voidtools forum

Question for @void:

If Everything Service as well as Run as administrator is enabled, how does the Everything client access the MAster File Table and the USN journal?

Everything will attempt to access the NTFS Master File Table (MFT) as an administrator/standard user first.
If that fails, it will fall back to the Everything Service (if running).

Note: Everything can acquire low level read access to NTFS volumes as a standard user only if they are not marked as a system volume.

You can have Everything running as an administrator and the Everything service installed at the same time. However, only one of these options is required to index system NTFS volumes.

void wrote: ↑Sun Aug 04, 2019 5:26 am Note: Everything can acquire low level read access to NTFS volumes as a standard user only if they are not marked as a system volume.

Didn't know that. Thank you!

void wrote: ↑Sun Aug 04, 2019 5:26 am Note: Everything can acquire low level read access to NTFS volumes as a standard user only if they are not marked as a system volume.

What do you consider a system volume? The volume where Windows is installed (the boot volume)?

Microsoft:

The system volume refers to the disk volume that contains the hardware-specific files that are needed to start Windows, such as Ntldr, Boot.ini, and Ntdetect.com.

WMIC Output:

The volume where Windows is installed.
The volume where a page file is stored.

Got it. Thanks!