Zoek naar een bestand, map, stream of extent


You can start a search for any file, folder, stream, extent or ... using a wide range of options, via two different methods.

Via the search dialog, which is triggered via right mouse click on an object, or via the seach toolbar in the top right corner of the program.

1. The option via the search dialog is rather self explaining.
2. The option via the search toolbar in the top right corner takes a wide range of commands and options.

The most straightforward method is a simple search for a file or folder name, with or without wildcards.
For instance *user*, will find all files and folders with "user" in the name (or extension).  Case insensitive.
For instance "Users", "System User" etc.

This search (*user*) is essentially the same as: file:*user*|folder:*user*

Rules that combine object properties and object name (case insensitive, supporting wildcard).
PS. the rules' names are case insensitive too.

File:
Folder:
Stream:
Extent:
RF:
ResourceFork:
Readable:
Unreadable:
Hidden:
Compressed:
Encrypted:
Fragmented:
Embedded:
System:
Deleted:
ReadOnly:
Recovered:
Shortcut:
Sparse:
HasStreams:
HasRF: (HasResourceFork:)

Examples:

*.jpg will find all .jpg files (and folders)
*.jpg|*.bmp  will find all .jpg and .bmp files (and folders)
file:*.jpg|file:*.bmp  will find all .jpg and .bmp files (not folders)
Compressed:*.log  will find all compressed .log files (or .log folders if they exist)
Fragmented:* will find all files and folders that are fragmented (consist of multiple extents)
file:z*|stream:z* will find all files and file/folder streams that start with a 'z'
folder:desktop will find the folder 'desktop'

A property without text, for instance ReadOnly: will return all candidates.  It is essentially the same as ReadOnly:*
As you can see in the examples (e.g. file:*jpg*|folder:*jpg*), you can use | (OR) between the different rules


Rules that look for numerical values:

LBA:    // Start Address
Address:    // Start Address
LastLBA:    // Last block of object address
ContainsLBA:    // Contains the block with address
UID:    // Unique ID (MFT record for NTFS, Inode for MFS, HFS, FE for UDF etc) 
Bytes:    // The amount of bytes of the object
Blocks    // The amount of blocks contained in the object

The rules that look for a numerical value can be AND together (using &).  They cannot be ORed together, but they can be preceeded and/or trailed by other ORed rules

Examples:  

lba:1000&bytes:10

These same rules can also be used in combination with >, <, >=, <= and = (the latter '=' is implied if absent)

Examples:  

lba:>=1000&lba<2000 will find all objects with an address between 1000 and 2000
lba:>=1000&lba<2000&file:*a* will find all files with an address between 1000 and 2000, containing an 'a' in the filename
lba:>=1000&lba<2000|stream:+++ will find all files with an address between 1000 and 2000, and the search will also include streams.  Streams with name +++ will be found too, but the idea here is to give a name that is not present, just to make sure the search covers streams as well. 
lba:>=1000&lba<2000|stream:+++|extent:+++ Using previous example logic you can also look in the individual extents
uid:14234 will find (on NTFS) the file or folder using MFT record 14234
bytes:<100|stream:$$$ will find all files and streams smaller than 100 bytes.  Stream:$$$ assures that the search also looks into the extents, but the name $$$ will likely not be found, so only the bytes criteria will matter