change journal

The Change Journal describes the changes that took place, but does not include all the data or details associated with the change.

Each record in the Change Journal contains the USN, the name of the file, and information about what the change was.

Once created, the index is continually updated by the application from the NTFS change journal.

However, because it relies on the change journal, Everything can only search NTFS volumes.

(For this reason Change Journals are sometimes called USN Journals.)

For this reason the Change Journal cannot be used to undo operations on files within NTFS.

Because it requires access to the NTFS change journal, Everything must run with administrator privileges, either in a privileged user account or as a Windows service.

USN Journal (NTFS change journal)

USN Journal (shorthand form of Update Sequence Number Journal, also known as Change Journal) is a function of recording the changes on NTFS volumes.

Because Everything doesn't index content and relies on the NTFS change journal to filter file updates, the only file system activity which requires it to update its index, it uses very little memory and processor time to provide its service.

The Notifications API is also used by the internal USN Journal Notifier component of Windows Search, which monitors the Change Journal in an NTFS volume to keep track of files that has changed on the volume.