major-ai-skills
Version:
Installable agentic skills / AI agent skills (SKILL.md) for Claude Code, Cursor, Codex CLI, Gemini CLI & Antigravity - 402+ professional app, token-efficiency, and common-sense skills. SEO/GEO ready.
162 lines (126 loc) • 8.9 kB
Markdown
name: everything
description: "Search Windows files with Everything and es.exe, integrate the SDK or IPC interface, and troubleshoot NTFS index behavior."
category: windows
risk: safe
source: self
source_type: self
date_added: "2026-08-26"
tags: ["everything", "voidtools", "ntfs-usn-journal", "mft-indexing", "everything-sdk-dll", "es-cli", "claude"]
tools: ["claude", "cursor", "gemini", "codex"]
# Voidtools Everything Real-Time Search AI Skill Guide (Claude)
## Overview & Engine Architecture
Voidtools Everything is a high-performance Windows file search and indexing engine capable of searching millions of files in milliseconds. Everything achieves zero-overhead indexing by directly parsing the **NTFS Master File Table (MFT)** and monitoring the **NTFS Update Sequence Number (USN) Change Journal**. The platform supports **regular expressions**, advanced **Boolean query operators**, exposes the **Everything C-SDK (`Everything64.dll`)**, supports **`WM_COPYDATA` IPC**, and provides a high-speed command-line interface (**`es.exe`**). Claude operates as a Principal Windows Systems Architect and File System Performance Specialist, specializing in **Everything C-SDK Python automation**, **`es.exe` pipeline scripting**, **NTFS USN index maintenance**, and **headless HTTP/IPC server deployment**.
### Everything Search Engine Architecture & SDK Pipeline
```
┌─────────────────────────────────────────────────────────────┐
│ Everything Search Engine Stack │
│ │
│ User Interface & CLI Access Layer │
│ ├── Everything GUI Client (Instant Regex, Column Sorting) │
│ ├── Command Line Interface Tool (`es.exe`) │
│ └── Built-in HTTP / ETP / WebDAV Server Engine │
│ │
│ Everything Core Engine & IPC Subsystem │
│ ├── Everything Windows Service (SYSTEM Daemon: No UAC) │
│ ├── `Everything64.dll` C-SDK (Direct IPC via `WM_COPYDATA`) │
│ └── In-Memory File Metadata Trie Index (`Everything.db`) │
│ │
│ Storage Subsystem & NTFS Kernel Hook │
│ ├── Direct NTFS MFT (Master File Table) Parser │
│ ├── Live NTFS USN Change Journal Event Stream │
│ └── ReFS / FAT32 / Network Share Folder Rescanner Engine │
└─────────────────────────────────────────────────────────────┘
```
## Operational Capabilities & Agent Directives
1. **Everything C-SDK Automation (`Everything64.dll`)**: Author Python scripts using `ctypes` to query the in-memory Everything index with sub-millisecond latency, retrieving paths, file sizes, and timestamps.
2. **`es.exe` Command-Line Scripting**: Construct complex search commands using boolean operators (`|`, `!`), file size constraints (`size:>500MB`), extension groups (`ext:mp4;mkv`), and regex patterns.
3. **UAC Elimination & Service Configuration**: Configure the Everything Windows Service (`Everything Service`) to run with SYSTEM privileges so standard user clients query the index without prompting UAC dialogs.
4. **Network Drive & NAS Index Optimization**: Set up Folder Indexing with scheduled rescans for non-NTFS network shares (SMB/CIFS) to integrate network paths into the global index.
## Production Python Automation: High-Speed Everything C-SDK Search Client (`Everything64.dll`)
Save this script as `search_everything.py` (requires `Everything64.dll` in system path or script directory):
```python
"""
Voidtools Everything 64-bit C-SDK Client (ctypes)
Queries the Everything in-memory index via IPC and returns matched file paths, sizes, and dates.
"""
import sys
import os
import ctypes
from ctypes import wintypes
# 1. Load Everything64.dll
DLL_PATH = "Everything64.dll"
try:
everything = ctypes.WinDLL(DLL_PATH)
except Exception:
# Standard installation fallback path
fallback = r"C:\Program Files\Everything\Everything64.dll"
if os.path.exists(fallback):
everything = ctypes.WinDLL(fallback)
else:
print("🚨 Error: Everything64.dll not found. Please place it in the script directory.")
sys.exit(1)
# 2. Configure DLL Function Signatures
everything.Everything_SetSearchW.argtypes = [wintypes.LPCWSTR]
everything.Everything_QueryW.argtypes = [wintypes.BOOL]
everything.Everything_QueryW.restype = wintypes.BOOL
everything.Everything_GetNumResults.restype = wintypes.DWORD
everything.Everything_GetResultFullPathNameW.argtypes = [wintypes.DWORD, wintypes.LPWSTR, wintypes.DWORD]
everything.Everything_GetResultSize.argtypes = [wintypes.DWORD, ctypes.POINTER(ctypes.c_ulonglong)]
everything.Everything_GetResultSize.restype = wintypes.BOOL
def search_files(query_string: str, max_results: int = 15):
print(f"--- [QUERYING EVERYTHING INDEX: '{query_string}'] ---")
# Set Search Parameters: Regex enabled = False, Match Case = False
everything.Everything_SetRegex(False)
everything.Everything_SetMatchCase(False)
everything.Everything_SetSearchW(query_string)
everything.Everything_SetMax(max_results)
everything.Everything_SetRequestFlags(0x00000001 | 0x00000010) # Full Path + Size
# Execute IPC Query
if not everything.Everything_QueryW(True):
err = everything.Everything_GetLastError()
print(f"🚨 Everything Query Failed with Error Code: {err}")
return
num_results = everything.Everything_GetNumResults()
total_matches = everything.Everything_GetTotResults()
print(f"Found {total_matches} total match(es) (Displaying top {min(num_results, max_results)}):\n")
buf = ctypes.create_unicode_buffer(1024)
size_bytes = ctypes.c_ulonglong()
for i in range(num_results):
everything.Everything_GetResultFullPathNameW(i, buf, 1024)
everything.Everything_GetResultSize(i, ctypes.byref(size_bytes))
size_mb = size_bytes.value / (1024 * 1024)
print(f"• [{size_mb:>8.2f} MB] {buf.value}")
print("\n✅ Query completed in sub-millisecond latency.")
if __name__ == "__main__":
query = sys.argv[1] if len(sys.argv) > 1 else "ext:log size:>10mb"
search_files(query)
```
## Technical Troubleshooting Matrix
| Issue & Failure Signature | Root Cause Analysis | Diagnostic & Resolution Pathway |
| :--- | :--- | :--- |
| **Search Returns 0 Results / Service Inactive** | `Everything Service` is stopped or background process not running. | Start service via elevated command prompt:<br>`Everything.exe -svc-start` or run `net start "Everything"`. |
| **UAC Prompt Appears Every Time Everything Opens** | Client executable configured with "Run as administrator" compatibility flag. | 1. In *Tools $\rightarrow$ Options $\rightarrow$ General*, check **Everything Service**.<br>2. Uncheck **Run as administrator** to allow standard non-elevated user access. |
| **Search Results Out of Sync with Disk** | NTFS USN Change Journal index buffer corrupted or volume unmounted uncleanly. | In Everything, go to *Tools $\rightarrow$ Options $\rightarrow$ Indexes*, click **Force Rebuild**. |
| **Network Shared Folder Not Appearing in Search** | Network drives (SMB) do not support NTFS USN journals and must be indexed manually. | In Options $\rightarrow$ **Folders**, click **Add...** $\rightarrow$ Select network UNC path $\rightarrow$ Set Rescan Schedule (e.g. Daily). |
## Command Line Syntax & `es.exe` CLI Recipes
```bash
# 1. Search for Large Video Files (>1GB) Modified in the Last 7 Days
es.exe "ext:mp4;mkv;mov size:>1gb dm:last7days" -sort-size-desc
# 2. Search using Regular Expressions and Export to CSV
es.exe -r "^[0-9]{4}_[A-Z]+.*\.pdf$" -export-csv "C:\SearchResults.csv"
# 3. Force Immediate NTFS USN Index Rebuild
"C:\Program Files\Everything\Everything.exe" -reindex
```
### Essential File Locations
- **Configuration File**: `%APPDATA%\Everything\Everything.ini`
- **Database Cache**: `%APPDATA%\Everything\Everything.db`
- **CLI Utility**: `C:\Program Files\Everything\es.exe`
## Agent Operational Directive
> **MANDATORY**: For automated systems integration on Windows, always install and run the "Everything Service" as a background daemon so automation scripts and non-elevated users can query the index without triggering UAC popups.