What is "recent"

[ChrisGreaves]

A list of all localization strings by ID.

Please and thank you: What is the difference between

Code: Select all

the Function recentchange: "Search for files and folders with the specified recently changed date."
and 
the Function Datemodified: "Search for files and folders with the specified date modified."

As far as I can see "recent" is undefined in Everything.
Thanks, Chris

[void]

Moved from Localization String IDs.

Everything has a recently changed database.

Recent changes are changes since Everything was started (USN Journals can also be loaded into your recent change database)

Not all files/folders will have a "date recently changed".

Date recently change is updated for any change to the index entry.
This includes renaming the file/folder.



Date Modified is the timestamp of the last content change to the file/folder.
All files/folders will have a date modified timestamp.




Recent changes was added before date modified indexing existed in Everything.
It was useful for finding recently modified files.

With date modified indexing, recent changes is no longer relevant.
You can now sort all files/folders by date modified instantly.
Recent changes can still be useful to find recent renames/attribute-changes/data-stream-changes/etc.., as these changes do not update the date modified timestamp.

Recent changes will be disabled by default in Everything 1.5.

[ChrisGreaves]

Not all files/folders will have a "date recently changed".
Recent changes can still be useful to find recent renames/attribute-changes/data-stream-changes/etc.., as these changes do not update the date modified timestamp.

Makes sense now, thank you.
(I always like to fed back to check that I have understood)

So the message to the beginner (me!) is:-
Date Modified has the meaning it does in Windows Explorer: The file contents are changed
Recent Changes means that "Everything has made or detected changes in the file other than any change in contents"

But the terms may not be exclusive "Contents" vs. "Descriptor"?

I suspect that still, both functions are useful, but that Date Modified will be, by far, the more used by us users.
Thanks, Chris

[raccoon]

You will find that the rc timestamp column can be useful in Everything for sorting and watching for changes in realtime. A lot of software will modify a file without augmenting its dm timestamp, but Everything can see through this deception. You might copy a file and the dm stays the same, but Everything will show the copied file with a new rc timestamp.

[void]

Changing the file content will also update the "date recently changed".

Most of the time, "date modified" and "date recently changed" will be the same.
"date recently changed" might be more recent if the index entry is changed, but the file contents remain the same.

There's also the "Date Changed" property in Everything 1.5, which is the timestamp of the last NTFS Master File Table (MFT) entry change.
Every single file/folder on an NTFS volume will have a "Date Changed" value.

"Date Recently Changed" will be very similar to "Date Changed".
Except, "Date Recently Changed" is only stored for files/folders recently changed.
"Date Recently Changed" = index entry change in Everything. (for files changed since Everything was started)
"Date Changed" = MFT entry change on the NTFS volume.

"Date Changed" will include changes that Everything ignores. (such as updating alternate data streams, object id changes, security descriptor changes, etc..)

[raccoon]

I didn't know about Date Changed. Thanks! Any other NTFS entries I might not know about?

If Date Changed is stored in $NTFS, why does it propose to take hours or days to index this property in all my files, instead of the normal 30 seconds?

[ChrisGreaves]

* Changing the file content will also update the "date recently changed".
* Most of the time, "date modified" and "date recently changed" will be the same.
* "date recently changed" might be more recent if the index entry is changed, but the file contents remain the same.
* There's also the "Date Changed" property in Everything 1.5, which is the timestamp of the last NTFS Master File Table (MFT) entry change.
* Every single file/folder on an NTFS volume will have a "Date Changed" value.
* "Date Recently Changed" = index entry change in Everything. (for files changed since Everything was started)
* "Date Changed" = MFT entry change on the NTFS volume.
* "Date Changed" will include changes that Everything ignores. (such as updating alternate data streams, object id changes, security descriptor changes, etc..)

Phew! Let me digest all of the statements that I have starred.

I don't monitor changes in Real Time, but "recent" might be useful if I was trying to ferret out weird behavious in Windows; is that correct?
I could sit (or have a program sit for me) like a cat waiting for a mouse, then pounce when a Recent Change was reported on a C:\Windows file. That would signal that Windows had decided to effect some sort of recognizable change in that part of my system?

I think that for the Beginner/User they/we will go on using Date Modified to learn about what we think of as "files on which I am currently working". To that end Recent Changes would be a misleading signal.
Thanks, Chris

[void]

Any other NTFS entries I might not know about?

Most properties under result list column header -> Add columns with a type of "File" are NTFS properties.

If Date Changed is stored in $NTFS, why does it propose to take hours or days to index this property in all my files, instead of the normal 30 seconds?

Everything will lookup the Date Changed from the MFT by filename for each file, which is not too efficient.
I will consider an option to index the date changed like date modified.

I don't monitor changes in Real Time, but "recent" might be useful if I was trying to ferret out weird behavious in Windows; is that correct?

The Index Journal replaces "date recently changed" in Everything 1.5.
"Date Changed" might be useful to find older changes.

I could sit (or have a program sit for me) like a cat waiting for a mouse, then pounce when a Recent Change was reported on a C:\Windows file. That would signal that Windows had decided to effect some sort of recognizable change in that part of my system?

A task scheduler is on my TODO list.
For example, run an action when a file is changed.

[raccoon]

If Date Changed is stored in $NTFS, why does it propose to take hours or days to index this property in all my files, instead of the normal 30 seconds?

Everything will lookup the Date Changed from the MFT by filename for each file, which is not too efficient.
I will consider an option to index the date changed like date modified.

I wonder if you could add a hook to the Fast NTFS Scan loop for all extra NTFS property requests, to affect all "File" category NTFS properties, Alternate-Data-Streams included. This way you don't have to add them one-by-one only when there's enough popular demand.