TFind - NTFS disk searcher

This tool searches an entire local NTFS filesystem extremely quickly - much faster than the built-in Windows search tool, which goes directory by directory - but still uses only documented, public API calls.

As of 2013, it can now be used (once installed by an Administrator) by non-privileged users and in non-elevated command shells without UAC prompts.

Unicode output should also work, including redirection to a file complete with byte-order-mark when writing to a new or empty file. (Windows 2000's runtime libraries don't have full support for this, so without updating msvcrt.dll you will get legacy non-Unicode output instead.)

Usage

tfind (pattern) [(drive letters)]

This command will search the volume(s) specified (all compatible drives, if you don't specify) for any filename matching the pattern specified. For example, to find all Word (.doc) files on drive C or D beginning with 'home', use the command 'tfind home*.doc c d'. Patterns may contain the ? and * characters as wildcards, to match any single character or any sequence of zero or more characters respectively. Multiple wildcards are permitted; pattern matching is not case-sensitive. If your pattern contains spaces or other problem characters, encase it in double-quotes - for example, since some malicious software uses filenames with a leading space to disguise themselves, you might use this command to find them:

tfind " *.exe"

tfind -v

This will display the current version number and build timestamp.

tfind -i

tfind -x

Install (-i) or uninstall (-x) the TFind Windows service. Installing this service allows non-privileged users (and administrators with non-elevated command prompts) to run TFind without needing to approve UAC prompts each time.

Download

32 bit version (Windows 2000 or later on x86) (previous version)

64 bit version (Windows XP Pro or later on AMD64) (previous version)

Both the above archives contain a single file, 'tfind.exe', for the specified architecture - I recommend extracting this to %SYSTEMROOT%\System32 or another directory on your PATH, so you can run the utility from any directory easily.

Features

Limitations

Future plans

Several of the limitations listed above may soon disappear, particularly if I receive supportive feedback about this tool. At present, I am considering adding a GUI and support for regular expressions; at a later date, I may also add support for other file systems (without the speed benefits of MFT access, but at least you'd be able to use TFind anywhere). Depending on the performance impact, I may also add full path matching along with regular expression support.

History

19 June 2013 - Service version with built-in installer

09 April 2008 - UAC workaround, default to searching all drives.

Contact

Please send comments, queries and suggestions to me.

Copyright/license

This tool is provided free of charge for personal use in the hope it will be useful to you, but is not guaranteed in any respect. Please link to this page, rather than distributing or linking directly to the files themselves. If you find this useful, Paypal donations are welcome at [email protected]; suggestions, bug reports or queries are also very welcome.