Search for files, folders, streams, extents, etc.
You can start a search for any file, folder, stream, extent or ... using a wide range of options, via two different methods.
Via the search dialog, which is triggered via right mouse click on a file or folder object, or via the search toolbar in the top right corner of the program.
1. The option via the search dialog is rather self explaining and offers a sub-set of all that is possible.
2. The option via the search toolbar in the top right corner takes a wider range of commands and options.
The most straightforward method is a simple search for a file or folder name, with or without wildcards.
For instance *user*, will find all files and folders with "user" in the name (or extension). Case insensitive by default.
For instance "Users", "System User" etc.
This search (*user*) is essentially the same as: file:*user*|folder:*user*
From IsoBuster 5.7 onward all search terms can be combined via OR (|) or AND (&) including the use of brackets/parenthesis where appropriate.
An exclamation mark (!) is also supported and it means the opposite of what is requested
A consequence of this change is that if your search term string/name contains one of these characters they need to be escaped with a backslash.
For instance if you want all files that start with a "(" then you need to escape the "(" character with a backslash
For instance: file:\(*
Pseudo code examples:
Term1&Term2 // both terms need to be true for the object to be listed
Term1|Term2 // if one of both terms is true, the object is listed
(Term1&Term2)|Term3 // both terms 1 and 2 need to be true unless the third term is true
!(Term1&Term2) // if the object does not match term 1 and doesn't match term 2, it is listed
Concrete examples:
file:*.exe&unreadable: // All executables that are known to be unreadable (This particular search can also simply be written as unreadable:*.exe)
file:*.png&address:>100,000 // All *.png files that start on an address > 100,000
file:*.png&address:>100,000&containslba:<=200.000 // All *.png files that are located in a block range between 100,000 and 200,000
A term can actually contain multiple commands/rules that are compatible but only one payload (text or number) that comes last per term. All those commands/rules are always AND
For instance file:unreadable:compressed:*.png // will find all *.png files that are (partially) unreadable and happen to be compressed
When unsure, simply split it up in multiple terms, in this case: file:*.png&unreadable:&compressed:
The rules (e.g. File:) are always case insensitive.
The payload (text) is always case insensitive (unless turned on (case:)) and supports wildcards (unless turned off (-wc:)).
Rules that combine object properties and object name
File:
Folder:
FileOrFolder: (>= IsoBuster 5.7)
Stream:
Extent:
RF:
ResourceFork:
Readable:
Unreadable:
Hidden:
Compressed:
Encrypted:
Fragmented:
Embedded:
System:
Deleted:
ReadOnly:
Recovered:
Shortcut:
Sparse:
HasStreams:
HasRF: (HasResourceFork:)
Examples:
*.jpg will find all .jpg files (and folders)
*.jpg|*.bmp will find all .jpg and .bmp files (and folders)
file:*.jpg|file:*.bmp will find all .jpg and .bmp files (not folders)
Compressed:*.log will find all compressed .log files (or .log folders if they exist)
Fragmented:* will find all files and folders that are fragmented (that consist of multiple extents)
file:z*|stream:z* will find all files and file/folder streams that start with a 'z'
folder:desktop will find the folder 'desktop'
A property without text, for instance ReadOnly: will return all candidates. It is essentially the same as ReadOnly:*
Rules that look for numerical values:
LBA: // Start Address
Address: // (Same as LBA:) Start Address
LastLBA: // Last block address of object
ContainsLBA: // Contains the block with address
UID: // Unique ID (File system specific. MFT record for NTFS, Inode for MFS, HFS, FE for UDF etc)
Bytes: // The amount of bytes in the object
Blocks: // The amount of blocks in the object
StreamCnt: // The amount of streams attached to an object (>= IsoBuster 4.4)
ExtentCnt: // The amount of extents that make up the object (minimum is 1) (>= IsoBuster 4.4)
MemberCnt: // The amount of files and folders in a Folder, or amount of Tracks in a Session, or Sessions on a CD or Partitions on a Disk (>= IsoBuster 4.4)
UnreadableCnt: // The amount of unreadable blocks in an object (>= IsoBuster 4.4)
Range:x:y // Find all objects (files, folders, ..) that are (fully or partially) located in a range starting from block address x over a range of y blocks (>= IsoBuster 4.8)
FromTo:x:y // Find all objects (files, folders, ..) that are (fully or partially) located in a range starting from block address x ending with block address y (>= IsoBuster 4.8)
Examples:
lba:1000&bytes:10
These same rules can also be used in combination with >, <, >=, <= and = (the latter '=' is implied if absent)
Examples:
lba:>=1000&lba<2000 will find all objects with a start address between 1000 and 2000
lba:>=1000&lba<2000&file:*a* will find all files with an address between 1000 and 2000, containing an 'a' in the filename
lba:>=1000&lba<2000&(file:|stream:) will find all files and streams with an address between 1000 and 2000
lba:>=1000&lba<2000&(file:|stream:|extent:) will find all files, streams and extents with an address between 1000 and 2000
uid:14234 (on NTFS) will find the file or folder using MFT record 14234
bytes:<100&stream: will find all streams smaller than 100 bytes.
Other rules:
Limit: // Limit the search to (provided number) objects (If no other rules are provided it will default to finding regular objects (files, folders, ...)) // Applies to all search terms if more than one are provided
deep: // Drills down in files and folders // New in IsoBuster 5.7 - but is and was already implied // Applies to all search terms if more than one are provided
-deep: // Turns off drilling down in files and folders // New in IsoBuster 5.7 // Applies to all search terms if more than one are provided
wc: // Support for wildcards in names // New in IsoBuster 5.7 - but is and was already implied // Applies to the search term it is part of
-wc: // Turns off support for wildcards // New in IsoBuster 5.7 // Applies to the search term it is part of
case: // Case sensitive testing of names // New in IsoBuster 5.7 // Applies to the search term it is part of
regex: // Use regular expressions while testing of names (wildcards ignored) // New in IsoBuster 5.7 // Applies to the search term it is part of
Examples:
*|Limit:50 stops the search after 50 objects have been found
Limit:50 does the same as previous
file:*.txt&Limit:50 stops the search after 50 text files have been found
UID:2000|Limit:1 stops the search after the object with unique ID 2000 has been found
file:-wc:question? looks for a file with actual file name question? (PS. this is impossible on a Windows system, but on Unix (EXT, XFS,..) for instance this character is allowed in a filename)