Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've often wondered how to use Windows Search Filters. The available documentation is extremely limited, but its potential uses are quite large.

When I type something, the only search filters I see are "Date modified" and "Size". Googling shows me a few other options that, sometimes, work. Every time I try to use it I'm pondering "what search filters can I use, and what options does each filter support?". Anybody any idea where to find an extensive list or how to configure Search to give me a dropdown of the possibilities?

To find something, I always go back to a command prompt. I'd like to think I can do otherwise.

enter image description here

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Instead of "Search Filters", the keywords/phrase you're actually looking for is "Advanced Query Syntax".

As always, MSDN is the place to turn to for further help and details:

BTW, if you need a far better search utility with RegEx support, try AstroGrep or Everything.

share|improve this answer
    
And I just thought I was stupid, not being able to find a simple file in the current directory with a given text. Reading only the first three comments on that link finally gives me the insight that it is not me. Opening a command prompt on that dir, use findstr et voilà! There is is. And there I was, trying to find the filters that could have helped me, like "content" or whatever, but, alas, they don't help. Thanks, this was exactly the link (and discussion) I needed to see! –  Abel Jan 10 '13 at 21:27

To search based on file system attributes (e.g., hidden, system, read-only, etc.), use the intuitively obvious but largely undocumented attributes keyword.  As discussed in this thread on Windows 7 Help Forums, the usage is

attributes:numeric_attribute_code(s)

The file attribute values (constants) are

FILE_ATTRIBUTE_READONLY      = 1
FILE_ATTRIBUTE_HIDDEN        = 2
FILE_ATTRIBUTE_SYSTEM        = 4
FILE_ATTRIBUTE_DIRECTORY     = 16
FILE_ATTRIBUTE_ARCHIVE       = 32
FILE_ATTRIBUTE_ENCRYPTED     = 64 or 16384
FILE_ATTRIBUTE_NORMAL        = 128
FILE_ATTRIBUTE_TEMPORARY     = 256
FILE_ATTRIBUTE_SPARSE_FILE   = 512
FILE_ATTRIBUTE_REPARSE_POINT = 1024
FILE_ATTRIBUTE_COMPRESSED    = 2048
FILE_ATTRIBUTE_OFFLINE       = 4096
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 8192

(The aforementioned Windows 7 Help Forums says that FILE_ATTRIBUTE_ENCRYPTED is 64, but this page about the ATTRIB command says that it is 16384.  My testing (on Windows 7) indicates that 16384 is the correct value.)

So, for example, attributes:1 searches for files that have the READONLY attribute set.  Only.  This will not find files that have both the READONLY and the ARCHIVE attributes set, use attributes:33 for that.  To find both (i.e., files that have the READONLY attribute set, but not HIDDEN, SYSTEM, ENCRYPTED, COMPRESSED, or any of the other exotic, extended attributes, regardless of the state of the ARCHIVE attribute), you could use

attributes:1 OR attributes:33

But this syntax gets unwieldy quickly.  Luckily, there is an abbreviated form:

attributes:(1 OR 33)

Conjunction/disjunction keywords (AND and OR) must be capitalized; search filter (property) keywords like attributes (and filename, kind, type, date, datemodified, size, owner, datetaken, author, title, etc.) are case-insensitive.  By the way, if you like extra typing, you can say system.fileattributes instead of attributes.

So here are the numeric search codes for all possible searches based on the R, H, and A attributes.  (+R represents all read-only files, regardless of H and A status; +R -H is the example from above – all non-hidden read-only files.)

Attributes (symbolic)          Numeric attributes: value(s)
  +R   (1 OR 3 OR 33 OR 35)
  +R +H   (3 OR 35)
  +R +H +A   35
  +R +H -A   3
  +R -H   (1 OR 33)
  +R -H +A   33
  +R -H -A   1
  +R +A   (33 OR 35)
  +R -A   (1 OR 3)
  -R   (0 OR 2 OR 32 OR 34 OR 128)
  -R +H   (2 OR 34)
  -R +H +A   34
  -R +H -A   2
  -R -H   (0 OR 32 OR 128)
  -R -H +A   32
  -R -H -A   (0 OR 128)
  -R +A   (32 OR 34)
  -R -A   (0 OR 2 OR 128)
  +H   (2 OR 3 OR 34 OR 35)
  +H +A   (34 OR 35)
  +H -A   (2 OR 3)
  -H   (0 OR 1 OR 32 OR 33 OR 128)
  -H +A   (32 OR 33)
  -H -A   (0 OR 1 OR 128)
  +A   (32 OR 33 OR 34 OR 35)
  -A   (0 OR 1 OR 2 OR 3 OR 128)

Notes:

  • Any query term can be inverted by preceding it with - (minus).  For example, you can find everything except hidden read-only files with -attributes:(3 OR 35).
  • Naturally, even if you use the attributes keyword to search for hidden files, you will not find any unless you have “Show hidden files, folders, and drives” selected in “Folder Options”.
  • Logically, files with no attributes set should have an attributes value of 0, but this seems not to be the case.  In my experience, they have an attributes value of NORMAL (128).
  • To search for directories, and/or files/directories that are compressed, encrypted, not indexed, or have the SYSTEM attribute set, add the appropriate constant(s) from the first table to the values in the above table.  It should not be necessary to include the “128” values; e.g., for -R -H +S -A, it should be good enough to search for 4 rather than (4 OR 132).
  • Remember that folders that are “customized” (e.g., with a non-standard icon) have the READONLY attribute set.  (Customizations are stored in a hidden, system desktop.ini file.)
  • You don’t need to use the attributes keyword to search for directories only (i.e., excluding files) if you don’t care about the other attributes; just use type:folder.  Likewise, -type:folder searches for files only (excluding directories).  Do not confuse this with kind:folder, which will find true file system folders, but also collection files like *.CAB and *.ZIP.
  • Also, you can search for encrypted files and directories with encryptionstatus:encrypted or is:encrypted.  The inverse can be specified as -encryptionstatus:encrypted, -is:encrypted, or encryptionstatus:unencrypted.
  • Naturally, even if you use the attributes keyword to search for system files, you will not find any unless you have “Hide protected operating system files” deselected in “Folder Options”.
share|improve this answer
    
Nice addition to the original answer, thanks! –  Abel Feb 6 at 18:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.