Hacker News new | ask | show | jobs
by wander_homer 1066 days ago
No, upon start Everything loads its database file into RAM and queries the USN journal for all file system changes since the last time it was running. By applying those changes to its current database it automatically gets a consistent representation of the current state of the file system. This usually is much quicker than a full rebuild.

Only when the USN journal doesn't go back enough in time will Everything rebuild its database by parsing the MFT (which is also much quicker than traversing the file system).
2 comments
mozball 1066 days ago
Okay. My system might have been bugged or misconfigured. It was several years ago.
link
jhoechtl 1066 days ago
what about deleted files? Do they eventually get flushed from the cache?
link
wander_homer 1066 days ago
Files get deleted immediately, the USN Journal only keeps track of the events (including delete events). It's basically a log of all filesystem events (up until a certain point in time, due to size restrictions).
link
Someone 1066 days ago
The journal has data about deletions, too.

https://learn.microsoft.com/en-us/windows-server/administrat...:

“As files, directories, and other NTFS objects are added, deleted, and modified, NTFS enters records into the USN change journal, one for each volume on the computer.”

link