I'm pretty certain that everything doesn't use the NTFS journal[1].
My understanding is that everything uses the file open hooks provided for antivirus to maintain the index, which is why it appears instant.
Adding a millisecond to each open call is imperceptible to the user, and it takes less time than that if you return immediately and process the index update in the background.
My understanding is that everything uses the file open hooks provided for antivirus to maintain the index, which is why it appears instant.
Adding a millisecond to each open call is imperceptible to the user, and it takes less time than that if you return immediately and process the index update in the background.
[1] happy to be proven wrong.