Everything NTFS scanning technology: Can it see deleted files?

[raccoon]

I'm curious to know if the method that Everything uses to index NTFS volumes directly, at a low level, would permit discovery of deleted files. And if so, would the indexing and displaying of deleted files be a desirable feature for Everything?

[therube]

In the future version, during an Everything session (so long as Everything remains open & running), renames & deletes will be logged (also allowing potential undo rename/delete).
I think it to be a very nice feature.

And while it doesn't do it, some sort of global history feature I'd find interesting.


Windows itself does store some (much) information on actions taken on files.
(Nirsoft's) RecentFilesView will note if a recently viewed file is no longer, which might imply that it had been deleted.

[raccoon]

OK, thanks. I was hoping the NTFS scanning that Everything uses might also have access to deleted files, in the same way Recuva and other undelete programs do. I know that deleted files remain in the MFT but I don't know the particulars of how you're scanning.

These links seem useful though.

https://www.codeproject.com/articles/74 ... eted-files

https://www.ntfs.com/file-recovery-concepts.htm