How can I see the available Windows Search Filters?

Question

I've often wondered how to use Windows Search Filters. The available documentation is extremely limited, but its potential uses are quite large.

When I type something, the only search filters I see are "Date modified" and "Size". Googling shows me a few other options that, sometimes, work. Every time I try to use it I'm pondering "what search filters can I use, and what options does each filter support?". Anybody any idea where to find an extensive list or how to configure Search to give me a dropdown of the possibilities?

To find something, I always go back to a command prompt. I'd like to think I can do otherwise.

Answer 1

Instead of "Search Filters", the keywords/phrase you're actually looking for is "Advanced Query Syntax".

As always, MSDN is the place to turn to for further help and details:

• Advanced Query Syntax

• Using Advanced Query Syntax Programmatically

BTW, if you need a far better search utility with RegEx support, try AstroGrep or Everything.

Answer 2

To search based on file system attributes (e.g., hidden, system, read-only, etc.), use the intuitively obvious but largely undocumented attributes keyword.  As discussed in this thread on Windows 7 Help Forums, the usage is

attributes:numeric_attribute_code(s)

The file attribute values (constants) are

FILE_ATTRIBUTE_READONLY      = 1
FILE_ATTRIBUTE_HIDDEN        = 2
FILE_ATTRIBUTE_SYSTEM        = 4
FILE_ATTRIBUTE_DIRECTORY     = 16
FILE_ATTRIBUTE_ARCHIVE       = 32
FILE_ATTRIBUTE_ENCRYPTED     = 64 or 16384
FILE_ATTRIBUTE_NORMAL        = 128
FILE_ATTRIBUTE_TEMPORARY     = 256
FILE_ATTRIBUTE_SPARSE_FILE   = 512
FILE_ATTRIBUTE_REPARSE_POINT = 1024
FILE_ATTRIBUTE_COMPRESSED    = 2048
FILE_ATTRIBUTE_OFFLINE       = 4096
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 8192

(The aforementioned Windows 7 Help Forums says that FILE_ATTRIBUTE_ENCRYPTED is 64, but this page about the ATTRIB command says that it is 16384.  My testing (on Windows 7) indicates that 16384 is the correct value.)

So, for example, attributes:1 searches for files that have the READONLY attribute set.  Only.  This will not find files that have both the READONLY and the ARCHIVE attributes set, use attributes:33 for that.  To find both (i.e., files that have the READONLY attribute set, but not HIDDEN, SYSTEM, ENCRYPTED, COMPRESSED, or any of the other exotic, extended attributes, regardless of the state of the ARCHIVE attribute), you could use

attributes:1 OR attributes:33

But this syntax gets unwieldy quickly.  Luckily, there is an abbreviated form:

attributes:(1 OR 33)

Conjunction/disjunction keywords (AND and OR) must be capitalized; search filter (property) keywords like attributes (and filename, kind, type, date, datemodified, size, owner, datetaken, author, title, etc.) are case-insensitive.  By the way, if you like extra typing, you can say system.fileattributes instead of attributes.

So here are the numeric search codes for all possible searches based on the R, H, and A attributes.  (+R represents all read-only files, regardless of H and A status; +R -H is the example from above – all non-hidden read-only files.)

Attributes (symbolic)          Numeric attributes: value(s)
  +R   (1 OR 3 OR 33 OR 35)
  +R +H   (3 OR 35)
  +R +H +A   35
  +R +H -A   3
  +R -H   (1 OR 33)
  +R -H +A   33
  +R -H -A   1
  +R +A   (33 OR 35)
  +R -A   (1 OR 3)
  -R   (0 OR 2 OR 32 OR 34 OR 128)
  -R +H   (2 OR 34)
  -R +H +A   34
  -R +H -A   2
  -R -H   (0 OR 32 OR 128)
  -R -H +A   32
  -R -H -A   (0 OR 128)
  -R +A   (32 OR 34)
  -R -A   (0 OR 2 OR 128)
  +H   (2 OR 3 OR 34 OR 35)
  +H +A   (34 OR 35)
  +H -A   (2 OR 3)
  -H   (0 OR 1 OR 32 OR 33 OR 128)
  -H +A   (32 OR 33)
  -H -A   (0 OR 1 OR 128)
  +A   (32 OR 33 OR 34 OR 35)
  -A   (0 OR 1 OR 2 OR 3 OR 128)

Notes:

• Any query term can be inverted by preceding it with - (minus).  For example, you can find everything except hidden read-only files with -attributes:(3 OR 35).
• Naturally, even if you use the attributes keyword to search for hidden files, you will not find any unless you have “Show hidden files, folders, and drives” selected in “Folder Options”.
• Logically, files with no attributes set should have an attributes value of 0, but this seems not to be the case.  In my experience, they have an attributes value of NORMAL (128).
• To search for directories, and/or files/directories that are compressed, encrypted, not indexed, or have the SYSTEM attribute set, add the appropriate constant(s) from the first table to the values in the above table.  It should not be necessary to include the “128” values; e.g., for -R -H +S -A, it should be good enough to search for 4 rather than (4 OR 132).
• Remember that folders that are “customized” (e.g., with a non-standard icon) have the READONLY attribute set.  (Customizations are stored in a hidden, system desktop.ini file.)
• You don’t need to use the attributes keyword to search for directories only (i.e., excluding files) if you don’t care about the other attributes; just use type:folder.  Likewise, -type:folder searches for files only (excluding directories).  Do not confuse this with kind:folder, which will find true file system folders, but also collection files like *.CAB and *.ZIP.
• Also, you can search for encrypted files and directories with encryptionstatus:encrypted or is:encrypted.  The inverse can be specified as -encryptionstatus:encrypted, -is:encrypted, or encryptionstatus:unencrypted.
• Naturally, even if you use the attributes keyword to search for system files, you will not find any unless you have “Hide protected operating system files” deselected in “Folder Options”.