TFind - NTFS disk searcher
This tool searches an entire local NTFS filesystem extremely quickly - much faster than the built-in Windows search tool, which goes directory by directory - but still uses only documented, public API calls.
As of 2013, it can now be used (once installed by an Administrator) by non-privileged users and in non-elevated command shells without UAC prompts.
Unicode output should also work, including redirection to a file complete with byte-order-mark when writing to a new or empty file. (Windows 2000's runtime libraries don't have full support for this, so without updating msvcrt.dll you will get legacy non-Unicode output instead.)
Usage
tfind (pattern) [(drive letters)]
This command will search the volume(s) specified (all compatible drives, if you don't specify) for any filename matching the pattern specified. For example, to find all Word (.doc) files on drive C or D beginning with 'home', use the command 'tfind home*.doc c d'. Patterns may contain the ? and * characters as wildcards, to match any single character or any sequence of zero or more characters respectively. Multiple wildcards are permitted; pattern matching is not case-sensitive. If your pattern contains spaces or other problem characters, encase it in double-quotes - for example, since some malicious software uses filenames with a leading space to disguise themselves, you might use this command to find them:
tfind " *.exe"
tfind -v
This will display the current version number and build timestamp.
tfind -i
tfind -x
Install (-i) or uninstall (-x) the TFind Windows service. Installing this service allows non-privileged users (and administrators with non-elevated command prompts) to run TFind without needing to approve UAC prompts each time.
Download
32 bit version (Windows 2000 or later on x86) (previous version)
64 bit version (Windows XP Pro or later on AMD64) (previous version)
Both the above archives contain a single file, 'tfind.exe', for the specified architecture - I recommend extracting this to %SYSTEMROOT%\System32 or another directory on your PATH, so you can run the utility from any directory easily.
Features
- UAC 'workaround': Unlike Microsoft's own command line utilities such as chkdsk, TFind works with UAC, spawning an elevated instance of itself and feeding the results back to the original console window. Like everyone else, I soon got fed up needing to launch a new, privileged, console window for some tasks - so I implemented a solution!
Limitations
- NTFS only: TFind achieves its speed and efficiency by reading the NTFS MFT (Master File Table), which of course only exists on NTFS volumes
- Administrator access required (only Administrators are allowed to read the MFT)
- Local use only: TFind must be run on the computer holding the volume to search (although Mark Russinovich's excellent PSExec tool can be used to execute it remotely)
- No GUI - command line only
- Simple strings and wild-cards only
- The pattern given is matched only against the file name, not the full path
Future plans
Several of the limitations listed above may soon disappear, particularly if I receive supportive feedback about this tool. At present, I am considering adding a GUI and support for regular expressions; at a later date, I may also add support for other file systems (without the speed benefits of MFT access, but at least you'd be able to use TFind anywhere). Depending on the performance impact, I may also add full path matching along with regular expression support.
History
19 June 2013 - Service version with built-in installer
09 April 2008 - UAC workaround, default to searching all drives.
Contact
Please send comments, queries and suggestions to me.
Copyright/license
This tool is provided free of charge for personal use in the hope it will be useful to you, but is not guaranteed in any respect. Please link to this page, rather than distributing or linking directly to the files themselves. If you find this useful, Paypal donations are welcome at james@deadnode.org; suggestions, bug reports or queries are also very welcome.