How to search by time difference

[anmac1789]

Hello, is there a way to search by time difference between the date created and date modified of a file for any combination of dates?

[tuska]

Hi,

I'm sorry, the following is not exactly what you are looking for but maybe it can help you in some way....

Example:
Everything 1.5.0.1304a (x64) - Alpha

Tools -> Options... -> Indexes
[x] Index date created
[x] Index date modified

Search for:

Code: Select all

date-created:!=dm:
-OR-
dm:!=date-created:

See also:
Make a custom property that encompasses two pre-existing properties

_________________________________________________
Windows 10 Pro (x64) Version 21H2 (OS build 19044.1586)
'Everything' 1.5.0.1304a (x64) | Switching from Everything 1.4 to 1.5 | Troubleshooting

[raccoon]

Quoting @void:

Arithmetic on dc: and dm: is on my TODO list.

Date arithmetic is still on my TODO list.

[anmac1789]

Is there a workaround for finding a time difference between two dates? for example what if I convert difference between two dates and times to seconds say for example, from Nov 5, 2019 @ 2 PM to Nov 5, 2019 @ 3 PM = 1 hr = 60 mins= 3,600 seconds or for example, from a given reference date such as Jan 1, 2022 to any other two dates further down the year

[raccoon]

It probably is possible in the current development version, but I don't have a great handle on using the preprocessor verbs to do what I want.

I expect some combination of #eval, #filetime, #dc:, #dm:, and possibly a little #abs:, dropped into a regex:"(...)" backref to create a custom property column. But I'm not quite there yet.

[void]

Please try the Everything 1.5 alpha with the eval: search function:

To find files/folders within a specific difference range, search for:
dm:!=dc: eval:#<:#abs:<$dm:-$dc:>/10000000<3600#>:


dm:!=dc: = find only files/folders where the date modified and date created differ (I assume you are not interested in files/folders with the same date modified and date created)

eval: = evaluate the preprocessor expression and match the file/folder if the result is non-zero.
#<: ... #>: = escape preprocessor functions.
#abs: = calculate the absolute value (make negative numbers positive)
$dm: is replaced with the raw 100-nanosecond date modified timestamp.
$dc: is replaced with the raw 100-nanosecond date created timestamp.
$dm:-$dc: = calculate the difference between date modified and date created.
/10000000 = convert 100-nanosecond FILETIME to seconds
<3600 = match the file/folder if the absolute difference between date modified and date created is less than 3600 seconds (1 hour)



Enable date created indexing for the best performance under Tools -> Options -> Indexes -> Index date created.



Preprocessor Help

[raccoon]

May I make a feature creep suggestion? The ability to dump data to a custom column? Eg:

dm:!=dc: column1:eval:#<:#abs:<$dm:-$dc:>/10000000#>: column1:

dm:!=dc: ... narrow results to items with differing dates
column1:eval:#<:#abs:<$dm:-$dc:>/10000000#>: ... populate a custom column with data but don't narrow results
column1: ... narrow results to items with data in column1

Custom columns would essentially act like variables we can play with to further sort results, detect dupes, or use in other evals and if-checks.

[void]

An eval result column is on my TODO list.
I'm not quite sure what the syntax will be.

Thanks for the suggestion.

[anmac1789]

Please try the Everything 1.5 alpha with the eval: search function:

To find files/folders within a specific difference range, search for:
dm:!=dc: eval:#<:#abs:<$dm:-$dc:>/10000000<3600#>:


dm:!=dc: = find only files/folders where the date modified and date created differ (I assume you are not interested in files/folders with the same date modified and date created)

eval: = evaluate the preprocessor expression and match the file/folder if the result is non-zero.
#<: ... #>: = escape preprocessor functions.
#abs: = calculate the absolute value (make negative numbers positive)
$dm:-$dc: = calculate the difference between date modified and date created.
/10000000 = convert FILETIME to seconds
<3600 = match the file/folder if the absolute difference between date modified and date created is less than 3600 seconds (1 hour)

How do I use this ? like where am i seeing the result from my searches??

[raccoon]

This search query narrows your search results. You will only be shown results of objects whose Date Modified and Date Created are less than 1 hour difference (3600 seconds). If you change the number 3600 to 7200, then more results will be shown to include objects with dates up to 2 hours apart. There is no column, yet, to show you the number for each object.

[anmac1789]

I tried searching for photos which differ by 1-2 seconds, but nothing shows up in the results

[raccoon]

Have you tried broadening your search? You may not have photos that are only 1 or 2 seconds different. Also, the example uses the less-than operator, so less than 1 second is 0 seconds, and it definitely will not return any results for objects with a Date Modified and Date Created delta of 0 seconds, owing to the dm:!=dc: term (not equal; not zero).

[anmac1789]

wait a minute, do we need regex enabled ?

[raccoon]

wait a minute, do we need regex enabled ?

No. Regular Expressions under the Search Menu should be unchecked. You must also be using Everything (1.5a) 1.5.0.1034a. It will say this in the Everything titlebar. If you are not using version 1.5.0.1034a then this will not work.

[anmac1789]

wait a minute, do we need regex enabled ?

No. Regular Expressions under the Search Menu should be unchecked. You must also be using Everything (1.5a) 1.5.0.1034a. It will say this in the Everything titlebar. If you are not using version 1.5.0.1034a then this will not work.

Do i need to enable any special settings for this to work ? I tried changing "3600" to 1 or 2 but it didn't work still...

[raccoon]

Do i need to enable any special settings for this to work ? I tried changing "3600" to 1 or 2 but it didn't work still...

You don't need any special settings other than Options -> Indexes -> "[x]Index date created" and "[x]Index date modified".

I already explained above that a value of "1" will not work in place of "3600", because ''LESS-THAN 1" is zero, and that means the Date Modified and Date Created times would be matching... which is precluded by the statement "dm:!=dc:" (do not match).

A value of "2" means that the Date Modified and Date Created times can be no more, and no less, than 1-second different. You probably do not have any files on your harddrive with only 1 second difference between the DM and DC times.

Try broadening your search to 3600 seconds or 7200 seconds instead. See if that produces results.

[void]

Try comparing the FILETIME (100-nanoseconds resolution):

To find files where the date modified and date created differ and where they differ by no more than 1 second, search for:

dm:!=dc: eval:#<:#abs:<$dm:-$dc:><10000000#>:
10000000 = 1 second



To find files where the date modified and date created differ and where they differ by no more than 2 seconds, search for:
dm:!=dc: eval:#<:#abs:<$dm:-$dc:><20000000#>:
20000000 = 2 seconds


Searching can take a few seconds.
Search status is shown in the status bar.

[anmac1789]

Well theres like over 500 files so spotting which is 2 seconds difference, 3 seconds, 4 seconds difference is kinda hard ill probably have to use excel to find which files are unique in a database ... so i found out that:

541 pics = 2 seconds
574 pics = 3 seconds
586 pics = 4 seconds

Im assuming that for each second its searching 2 seconds AND LESS, 3 seconds AND LESS, 4 seconds AND less...

[raccoon]

If you want 2-seconds-and-less, then you have to change the math operator "<" to "<=" instead.

Referencing the original example given and used:

dm:!=dc: eval:#<:#abs:<$dm:-$dc:>/10000000<2#>: (becomes)
dm:!=dc: eval:#<:#abs:<$dm:-$dc:>/10000000<=2#>:

Referencing @void's most recent example:

dm:!=dc: eval:#<:#abs:<$dm:-$dc:><20000000#>: (becomes)
dm:!=dc: eval:#<:#abs:<$dm:-$dc:><=20000000#>:

[void]

Exporting to an EFU file and opening in Excel might be an option if you are trying to sort by the timestamp difference:

• In Everything, from the File menu, click Export....
• Change save as type to EFU Everything File List.
• Uncheck Export selection only.
• Choose a filename and click Save.
• In Excel, from the Data menu, from the Import External Data submenu, click Import data....
• Select your EFU file from above and click Open.
• Change File origin to 65001 : Unicode (UTF-8).
• Click Next.
• Check Comma.
• Click Next.
• Click Finish.
• Click OK to put the data in the existing worksheet at $A$1.
• Create a new column to calculate the difference between the Date Modified and Date Created column.
  (eg: =C2-D2)
  (Date Modified and Date Created columns are FILETIMEs - 100 nanoseconds since January 1, 1601)
  (divide by 10000000 to convert to seconds)
• Sort by this new column.

[anmac1789]

uhh...i have microsoft 365, it loads something called power data query ??

[anmac1789]

I even tried == for exact match to 1 second, 2 second, nothing shows up and sometimes all the files within a certain subfolder show up...im still not understanding whats happening or how preprocessing works

[void]

I'm not quite sure what you are trying to search for.
Could you please give an example.


Date modified and date created use a very high timestamp resolution. (100-nanoseconds)
It's very unlikely that the timestamps will differ by exactly 1 second.

Are you trying to find files/folders where the displayed date modified time is different to the displayed date created time?

eg: 12:34 != 12:35

or, are you trying to find files/folders where the date modified time is different to the date created time?

eg: 12:34:00.0000000 != 12:34:00.0000001

(while these are different, they will both be displayed as 12:34)



To find files/folders where the displayed date modified time differs to the displayed date created in seconds, search for:
dm:!=dc: eval:#<:$dm:/10000000!=$dc:/10000000#>:

To find files/folders where the displayed date modified time differs to the displayed date created in minutes, search for:
dm:!=dc: eval:#<:$dm:/600000000!=$dc:/600000000#>:

[anmac1789]

Okay so let me give you the full story, I want to see which pictures within "This PC\Galaxy Note8\Phone\WhatsApp\Media\WhatsApp Images" have their date created, date modified differ by 1 second or 2 second or 3 seconds and narrow down the search. Here is a screenshot

everything time diff.png (81.95 KiB) Viewed 10817 times

[void]

Thanks for the information.
You show some files that differ by 25 seconds.

Please try the following search:

dm:!=dc: eval:#<:#abs:<$dm:-$dc:><600000000#>:

This will find files and folders that differ by up to 60 seconds.
Does this search show files that differ by more than 60 seconds?
Is this search missing some files?

[anmac1789]

How do i narrow down the results which only show 60 seconds and nothing else ?

[raccoon]

How do i narrow down the results which only show 60 seconds and nothing else ?

What level of precision? 60 seconds difference plus-or-minus 1 second? 59.999999 seconds through 61.000001 seconds? 59.5 through 60.5 seconds?

[anmac1789]

What i meant was how to narrow down the results to only show those images that havr a exactly 1 second difference ? for example out of 700 images, only show 1 second time difference which could be 20 images, 10 images etc..

[void]

To find files/folders where the date modified and date created timestamps differ by exactly 1 second (10,000,000 100-nanoseconds):

dm:!=dc: eval:#<:#abs:<$dm:-$dc:>==10000000#>:

However, this is unlikely to match anything due to the 100nano-second resolution.



To find files/folders where the displayed date modified and displayed date created timestamps differ by exactly 1 second:

dm:!=dc: eval:#<:#abs:<($dm:/10000000)-($dc:/10000000)>==1#>:

[anmac1789]

okay so it seems to be working so far, 1 second returned 541 results while 2 seconds returned 33 results, 3 seconds returned 12 results