How "Everything" doesn't miss changes when not running

[Chillance]

Hi!

First off, awesome program!

Now, to my question. In the FAQ, you can find:

1.7 Does "Everything" miss changes made to the file system if it is not running?

No, "Everything" can be closed and restarted without missing changes made to the file system (even across system restarts).
"Everything" updates the database when it is started.

What I'm wondering is HOW this is possible? Mainly because it seems to go really fast, and not rescanning the whole drive at upstart...
I guess you use ReadDirectoryChangesW to monitor changes when running, but how to get file changes since the program was last running is what I want to know!

Thanks,
Chillance

[David]

"Everything" does not use ReadDirectoryChangesW.
Instead it reads file name changes from the NTFS USN Change Journal.

The USN Change Journal is a log of file name changes maintained by the NTFS driver.

When you run "Everything" it updates its database with this USN Change Journal.

While "Everything" is running it will continue to monitor the USN Change Journal for file name changes.

See http://en.wikipedia.org/wiki/Change_Journal for more information.

[cacamama]

What happens when creating a fresh database? How is it that it's so fast at indexing so many files?

[David]

The "Everything" database is built directly from the Master File Table (MFT).

This makes "Everything" limited to NTFS only at this stage..

[Chillance]

Awesome stuff man! Thanks for the info!