The "Everything" database is a cache of all your NTFS Master File Tables (MFTs).
It is not a vital file and can be deleted.
So how is it updated
When you run "Everything", it reads the database from disk into memory.
If the database does not exist, or is out of date "Everything" will create a new one.
Once the database is loaded into memory, "Everything" no longer requires the Everything.db on the disk.
While "Everything" is running it will maintain the database in memory.
When you Exit "Everything", the entire database is recreated on the disk from the database in "Everything"'s memory.
"Everything" will save the new database to Everything.db.tmp before overwriting Everything.db.
when is it updated
When you run "Everything" and the database does not exist, or was out of date a new database is created on the disk.
When you exit "Everything" the database in memory is saved to the database on disk.
why is the file date/time not as expected?
Exit "Everything" and check if the Everything.db creation/modified date is updated.
With "Everything" 18.104.22.1681a the database filename is Everything.ComputerName.UserName.db.
"Everything" does not use ADS.
Future versions will not save the database to disk after rescanning all volumes. The database on disk will only be updated after exiting "Everything".
If you run "Everything" from a removable volume the database uses the Everything.ComputerName.UserName.db filename, otherwise the Everything.db filename is used.
In future releases you will be able to disable the database on disk, "Everything" will need to recreate the database in memory every time you run it.
If you shutdown Windows with "Everything" running in debug mode the database is not saved.