What Is an Everything Search Program?
An Everything search program is a desktop file-search utility that indexes every file and folder on a Windows system by name and returns results instantaneously as you type — typically within milliseconds, regardless of how many files are stored on the drive. The defining characteristic is speed: rather than scanning the disk at query time, the program pre-builds and maintains a lightweight index, then filters that index in real time as characters are entered into the search box.
The most widely known implementation is Everything, developed by David Carpenter and distributed free of charge by his company voidtools. The program has become the canonical example of the category, to the point where many users treat the product name and the category name as synonymous. Other tools — such as Listary, UltraSearch, and DocFetcher — share some characteristics but differ in scope, indexing strategy, or target use case.
Why Windows Needs a Dedicated File-Search Tool
Windows includes a built-in search facility, but it has well-documented limitations that make a dedicated tool valuable for most users.
- Windows Search indexes selectively. By default it covers only libraries, the Start Menu, and user-designated folders. Files outside those locations — external drives, network shares, non-standard directories — are invisible to it unless manually added to the index scope.
- Windows Search is slow to update. The indexer runs as a background service and can take minutes to hours to reflect newly created or moved files, particularly after large batch operations.
- Query latency is noticeable. On mechanical hard drives or systems under load, Windows Search can take several seconds to return results, making iterative searching frustrating.
- Resource consumption is high. The Windows Search service (SearchIndexer.exe) maintains a large index database and can consume significant CPU and disk I/O during indexing passes.
Everything and similar programs solve these problems by taking a fundamentally different approach to both what they index and how they store and query that index.
How an Everything Search Program Works: The Technical Mechanism
Understanding why Everything is fast requires understanding the specific data source it uses and how it structures queries against that data.
The NTFS Master File Table
On any drive formatted with the NTFS file system — the default for Windows system drives since Windows XP — the operating system maintains a hidden system file called the Master File Table (MFT). The MFT is a structured database that records metadata for every file and directory on the volume: name, size, timestamps, attributes, and the physical location of data on disk. Every file that exists on an NTFS volume has at least one corresponding record in the MFT.
Everything reads the MFT directly, bypassing the normal file-system API calls that most applications use. This is why initial indexing of a drive with hundreds of thousands of files takes only a few seconds rather than minutes: the program is reading a compact, structured database rather than recursively traversing directory trees. A full MFT for a drive containing 500,000 files typically occupies only a few hundred megabytes on disk, but Everything extracts only file names and paths — the resulting in-memory index is dramatically smaller, often just 50–80 MB of RAM for the same file count.
Real-Time Change Notification via USN Journal
Keeping the index current is just as important as building it quickly. Everything monitors the NTFS Update Sequence Number (USN) Change Journal, a log maintained by the operating system that records every file-system change — creations, deletions, renames, and moves — as they happen. When a file is created or renamed, the change journal entry is processed within milliseconds, and the in-memory index is updated immediately. This means the index is effectively always current without any polling or periodic re-scan.
This architecture is fundamentally different from Windows Search, which uses a file-system watcher that can miss events under load, and from older search tools that scheduled periodic full re-indexes.
In-Memory Index and Query Execution
Everything stores its index in RAM. The index is a sorted list of file paths, not a full-text document index. When a user types a query, the program performs a case-insensitive substring match (or, optionally, a regular expression or wildcard match) against this in-memory list. Modern CPUs can scan millions of short strings per second, which is why results appear before the user finishes typing even on systems with millions of indexed files.
The program does not index file contents by default. It indexes file and folder names and their full paths. This is a deliberate design choice: content indexing requires reading every byte of every file, which is slow and storage-intensive. For name-based searches — which account for the vast majority of everyday "where did I put that file?" queries — name indexing is sufficient and vastly faster.
Limitations of the MFT Approach
The MFT-based approach has specific constraints users should understand:
- NTFS only. FAT32 and exFAT volumes (common on USB drives and SD cards) have no MFT. Everything falls back to a conventional folder enumeration for these volumes, which is slower and not updated via the change journal.
- Administrator access required for initial index. Reading the MFT directly requires elevated privileges on some system configurations. Everything requests the necessary access at install time.
- Network drives require a different mechanism. UNC paths and mapped network drives do not expose an MFT to the local machine. Everything supports indexing network shares via folder enumeration or by running an Everything service instance on the remote machine.
- No content search by default. Finding a file whose name you do not remember, but whose contents you know, requires a different tool or Everything's optional content-search plugin.
Key Capabilities That Define the Category
A program qualifies as an "Everything-style" search tool when it offers most or all of the following characteristics:
| Capability | Description | Everything (voidtools) |
|---|---|---|
| Instant results | Results appear as each character is typed, with no perceptible delay | Yes |
| Full-volume indexing | All files on all connected NTFS volumes are indexed, not just selected folders | Yes |
| Real-time index updates | New, moved, renamed, and deleted files are reflected immediately | Yes (via USN journal) |
| Low resource footprint | Minimal RAM and CPU usage during idle operation | Yes (~50–80 MB RAM typical) |
| Advanced query syntax | Boolean operators, wildcards, regex, size/date filters, file-type filters | Yes |
| Portable or installable | Can run without installation for use on multiple machines | Yes (portable version available) |
| API or integration support | Allows other applications to query the index programmatically | Yes (ETP, HTTP, SDK) |
Why Speed Matters: The Practical Impact
The difference between a 200-millisecond response and a 3-second response may seem trivial in isolation, but it changes how people work. Research in human-computer interaction consistently shows that response times below 100–200 milliseconds feel instantaneous and allow users to maintain a continuous flow of thought. Response times above 1 second interrupt that flow and cause users to shift attention.
In practice, this means that users of instant file-search tools search more often and more iteratively. Instead of navigating through folder hierarchies — a strategy adopted as a workaround for slow search — they type partial file names and refine queries in real time. This changes file-management behavior: users spend less time maintaining elaborate folder structures because they know they can find any file by name in under a second.
For power users, developers, and system administrators managing machines with hundreds of thousands of files, the difference is even more pronounced. Finding a specific configuration file buried in a deep directory tree, locating all instances of a DLL across a system, or auditing which files were modified in the last hour — these tasks take seconds with Everything and minutes without it.
Everything Search Programs vs. Related Tools
It is worth distinguishing Everything-style programs from adjacent categories that are sometimes confused with them:
- Full-text search tools (DocFetcher, Recoll, Windows Search with content indexing enabled) index the contents of documents, not just their names. They answer "find files containing the phrase X" rather than "find files named X." They are slower to build and query but answer a different class of question.
- Application launchers (Launchy, Wox, PowerToys Run) use file-name search as one feature among many, including launching applications, performing calculations, and querying web services. Some integrate with Everything's index directly.
- Cloud search tools (Windows Search with OneDrive integration, Google Drive search) index files stored in cloud services and may not cover local files comprehensively.
- Duplicate finders and file auditors scan the file system for specific conditions (duplicate content, large files, old files) but do not provide general-purpose interactive search.
Everything-style programs occupy a specific and well-defined niche: fast, comprehensive, name-based, real-time local file search. They do not replace full-text search tools; they complement them.
How to Install and Configure Everything Search for Maximum Performance
Download the installer from voidtools.com, run it with default settings for most users, then let the NTFS index build (usually under 30 seconds on a typical drive). Everything is ready to use the moment indexing finishes — no reboot required.
Choosing the Right Version Before You Download
Voidtools ships four distinct packages. Picking the wrong one wastes time and causes confusion, so match your situation before clicking anything.
| Version | Best For | Key Difference |
|---|---|---|
| Everything 1.4.1 (stable) | Most users, production machines | Fully tested, widest compatibility |
| Everything 1.5a (alpha) | Power users wanting new features | Content indexing, bookmarks, faster filters — but may have bugs |
| Everything Lite | Restricted corporate environments | No service installation; runs fully in user space |
| Portable (.zip) | USB drives, shared PCs, no-install policies | Leaves no registry entries; settings stored in the program folder |
The x64 installer is preferred on any 64-bit Windows machine because it handles very large file databases without memory constraints. The x86 build works on 32-bit Windows but is increasingly rare to need.
Step-by-Step Installation
- Go to voidtools.com and click the Download button for the stable installer matching your architecture (x64 for almost everyone).
- Run the installer as Administrator. This allows Everything to install its Windows service, which is what gives it instant, always-current indexing. Without admin rights, you must use the Lite version with reduced capability.
- Accept the default install path unless your system drive is nearly full. The program itself is under 5 MB; the database grows proportionally to your file count but rarely exceeds 50 MB even on drives with hundreds of thousands of files.
- Leave "Start Everything on system startup" checked. Everything uses negligible RAM (typically 5–15 MB) and near-zero CPU at idle. Disabling startup to save resources defeats the purpose of the tool.
- Click Install and wait for the NTFS journal scan to complete. A progress bar appears in the main window. On an SSD with 500,000 files, this takes roughly 10–20 seconds. On a spinning disk with millions of files, allow up to two minutes.
- Type any filename fragment immediately. Results appear as you type. If you see files populating in real time, installation succeeded.
First-Configuration Checklist After Installation
Default settings work for casual use, but five minutes of configuration transforms Everything into a genuinely professional tool.
Index Network Drives and Additional Volumes
Everything automatically indexes all local NTFS volumes it detects. If you have external drives, NAS shares, or additional partitions, verify they appear under Tools → Options → Indexes → NTFS. Each volume listed with a checkmark is indexed. Uncheck volumes you never search to keep the database lean.
For network drives, Everything supports two methods: ETP (Everything Transfer Protocol) server mode on a remote machine running Everything, or folder indexing via UNC paths. The ETP method is far faster because it queries the remote Everything database directly rather than crawling the share over the network.
Set Up the Everything Service Correctly
Go to Tools → Options → General → Run as administrator or install service. The service (Everything.exe running under the SYSTEM account) is what keeps the index updated in real time using the NTFS USN change journal. Without the service, Everything falls back to polling, which is slower and misses rapid file changes. Confirm the service is running by opening Windows Services (services.msc) and checking that "Everything" shows status "Running" and startup type "Automatic".
Configure the Keyboard Shortcut
The single biggest productivity gain from Everything is instant access. Go to Tools → Options → Keyboard → Toggle window hotkey and assign a global shortcut. Common choices:
- Win + F — replaces the sluggish Windows Search shortcut (requires remapping in Windows settings first)
- Alt + Space — conflicts with window menu on some apps; test before committing
- Ctrl + Alt + F — reliable, rarely conflicts, easy to remember (F for Find)
- Win + E — opens File Explorer by default; reassigning it requires a registry tweak
Practical Search Tactics That Most Users Never Discover
Everything's search syntax is where the tool separates from every Windows alternative. Knowing a dozen operators makes you dramatically faster at locating files.
Basic Operators
- Space = AND:
report 2024finds files containing both words anywhere in the path or filename. - | = OR:
invoice | receiptfinds either word. - ! = NOT:
budget !draftfinds files with "budget" but not "draft". - " " = exact phrase:
"project brief"matches that exact string including the space. - Wildcards:
*matches any sequence of characters;?matches exactly one character. Example:report_202?.pdfmatches report_2021.pdf through report_2029.pdf.
Filter Functions (The Power User Layer)
Everything supports function-based filters typed directly into the search bar. These are the most underused features.
- ext:pdf — restricts results to PDF files. Faster than typing .pdf because it matches the extension field, not the full path string.
- size:>10mb — files larger than 10 MB. Combine with a name search:
video size:>500mb. - date:today — files modified today. Also accepts
yesterday,thisweek,lastweek,thismonth. - dm:last7days — date modified in the last seven days (dm = date modified; dc = date created; da = date accessed).
- path:C:\Users\ — restricts search to a specific folder tree without navigating there first.
- folder: — returns only folders, not files. Useful when you remember a directory name but not its location.
- file: — returns only files, excluding folders from results.
- empty: — finds empty folders. Extremely useful for cleanup operations.
- dupe: — in Everything 1.5a, highlights duplicate filenames. Note: this matches names, not content; it is not a hash-based duplicate finder.
- regex: — enables full regular expression matching. Example:
regex:invoice_\d{4}\.pdfmatches invoice_0001.pdf through invoice_9999.pdf. - parent:foldername — finds files whose immediate parent directory matches the name. Useful when multiple projects share a common subfolder structure.
Saving Searches as Bookmarks and Filters
Repeat searches waste time. Everything lets you save any search as a named bookmark via Bookmarks → Add Bookmark. In version 1.5a, you can also create custom filters that appear in the filter toolbar — for example, a "Large Media" filter combining ext:mp4|mkv|mov size:>100mb. Click once instead of retyping the query every session.
Using Everything from the Command Line
Everything ships with a command-line interface (es.exe) that enables scripting and integration with other tools. Place es.exe in a folder on your system PATH, then call it from any terminal:
es filename— basic search, outputs matching paths to stdoutes -ext pdf report— search for PDFs containing "report"es -size +10485760— files larger than 10 MB (size in bytes)es -sort date-modified-descending budget— results sorted newest firstes -export-csv results.csv query— exports results to a CSV file for further processing
This makes Everything genuinely useful in batch scripts, PowerShell workflows, and automation pipelines — something no GUI-only search tool can match.
Integrating Everything with Other Applications
Everything exposes an HTTP server and an IPC interface. Third-party launchers including PowerToys Run, Keypirinha, Listary, and Flow Launcher all support Everything as a search backend. Enable the HTTP server under Tools → Options → HTTP Server, then configure your launcher to query http://localhost:port/?s=query. The result is file search embedded directly inside your application launcher without switching windows.
The Everything SDK (available on voidtools.com) allows developers to query the Everything database programmatically from C, C++, C#, or any language that can call a DLL. This is how tools like Agent Ransack's fast-path mode and several file manager plugins work under the hood.
Critical Mistakes to Avoid
Most problems with Everything trace back to a small set of avoidable errors.
- Running without the service on a multi-user machine. If the service is not installed, each user session must re-read the USN journal on launch, causing a noticeable delay and potentially missing changes made by other users or background processes.
- Searching FAT32 or exFAT drives and expecting instant results. Everything uses the NTFS change journal for speed. FAT32 and exFAT have no equivalent journal, so Everything must crawl these volumes the slow way. Format removable drives as NTFS if you search them frequently.
- Disabling the startup entry to "save resources." Everything at idle consumes less memory than a browser tab. Disabling startup means the index is not maintained while Everything is closed, so the first search after reopening it requires a journal catch-up scan.
- Using Everything as a content search tool without enabling content indexing. By default, Everything indexes filenames and paths only — it does not read inside files. If you need to find a word inside a document, enable content indexing in 1.5a under Tools → Options → Indexes → Content, or use a complementary tool like Agent Ransack for full-text search.
- Ignoring the exclude list. Everything indexes everything by default, including system folders, temporary directories, and the Recycle Bin. Add exclusions under Tools → Options → Indexes → Exclude to remove noise from results. Common exclusions:
C:\Windows\WinSxS,C:\$Recycle.Bin,C:\Windows\Temp. - Sharing the Everything window on screen recordings or screenshots without checking results. Because Everything shows all files on the system instantly, sensitive filenames (financial documents, personal data, confidential project names) can appear in search results visible to others.
- Expecting Everything to replace a backup or sync verification tool. Everything confirms a file exists at a given path right now. It does not verify file integrity, detect corruption, or track whether a file has been backed up.
- Not updating after major Windows upgrades. Feature updates to Windows 10 and 11 occasionally change how the USN journal is exposed. Running an outdated version of Everything after a major OS update can cause the index to stall or show stale results. Check voidtools.com after any major Windows update.
Performance Tuning for Large Drives
On machines with millions of files — common in development environments, media production, or data science workstations — a few settings reduce memory usage and improve search responsiveness.
- Under Tools → Options → Indexes, uncheck volumes you never search. A 4 TB archive drive with 2 million files adds significant database weight if you never actually search it through Everything.
- Increase the USN journal size on heavily active drives using
fsutil usn createjournal m=0x10000000 a=0x800000 C:in an elevated command prompt. A larger journal means Everything misses fewer changes during periods when it is not running. - If Everything's database file grows beyond 200 MB, run Tools → Rebuild Database to compact it. Fragmented databases from years of incremental updates can be noticeably slower than a fresh build.
- On systems with 32 GB or more of RAM, the Everything database fits entirely in the OS file cache after the first access, making subsequent searches essentially instantaneous regardless of drive speed.