voidtools forum

For example: this command does not find files which start with zero's:
startwith:hex:binary:content:000000000000000000000000000000000000000000000000
It should search in all files which content is not indexed.
For now, I assume if the file starts with 000000000000000000000000000000000000000000000000, the file is empty.

Use the fromdisk: search modifier to bypass your content index.

fromdisk:startwith:hex:binary:content:000000000000000000000000000000000000000000000000

fromdisk:



Use whole:content: to match files with no content. (file size might still be > 0)

whole:



Use size:0 to match empty files.

dear david
by fromdisk:startwith:hex:binary:content:000000000000000000000000000000000000000000000000
surprisingly we can find all iso and dcm and some other extension that have started with many zero file at header but not empty file.

To find files that are all NULL characters:

regex:binarycontent:^\x00*$

binarycontent:



To find files that start with one or more NULL characters:

startwith:hex:content:00
-or-
regex:binarycontent:^\x00+

To find files that start with one or more NULL characters:

regex:binarycontent:^\x00+
-or-
startwith:hex:content:00

Is that correct? [YES - see below]
Is binarycontent: looking for files that contain ONLY nul?
Is startwith: looking for files where the first byte is a nul?

I have a ubcd.iso.
The file starts with a number of nul (but is certainly not all nul).
The binarycontent: does not find ubcd (& is a timely search [scan of the data] at that).
The startwith: immediately finds ubcd.iso.

Oh that's weird.

Is there some sort of limit with that?
Or bug?

With smaller files (9 bytes or 32,768 or 58,353,664), that does find files that start with any number of nul.
But with a larger file, it fails?
(In this case "larger" is only 692,897,792 bytes)


Oh, it must be an x86 issue. So yes, regex:binarycontent:^\x00+ is correct.
Though with x86 Everything you can run out of "memory" on larger files.

regex:binarycontent:^\x00+

is terribly inefficient.
This will load the entire file into memory to perform the search.

startwith:hex:content:00

will only load 1 byte of the file to perform the search.

So: is there a swift solution for a layman - in form adding a Filter?

How would Filter would need to look like in order to single out all empty files, no matter of what format they might be?

To me, a file filled with NULLs is not empty.

Your results may vary.



To find files that have no size or are filled with NULLs:

size:0 | < startwith:hex:content:00 regex:binarycontent:^\x00+$>



To make a filter to find these files

• In Everything, from the Search menu, click Add to filters....
• Change the Name to: Empty or All NULLs
• Change the Search to: size:0 | < startwith:hex:content:00 regex:binarycontent:^\x00*$>
• Click OK.

I added this to my Everything as a Bookmark

Thank you for the info