When Everything first runs, it creates an index of the names of every file and folder on all NTFS and ReFS volumes[2] on the system from file metadata, in the case of NTFS from the NTFS Master File Table.[3] By default, all mounted NTFS and ReFS[2] volumes are indexed.[4] Once created, the index is continually updated by the application; in the case of NTFS the updates are fetched from the NTFS change journal.[5]
Specific folders on any file system can also be added to the index, but the indexing of folders not using NTFS or ReFS will be slow,[6] although searching using the completed index will not be.
Regardless of the file system used on the indexed drives and folders, Everything searches its index for file names matching a user search expression, which may be a fragment of the target file name or a regular expression,[7] displaying intermediate and immediate results as the search term is entered.
Since Everything does not index content and, for NTFS drives, relies only on the NTFS change journal to filter file updates, the only file system activity it requires on NTFS drives is updating its index, and it uses very little memory and processor time to provide its service when only indexing NTFS and ReFS drives.[8][9]
Because Everything requires access to the NTFS change journal, it must run with administrator privileges, either in a privileged user account or as a Windows service. As a Windows service it can expose search functionality to accounts without administrator privileges.[11] However, Everything does not filter search results by client privileges before displaying them, so that every user can see every file on a volume. Furthermore, opening the file or running an executable will launch the file with its own credentials rather than with the user's own credentials.[12] Although there may be a way to prevent privilege escalation when opening a file,[13] there is no obvious remedy to prevent one user from listing the private files in another user's account.
