Understanding Indexing and USN Journal - MORE questions

[ChrisGreaves]

This new topic builds on one from May last year Understanding Indexing and USN Journal - 3 Questions] Today I am wet behind only one ear!
I have read through that earlier thread and I think that all relevant issues are addressed.
Too I have read the recent topic "BUG: The Remove button is always grayed out in "Index > NTFS" screen of Settings"

“Unless you have specific reason to do so, you should not be running Everything "As Administrator" - use the Everything Service instead.”
I now run as Standard User

“I am still unsure about USN journal; I suspect that for my simple needs I do not need it.”
I now understand that this should be left ON for drives that are to be indexed (for general-purpose users like me)

“Best practice is to run Everything using the same credentials as your Windows login-account. That means enabling 'Everything Service' and unchecking 'Run as administrator'”
Done!

“select your B:-drive and enable 'Include in database'.”
This I did NOT do. Today’s B: drive is actually “T:\Blotter\20230209\” and can be indexed as such; I will always find the files on B: via T:\Blotter\YYYYMMDD\

“Are you running Everything 1.4 or 1.5 or both at the moment? (you posted screenshots from both)”
I have only one Everything64.exe (1.5.0.1337a) on my C: drive.

Untitled.png (73.78 KiB) Viewed 1011 times

I am seeing drives which puzzle me in the Tools, Options, Indexes pane.

(1) All four of my currently established SUBSTituted drives appear in the pane A:, B:, V:, and W:.

None of these four appear in any Result List. (Hooray!)

This is for me only a cosmetic issue, and for me an academic question: Will the drives A, B, V, and W ever disappear from the Tools, Options, Indexes pane? Or will they stay there until my next installation of Everything.exe?

The attached image shows that ONLY drives C and T appear in the results list, and a scroll through the results list confirms this.

Thanks, Chris

[void]

“I am still unsure about USN journal; I suspect that for my simple needs I do not need it.”
I now understand that this should be left ON for drives that are to be indexed (for general-purpose users like me)

Please leave the USN Journal enabled.
The USN Journal is maintained by the NTFS driver. (Not Everything)

The system will typically re-create the USN Journal on next boot.

This is for me only a cosmetic issue, and for me an academic question: Will the drives A, B, V, and W ever disappear from the Tools, Options, Indexes pane? Or will they stay there until my next installation of Everything.exe?

Everything will show all indexed and online NTFS volumes in this list.
This will give you the option to re-include these volumes in the future.

[ChrisGreaves]

Thanks for this response, void.
I am getting there.
Slowly.

Please leave the USN Journal enabled.
The USN Journal is maintained by the NTFS driver. (Not Everything)
The system will typically re-create the USN Journal on next boot.

So the Everything USN Journal setting is really asking Everything to "send a message" to the Windows NTFS asking Windows to maintain a USN Journal for that drive.
It sounds like "(Everything to Windows)Hey! I might want this thing down the road, so please make sure it is going to be available for me (Everything) when/if I decide to use it"?

Everything will show all indexed and online NTFS volumes in this list. This will give you the option to re-include these volumes in the future.

And this means that Everything uses this pane as a shop-window; the list of drives here - especially A, B, V, and W, is Everything telling me-the-user that Everything will be happy to index these (four) drives, as well as the two HDD partitions (C and T) if ever I decide to make use of Everything on those (four) drives?

When I began looking at Tools, Options, Indexes, I somehow (my fault) got the idea that the drives were listed in the Indexes Pane because I had chosen them.
I look back now and see how faulty that idea was.
Of Course Everything has to let me see what is available. "On Display" doesn't mean "Sold!".
:slaps forehead: How could I be so stupid?!!???

[aside: It's void's fault for making Everything so versatile and rich with features )

Again, many thanks, Chris

[NotNull]

And this means that Everything uses this pane as a shop-window; the list of drives here - especially A, B, V, and W, is Everything telling me-the-user that Everything will be happy to index these (four) drives, as well as the two HDD partitions (C and T) if ever I decide to make use of Everything on those (four) drives?

It is a list of drives that Everything is aware of. They are on your system or they are currently being indexed by Everything (or both).


To know which drives are being indexed, select one from the Local volumes list and check the Include in database setting for that specific drive.
Repeat for all other drives.

There is a suggestion on this forum that I really like: to show a checkmark in the Local volumes list that will indicate at a glance if the drive is indexed or not. That would simplify things greatly.

So the Everything USN Journal setting is really asking Everything to "send a message" to the Windows NTFS asking Windows to maintain a USN Journal for that drive.

For NTFS volumes (let's call them drives for convenience), Everything reads 2 system files: the Master File Table (MFT) and the USN Journal.
The MFT is the "address book" of all files and folders on this drive.
The USN Journal is a logbook of all changes made to the files and folders of that drive. It holds about a week worth of changes.
Each NTFS volume has it's own MFT and USN Journal. They are managed by Windows (more or less).

When a drive is being indexed for the very first time, Everything will read the Master File Table all at once and builds it's index from that.
After that, Everything doesn't look at the MFT anymore, but will keep reading the USN Journal to keep up with changes (every second; which seems a lot for humans, but not for computers)

When you don't run Everything for a month (highly hypothetical ), Everything will notice that the USN Journal is no longer holding the needed entries (remember: about a week worth of changes in the USN Journal) and Everything will fall back to building the index for this drive from scratch. From -- you probably guessed it already -- the Master File Table.


Reading the MFT and USN Journal is a very fast way to build an index and keep it up-to-date in real-time (minus 1 second ..)

[ChrisGreaves]

It is a list of drives that Everything is aware of. They are on your system or they are currently being indexed by Everything (or both).

There is a suggestion on this forum that I really like: to show a checkmark in the Local volumes list that will indicate at a glance if the drive is indexed or not. That would simplify things greatly.

Thank you NotNull for all of this. My understanding grows day by day!
Cheers, Chris