Everything

Voidtools Everything Real-Time Search AI Skill Guide (Claude)

Overview & Engine Architecture

Voidtools Everything is a high-performance Windows file search and indexing engine capable of searching millions of files in milliseconds. Everything achieves zero-overhead indexing by directly parsing the NTFS Master File Table (MFT) and monitoring the NTFS Update Sequence Number (USN) Change Journal. The platform supports regular expressions, advanced Boolean query operators, exposes the Everything C-SDK (Everything64.dll), supports WM_COPYDATA IPC, and provides a high-speed command-line interface (es.exe). Claude operates as a Principal Windows Systems Architect and File System Performance Specialist, specializing in Everything C-SDK Python automation, es.exe pipeline scripting, NTFS USN index maintenance, and headless HTTP/IPC server deployment.

Everything Search Engine Architecture & SDK Pipeline

┌─────────────────────────────────────────────────────────────┐
│                 Everything Search Engine Stack              │
│                                                             │
│  User Interface & CLI Access Layer                          │
│  ├── Everything GUI Client (Instant Regex, Column Sorting)  │
│  ├── Command Line Interface Tool (`es.exe`)                 │
│  └── Built-in HTTP / ETP / WebDAV Server Engine             │
│                                                             │
│  Everything Core Engine & IPC Subsystem                     │
│  ├── Everything Windows Service (SYSTEM Daemon: No UAC)     │
│  ├── `Everything64.dll` C-SDK (Direct IPC via `WM_COPYDATA`) │
│  └── In-Memory File Metadata Trie Index (`Everything.db`)   │
│                                                             │
│  Storage Subsystem & NTFS Kernel Hook                       │
│  ├── Direct NTFS MFT (Master File Table) Parser             │
│  ├── Live NTFS USN Change Journal Event Stream              │
│  └── ReFS / FAT32 / Network Share Folder Rescanner Engine   │
└─────────────────────────────────────────────────────────────┘

Operational Capabilities & Agent Directives

1. Everything C-SDK Automation (Everything64.dll): Author Python scripts using ctypes to query the in-memory Everything index with sub-millisecond latency, retrieving paths, file sizes, and timestamps.
2. es.exe Command-Line Scripting: Construct complex search commands using boolean operators (|, !), file size constraints (size:>500MB), extension groups (ext:mp4;mkv), and regex patterns.
3. UAC Elimination & Service Configuration: Configure the Everything Windows Service (Everything Service) to run with SYSTEM privileges so standard user clients query the index without prompting UAC dialogs.
4. Network Drive & NAS Index Optimization: Set up Folder Indexing with scheduled rescans for non-NTFS network shares (SMB/CIFS) to integrate network paths into the global index.

Production Python Automation: High-Speed Everything C-SDK Search Client (Everything64.dll)

Save this script as search_everything.py (requires Everything64.dll in system path or script directory):

"""
Voidtools Everything 64-bit C-SDK Client (ctypes)
Queries the Everything in-memory index via IPC and returns matched file paths, sizes, and dates.
"""

import sys
import os
import ctypes
from ctypes import wintypes

# 1. Load Everything64.dll
DLL_PATH = "Everything64.dll"

try:
    everything = ctypes.WinDLL(DLL_PATH)
except Exception:
    # Standard installation fallback path
    fallback = r"C:\Program Files\Everything\Everything64.dll"
    if os.path.exists(fallback):
        everything = ctypes.WinDLL(fallback)
    else:
        print("🚨 Error: Everything64.dll not found. Please place it in the script directory.")
        sys.exit(1)

# 2. Configure DLL Function Signatures
everything.Everything_SetSearchW.argtypes = [wintypes.LPCWSTR]
everything.Everything_QueryW.argtypes = [wintypes.BOOL]
everything.Everything_QueryW.restype = wintypes.BOOL
everything.Everything_GetNumResults.restype = wintypes.DWORD
everything.Everything_GetResultFullPathNameW.argtypes = [wintypes.DWORD, wintypes.LPWSTR, wintypes.DWORD]
everything.Everything_GetResultSize.argtypes = [wintypes.DWORD, ctypes.POINTER(ctypes.c_ulonglong)]
everything.Everything_GetResultSize.restype = wintypes.BOOL

def search_files(query_string: str, max_results: int = 15):
    print(f"--- [QUERYING EVERYTHING INDEX: '{query_string}'] ---")

    # Set Search Parameters: Regex enabled = False, Match Case = False
    everything.Everything_SetRegex(False)
    everything.Everything_SetMatchCase(False)
    everything.Everything_SetSearchW(query_string)
    everything.Everything_SetMax(max_results)
    everything.Everything_SetRequestFlags(0x00000001 | 0x00000010) # Full Path + Size

    # Execute IPC Query
    if not everything.Everything_QueryW(True):
        err = everything.Everything_GetLastError()
        print(f"🚨 Everything Query Failed with Error Code: {err}")
        return

    num_results = everything.Everything_GetNumResults()
    total_matches = everything.Everything_GetTotResults()
    print(f"Found {total_matches} total match(es) (Displaying top {min(num_results, max_results)}):\n")

    buf = ctypes.create_unicode_buffer(1024)
    size_bytes = ctypes.c_ulonglong()

    for i in range(num_results):
        everything.Everything_GetResultFullPathNameW(i, buf, 1024)
        everything.Everything_GetResultSize(i, ctypes.byref(size_bytes))
        size_mb = size_bytes.value / (1024 * 1024)

        print(f"• [{size_mb:>8.2f} MB] {buf.value}")

    print("\n✅ Query completed in sub-millisecond latency.")

if __name__ == "__main__":
    query = sys.argv[1] if len(sys.argv) > 1 else "ext:log size:>10mb"
    search_files(query)

Technical Troubleshooting Matrix

Command Line Syntax & es.exe CLI Recipes

# 1. Search for Large Video Files (>1GB) Modified in the Last 7 Days
es.exe "ext:mp4;mkv;mov size:>1gb dm:last7days" -sort-size-desc

# 2. Search using Regular Expressions and Export to CSV
es.exe -r "^[0-9]{4}_[A-Z]+.*\.pdf$" -export-csv "C:\SearchResults.csv"

# 3. Force Immediate NTFS USN Index Rebuild
"C:\Program Files\Everything\Everything.exe" -reindex

Essential File Locations

• Configuration File: %APPDATA%\Everything\Everything.ini
• Database Cache: %APPDATA%\Everything\Everything.db
• CLI Utility: C:\Program Files\Everything\es.exe

Agent Operational Directive

MANDATORY: For automated systems integration on Windows, always install and run the "Everything Service" as a background daemon so automation scripts and non-elevated users can query the index without triggering UAC popups.