, deleting, and modifying files for each NTFS Volume; this is a subset of Version Management SVN functions. It seems that the understanding of operating system implementation is very helpful for the efficiency of application software;

How to enable: Right-click the NTFS partition icon and select "attribute" and select "enable Index Service". This raises the question: If no index service is available, can the software run properly?

View method:

  To learn the abstract information about the change log function, you only need to run the "fsutil USN queryjournal drivedesignator" command on the command line. Here, we need to query the volume of drivedesignator. For example, to view the change log Summary of drive C, run the command "fsutil USN queryjournal C :".

C: \ Documents ents and Settings \ zhuyong> fsutil USN queryjournal C:
USN journal ID : 0x01c8e96d59876854
First USN      : 0x00000000ec280000
Next USN       : 0x00000000f26acf00
Lowest valid USN: 0x0000000000000000
Max USN        : 0x00000fffffff0000
Maximum Size   : 0x0000000006400000
Allocation delta: 0x0000000000040000

 "USN journal ID" is the USN log ID, which is the unique identifier of the change log. "First USN" is the first USN, which is the first USN in the log. "Next USN" is the next USN. In this case, the change log contains the next USN that can be written. "Lowest valid USN" is the least valid USN, which is the lowest valid USN that can be written to change logs. "Max USN" is the maximum USN, which is the maximum USN that can be allocated. "Maximum size" is the maximum value, which is the maximum byte value that can be used in the change log. If the change log exceeds this value, the previous project will be overwritten. "Allocation Delta" indicates the distribution difference, which is the size of the allocated content space that can be added to the end of the log or deleted from the beginning of the log when the change log is full. From this understanding: the implementation of USN logs is a linked list with a limited maximum length and maximum space, so it may be incomplete?

 If we want to know the latest log items of a file, we only need to execute the command "fsutil USN readdate filepath" on the command line, here, filepath is the path and name of the file to view the change information. Command output result:
C: \> fsutil USN readdata c: \ dfatable.txt

Major version  : 0x2
Minor version  : 0x0
Fileref #       : 0x0095000000018bac
Parent fileref #: 0x0005000000000005
USN            : 0x00000000d8bcd058
Time stamp     : 0x0000000000000000 0:00:00 1601-1-1
Reason         : 0x0
Source info    : 0x0
Security ID    : 0x173
File Attributes: 0x20
File Name Length: 0x18
File Name offset: 0x3c
Filename       : Dfatable.txt

  The starting position of the data shows the index number and parent item of the file in the root file index, and the current USN of the file has the file attribute mark. All these latest changes to the file facilitate the direct query of specific system services to determine the modification to the file, which is not only faster, it is also more efficient to use system resources. It seems that using USA can also achieve more complex attribute search..

 

Attachment: Everything tool official: http://xbeta.info/everything-search-tool.htm