Why some file searches are instant

The slow way: opening every folder

Imagine you want to find every file on your drive whose name contains the word "invoice." The most direct approach is to start at the top of the drive, list what is inside the first folder, step into each sub-folder, list what is inside that, and keep going until you have visited every folder on the disk. This is often called walking the directory tree.

It works, and for a single folder it is fast. The problem is scale. A typical Windows drive holds hundreds of thousands — sometimes millions — of files and folders. Visiting each one means asking the disk a separate question every step of the way, and those questions add up. Some search tools scan folders one by one like this, which is why they feel slow on a full drive: the work grows with the number of folders, and there are a lot of folders.

The fast way: reading one table instead

Here is the key idea. On a drive formatted with NTFS — the file system Windows has used for decades — there is a single built-in structure that already lists everything on the volume. It is called the Master File Table, or MFT.

The MFT holds one record for every file and every folder on the drive. Each record stores that item's metadata — the facts about the file rather than its contents: its name, its size, when it was last modified, its attributes, and which folder it lives in. NTFS keeps this table so it can manage the disk at all; it is not an add-on that a search tool created.

That changes the whole problem. Instead of visiting a million folders to discover a million names, a program can read this one table and learn every name in a single pass. Reading one organized table is far less work than knocking on every folder's door. This is why tools that read the MFT can build their index in seconds and then answer searches in milliseconds. Everything, the well-known Windows search utility, works this way; PowerFind reads the MFT the same way.

A quick comparison

Simplified for explanation; real tools add caching and other refinements on top.

Staying current: the USN Journal

Reading the MFT once gives you a snapshot — an index of the drive as it was at that moment. But drives do not sit still. You save a document, download a file, delete an old folder. If the index never updated, it would drift out of date within minutes, and you would start seeing files in the results that no longer exist, or missing ones you just created.

One option would be to re-read the whole MFT every so often. That is wasteful — most of the drive did not change. NTFS offers something better: the USN Journal, short for Update Sequence Number Journal. It is a change log the file system keeps for the volume.

Every time a file is created, modified, renamed, or deleted, NTFS writes a short record into this journal describing what happened. Each record is stamped with a number — the update sequence number — that only ever counts upward. That detail is what makes the journal useful to a search tool.

A tool can remember the number of the last record it has already handled. Later, it simply asks the journal for everything that came after that number. In one small read it learns the exact list of what changed — this file was added, that one was renamed, another was removed — and updates just those entries in its index. Nothing else has to be re-examined. This is how an index stays live without re-scanning the drive, and it is what PowerFind does to keep its results matching your disk.

When the journal has moved on

The journal has a finite size, so its oldest records eventually roll off to make room. If a tool has been closed for a long time, the record it remembers may already be gone by the time it comes back. NTFS also assigns each journal an identifier, and that identifier changes if the journal is ever recreated. When a tool notices either situation — its saved position has aged out, or the identifier no longer matches — it knows it cannot safely replay the gap, so it falls back to reading the MFT again for a fresh, complete snapshot. In everyday use this rarely happens; the journal replay does the day-to-day work.

Putting it together

So the recipe for instant filename search on Windows is two parts, and neither is exotic — both are standard features of NTFS that have been there for years:

Read the MFT once to build an index of every file's name and details in a single pass, instead of walking folder by folder. Then follow the USN Journal to apply only what changes, instead of re-scanning. That is the whole reason a search can be ready before you finish typing. There is nothing about a slower folder-by-folder tool that is broken — it is simply looking in a place that takes longer to search. The instant tools just look somewhere the answer is already gathered.

PowerFind is built on exactly this approach. It reads the MFT to index your files and watches the USN Journal to stay current, which is why filename search returns in milliseconds. On top of that same index it also searches inside file contents, launches apps, and more — but the speed of the filename search comes straight from the two ideas in this article.