I've often wondered how to use Windows Search Filters. The available documentation is extremely limited, but its potential uses are quite large.

When I type something, the only search filters I see are "Date modified" and "Size". Googling shows me a few other options that, sometimes, work. Every time I try to use it I'm pondering "what search filters can I use, and what options does each filter support?". Anybody any idea where to find an extensive list or how to configure Search to give me a dropdown of the possibilities?

To find something, I always go back to a command prompt. I'd like to think I can do otherwise.

enter image description here


Instead of "Search Filters", the keywords/phrase you're actually looking for is "Advanced Query Syntax".

As always, MSDN is the place to turn to for further help and details:

BTW, if you need a far better search utility with RegEx support, try AstroGrep or Everything.


To search based on file system attributes (e.g., hidden, system, read-only, etc.), use the intuitively obvious but largely undocumented attributes keyword.  As discussed in this thread on Windows 7 Help Forums, the usage is


The file attribute values (constants) are


(The aforementioned Windows 7 Help Forums says that FILE_ATTRIBUTE_ENCRYPTED is 64, but this page about the ATTRIB command says that it is 16384.  My testing (on Windows 7) indicates that 16384 is the correct value.)

So, for example, attributes:1 searches for files that have the READONLY attribute set.  Only.  This will not find files that have both the READONLY and the ARCHIVE attributes set, use attributes:33 for that.  To find both (i.e., files that have the READONLY attribute set, but not HIDDEN, SYSTEM, ENCRYPTED, COMPRESSED, or any of the other exotic, extended attributes, regardless of the state of the ARCHIVE attribute), you could use

attributes:1 OR attributes:33

But this syntax gets unwieldy quickly.  Luckily, there is an abbreviated form:

attributes:(1 OR 33)

Conjunction/disjunction keywords (AND and OR) must be capitalized; search filter (property) keywords like attributes (and filename, kind, type, date, datemodified, size, owner, datetaken, author, title, etc.) are case-insensitive.  By the way, if you like extra typing, you can say system.fileattributes instead of attributes.

So here are the numeric search codes for all possible searches based on the R, H, and A attributes.  (+R represents all read-only files, regardless of H and A status; +R -H is the example from above – all non-hidden read-only files.)

Attributes (symbolic)          Numeric attributes: value(s)
  +R   (1 OR 3 OR 33 OR 35)
  +R +H   (3 OR 35)
  +R +H +A   35
  +R +H -A   3
  +R -H   (1 OR 33)
  +R -H +A   33
  +R -H -A   1
  +R +A   (33 OR 35)
  +R -A   (1 OR 3)
  -R   (0 OR 2 OR 32 OR 34 OR 128)
  -R +H   (2 OR 34)
  -R +H +A   34
  -R +H -A   2
  -R -H   (0 OR 32 OR 128)
  -R -H +A   32
  -R -H -A   (0 OR 128)
  -R +A   (32 OR 34)
  -R -A   (0 OR 2 OR 128)
  +H   (2 OR 3 OR 34 OR 35)
  +H +A   (34 OR 35)
  +H -A   (2 OR 3)
  -H   (0 OR 1 OR 32 OR 33 OR 128)
  -H +A   (32 OR 33)
  -H -A   (0 OR 1 OR 128)
  +A   (32 OR 33 OR 34 OR 35)
  -A   (0 OR 1 OR 2 OR 3 OR 128)


  • Any query term can be inverted by preceding it with - (minus).  For example, you can find everything except hidden read-only files with -attributes:(3 OR 35).
  • Naturally, even if you use the attributes keyword to search for hidden files, you will not find any unless you have “Show hidden files, folders, and drives” selected in “Folder Options”.
  • Logically, files with no attributes set should have an attributes value of 0, but this seems not to be the case.  In my experience, they have an attributes value of NORMAL (128).
  • To search for directories, and/or files/directories that are compressed, encrypted, not indexed, or have the SYSTEM attribute set, add the appropriate constant(s) from the first table to the values in the above table.  It should not be necessary to include the “128” values; e.g., for -R -H +S -A, it should be good enough to search for 4 rather than (4 OR 132).
  • Remember that folders that are “customized” (e.g., with a non-standard icon) have the READONLY attribute set.  (Customizations are stored in a hidden, system desktop.ini file.)
  • You don’t need to use the attributes keyword to search for directories only (i.e., excluding files) if you don’t care about the other attributes; just use type:folder.  Likewise, -type:folder searches for files only (excluding directories).  Do not confuse this with kind:folder, which will find true file system folders, but also collection files like *.CAB and *.ZIP.
  • Also, you can search for encrypted files and directories with encryptionstatus:encrypted or is:encrypted.  The inverse can be specified as -encryptionstatus:encrypted, -is:encrypted, or encryptionstatus:unencrypted.
  • Naturally, even if you use the attributes keyword to search for system files, you will not find any unless you have “Hide protected operating system files” deselected in “Folder Options”.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.