Using Everything

[Edwardo]

V. 1.2.1.371. After a targeted hijacked last month taking a few steps to watch what's going on behind the scenes. Everything is very useful in this effort logging Access and Modified dates. Without Everything I would have been unable to confirm the attack.

Everything showed all 50,000 files an the C:\ drive had been accessed in an uninterrupted single pass in the space of 3 hours and if I remember correctly I'm sure noticed the D:\ drive had been accessed as well. Since that time I have not seen a single D:\ file entry in Everything so not sure what's going on there. I know D:\ files showed changed dates an hour after the intrusion.

/ Will it be possible in future to include all drives in searches?

/ When Everything is closed then reopened it takes a substantial number of precious seconds to sort "Last Access". I usually smoke a cigarette to calm my nerves during the wait reflecting on how Everything excels in other areas. May I suggest an option to maintain a descending sort on this field, so Everything can open pre-sorted if one chooses on the "Last Access" column without a moment's delay and even include "Last Modified" to sort also with blistering speed as does "Name" on opening, virtually instantly.

/ A very useful option would be to combine groups of extensions, say, .png + .bmp + .tiff + .docx + .xls etc together in Saved Search files so they can be used repeatedly to find assorted files in one blindingly fast swoop. This method could be refined to include a Date Selector to retrieve only the last 1 or 2 days worth of files in a blink.

On a point of interest using Everything to delete Word and Excel files I discovered the original file name is deleted and sent to Recycler. However, Everything renames this file to, say, "Dc200" which on further deletions is re-renamed Dc201, Dc202 etc, under an S-1-5 identity in the Recycler from where it's restorable, a Windows action I think. Useful to know. Multiple deletions can eventually get rid of the Dc**... files (and sometimes not, very stubborn) and still, are they archived elsewhere? Probably as they still show up in the Recent folder. A bit of a mystery. In effect, you think you've deleted files but in fact, have not.


My compliments to you David.

Edwardo

[vsub]

/ Would it be possible in future to include all drives in searches?

Isn't that Everything can do?

/ If Everything hasn't been used for a few hours it takes about 60-80 seconds to sort "Last Access". May I suggest an option to maintain a descending sort on this field, so Everything opens pre-sorted on this field without delay.

There was similar thread before about forcing certain sort mode\order but I don't remember where it was

/ Another useful option would be to search for groups of extensions, say, .png + .bmp + .tiff ++ etc. The concern is that malicious hackers will plant unwanted files on the computer.

ext:<list> Search for files with a matching extension in the specified semi-colon delimited extension list.
ext:png;bmp;tif

[void]

Will it be possible in future to include all drives in searches?

While you will get the best performance with NTFS volumes, Everything can also index any non-ntfs volume.

When Everything is closed then reopened it takes a substantial number of precious seconds to sort "Last Access". I usually smoke a cigarette to calm my nerves during the wait reflecting on how Everything excels in other areas. May I suggest an option to maintain a descending sort on this field, so Everything can open pre-sorted if one chooses on the "Last Access" column without a moment's delay and even include "Last Modified" to sort also with blistering speed as does "Name" on opening, virtually instantly.

Unfortunately, Everything does not index Last Access dates. This information is cached, slowly, and also free'd when closing the search window.
I hope to improve performance by adding the option to index this information in a future release.

[therube]

> Since that time I have not seen a single D:\ file entry in Everything

Checked, Everything | Options | Indexes -> NTFS ?

> Will it be possible in future to include all drives in searches?

It should be, currently.

> combine groups of extensions, say, .png + .bmp + .tiff + .docx + .xls etc together in Saved Search

You could add (?) or modify filters.
Otherwise, maybe the Bookmarks function could help?

> the original file name is deleted and sent to Recycler. However, Everything renames this file to, say, "Dc200"

That has nothing to do with Everything, that is how "Recycler" stores its entries.
If you open the Recycle Bin, it shows the original file names rather then the Dc### names that you may otherwise see.

[Edwardo]

vsub, ext:<list> working, thank you.

Void, thanks for the link. On v.1.2.1.371 “Last Access” field was available, not on 1.3.2.649b.
Any way to include “Last Access”, it doesn’t show up on the list

therube, removable drive searches working, and now saving groups of extensions in Bookmarks as per vsub’s routine, thank you.

Excellent
Edwardo

[void]

“Date Last Accessed" will be back in the next beta update (It was removed in 1.3).

[Edwardo]

“Date Last Accessed" will be back in the next beta update (It was removed in 1.3).

I'm going to test if both 1.2.1.371 & 1.3.2.649b will work side by side because, "Last Date Accessed" is absolutely essential to monitor unauthorized interlopers. One can 'scatter' a number of sleeper files across the disk with enticing names and monitor the actions of vile malefactors with intent.

The return of "Last Date Accessed" will be hugely appreciated.

Your program, Khun void, is a work of art.

Best wishes from Bangkok.

[void]

To run Everything 1.2 and 1.3 at the same time, please use the -instance command line option

For example, run Everything 1.3.2.649b in its own instance:

Code: Select all

Everything-1.3.2.649b -instance beta

[Edwardo]

To run Everything 1.2 and 1.3 at the same time, please use the -instance command line option

For example, run Everything 1.3.2.649b in its own instance:

Code: Select all

Everything-1.3.2.649b -instance beta

Afraid that level of coding is slightly beyond my ability at this point, many thanks anyway.

Is the next beta scheduled?

[void]

I hope to release an update within a couple weeks.

[Edwardo]

I hope to release an update within a couple weeks.

Perfect.

"I always think everything's a trap, which is why I'm still alive".
- Prince Humperdink.