TFind - NTFS disk searcher

This tool searches an entire local NTFS filesystem extremely quickly - much faster than the built-in Windows search tool, which goes directory by directory - but still uses only documented, public API calls.

Usage

tfind (pattern) [(drive letters)]

This command will search the volume(s) specified (all compatible drives, if you don't specify) for any filename matching the pattern specified. For example, to find all Word (.doc) files on drive C or D beginning with 'home', use the command 'tfind home*.doc c d'. Patterns may contain the ? and * characters as wildcards, to match any single character or any sequence of zero or more characters respectively. Multiple wildcards are permitted; pattern matching is not case-sensitive. If your pattern contains spaces or other problem characters, encase it in double-quotes - for example, since some malicious software uses filenames with a leading space to disguise themselves, you might use this command to find them:

tfind " *.exe"

Download

32 bit version (Windows 2000 or later on x86)

64 bit version (Windows XP Pro or later on AMD64)

Both the above archives contain a single file, 'tfind.exe', for the specified architecture - I recommend extracting this to %SYSTEMROOT%\System32 or another directory on your PATH, so you can run the utility from any directory easily.

Features

• UAC 'workaround': Unlike Microsoft's own command line utilities such as chkdsk, TFind works with UAC, spawning an elevated instance of itself and feeding the results back to the original console window. Like everyone else, I soon got fed up needing to launch a new, privileged, console window for some tasks - so I implemented a solution!

Limitations

• NTFS only: TFind achieves its speed and efficiency by reading the NTFS MFT (Master File Table), which of course only exists on NTFS volumes
• Administrator access required (only Administrators are allowed to read the MFT)
• Local use only: TFind must be run on the computer holding the volume to search (although Mark Russinovich's excellent PSExec tool can be used to execute it remotely)
• No GUI - command line only
• Simple strings and wild-cards only
• The pattern given is matched only against the file name, not the full path

Future plans

Several of the limitations listed above may soon disappear, particularly if I receive supportive feedback about this tool. At present, I am considering adding a GUI, support for regular expressions and better UAC handling; at a later date, I may also add a helper service to allow remote and non-Administrator users to use TFind, along with support for other file systems (without the speed benefits of MFT access, but at least you'd be able to use TFind anywhere). Depending on the performance impact, I may also add full path matching along with regular expression support.

History

09 April 2008 - UAC workaround, default to searching all drives.

Contact

Please send comments, queries and suggestions to me.

Copyright/license

This tool is provided free of charge for personal use in the hope it will be useful to you, but is not guaranteed in any respect. Please link to this page, rather than distributing or linking directly to the files themselves. If you find this useful, Paypal donations are welcome at jas@spamcop.net; suggestions, bug reports or queries are also very welcome.