Reads the MFT directly
A LocalSystem service parses the raw NTFS Master File Table to enumerate an entire volume (1.13M files in ~3.4s) without touching the Windows Search indexer.
Built for people who run Windows for a living.
Reads the NTFS Master File Table directly to index millions of files in seconds, then tails the USN change journal for live results as you type — no admin, no waiting for Windows Search.
./allthethings --runSearch · Rust, Tauriready, 0 errors · offlineA LocalSystem service parses the raw NTFS Master File Table to enumerate an entire volume (1.13M files in ~3.4s) without touching the Windows Search indexer.
It follows the volume's update-sequence-number journal so creates, renames, and deletes appear live, re-reading each changed MFT record to backfill the size and timestamps the journal omits.
The asInvoker GUI queries the privileged indexing service over a query-only same-machine named pipe, keeping raw-volume reads in LocalSystem while file actions run in your own user context.
Windows Search is fine until it isn’t — slow to index, unaware of files it’s decided not to look at, and useless on a drive you’ve just attached. AllTheThings takes the voidtools Everything approach: it reads the NTFS Master File Table directly and indexes every file on a volume in seconds, then tails the USN change journal so creates, renames and deletes show up live. Type, and the results appear as you type.
It’s aimed at administrators, developers, and anyone who works on large NTFS volumes and has given up waiting for the indexer to catch up.
%LOCALAPPDATA%\AllTheThings\cache for near-instant warm starts.The GUI is designed to run without administrator rights. Privileged raw-volume indexing is delegated to the AllTheThingsSvc LocalSystem background service. File actions such as open, rename, delete, and properties run in your own user context, not in the service context.
Download the latest installer from:
https://github.com/Swatto86/AllTheThings/releases
The installer sets up the desktop app, the AllTheThingsSvc indexing service, signed updater assets, and optional startup/tray launch behavior. Uninstalling removes the app and service.
After the first run, AllTheThings loads its index cache and only replays journal changes since the last cache position. If the journal was recreated or its tail has been purged, the app falls back to a full scan.
| Syntax | Meaning | Example |
|---|---|---|
| space | AND | report 2026 |
| ` | ` | OR |
! | NOT | report !draft |
( ) | grouping | `report (2025 |
| quotes | exact phrase | "quarterly report" |
* and ? | wildcards | invoice-2026-*.pdf |
| regex mode | regular expressions | enabled from Options |
ext: | extension filter | ext:ps1 |
path: | path filter | path:projects |
file: | files only | file: report |
folder: | folders only | folder: archive |
size: | size filter | size:>1mb |
dm: | date modified | dm:thisweek |
dc: | date created | dc:2026-01-01..2026-06-30 |
da: | date accessed | da:yesterday |
attrib: | DOS attribute filter | attrib:h |
content: | file content search | *.log content:"timeout" |
Date filters accept keywords such as today, yesterday, thisweek, thismonth, and thisyear, plus dates, comparison operators, and ranges.
Use the toolbar Builder when you do not want to remember the query language. It can compose a query from name text, content text, extensions, size filters, dates, files versus folders, attributes, and match options. The Builder shows the query it creates, so it is also a good way to learn the syntax.
The result list supports open, open containing folder, open with, run as administrator, copy path, copy name, inline rename, delete to Recycle Bin, and properties. Columns can be sorted, resized, reordered, and selected from the header context menu. The app remembers the layout.
Settings include theme, global hotkey, close to tray, start with Windows, Explorer “Search AllTheThings here”, and background service controls. Explorer integration is per-user. On Windows 11 it appears under “Show more options”.
The Export button writes the current filtered result set. The format follows the extension you choose in the Save dialog:
.csv.txt.efuUse .efu when you want an Everything-compatible file list.
git clone https://github.com/Swatto86/AllTheThings.git
cd AllTheThings
npm install
npm run tauri dev
In development, the installer has not registered the service. Either install the service from an elevated shell, use the Settings service button, or run the development terminal as Administrator.
Build the installer:
npm run tauri build
Check the status bar. If it shows access denied, install/start the background service or launch the development build from an elevated terminal.
Open Settings and enable Explorer integration. On Windows 11, check “Show more options” in the folder context menu.
content: first narrows candidates by filename, then reads file bodies in your user account. Add filename, extension, path, or size filters to reduce the candidate set.
https://github.com/Swatto86/AllTheThingshttps://github.com/Swatto86/AllTheThings/releases