Everything NTFS scanning technology: Can it see deleted files?

General discussion related to "Everything".
Post Reply
raccoon
Posts: 144
Joined: Thu Oct 18, 2018 1:24 am

Everything NTFS scanning technology: Can it see deleted files?

Post by raccoon » Mon Dec 14, 2020 11:38 am

I'm curious to know if the method that Everything uses to index NTFS volumes directly, at a low level, would permit discovery of deleted files. And if so, would the indexing and displaying of deleted files be a desirable feature for Everything?

therube
Posts: 2853
Joined: Thu Sep 03, 2009 6:48 pm

Re: Everything NTFS scanning technology: Can it see deleted files?

Post by therube » Mon Dec 14, 2020 3:56 pm

In the future version, during an Everything session (so long as Everything remains open & running), renames & deletes will be logged (also allowing potential undo rename/delete).
I think it to be a very nice feature.

And while it doesn't do it, some sort of global history feature I'd find interesting.


Windows itself does store some (much) information on actions taken on files.
(Nirsoft's) RecentFilesView will note if a recently viewed file is no longer, which might imply that it had been deleted.

raccoon
Posts: 144
Joined: Thu Oct 18, 2018 1:24 am

Re: Everything NTFS scanning technology: Can it see deleted files?

Post by raccoon » Tue Dec 15, 2020 7:04 pm

OK, thanks. I was hoping the NTFS scanning that Everything uses might also have access to deleted files, in the same way Recuva and other undelete programs do. I know that deleted files remain in the MFT but I don't know the particulars of how you're scanning.

These links seem useful though.

https://www.codeproject.com/articles/74 ... eted-files

https://www.ntfs.com/file-recovery-concepts.htm

Post Reply