Zoek naar een bestand, map, stream of extent
You can start a search for any file, folder, stream, extent or ... using a wide range of options, via two different methods.
Via the search dialog, which is triggered via right mouse click on an object, or via the seach toolbar in the top right corner of the program.
1. The option via the search dialog is rather self explaining.
2. The option via the search toolbar in the top right corner takes a wide range of commands and options.
The most straightforward method is a simple search for a file or folder name, with or without wildcards.
For instance *user*, will find all files and folders with "user" in the name (or extension). Case insensitive.
For instance "Users", "System User" etc.
This search (*user*) is essentially the same as: file:*user*|folder:*user*
Rules that combine object properties and object name (case insensitive, supporting wildcard).
PS. the rules' names are case insensitive too.
File:
Folder:
Stream:
Extent:
RF:
ResourceFork:
Readable:
Unreadable:
Hidden:
Compressed:
Encrypted:
Fragmented:
Embedded:
System:
Deleted:
ReadOnly:
Recovered:
Shortcut:
Sparse:
HasStreams:
HasRF: (HasResourceFork:)
Examples:
*.jpg will find all .jpg files (and folders)
*.jpg|*.bmp will find all .jpg and .bmp files (and folders)
file:*.jpg|file:*.bmp will find all .jpg and .bmp files (not folders)
Compressed:*.log will find all compressed .log files (or .log folders if they exist)
Fragmented:* will find all files and folders that are fragmented (consist of multiple extents)
file:z*|stream:z* will find all files and file/folder streams that start with a 'z'
folder:desktop will find the folder 'desktop'
A property without text, for instance ReadOnly: will return all candidates. It is essentially the same as ReadOnly:*
As you can see in the examples (e.g. file:*jpg*|folder:*jpg*), you can use | (OR) between the different rules
Rules that look for numerical values:
LBA: // Start Address
Address: // Start Address
LastLBA: // Last block of object address
ContainsLBA: // Contains the block with address
UID: // Unique ID (MFT record for NTFS, Inode for MFS, HFS, FE for UDF etc)
Bytes: // The amount of bytes of the object
Blocks: // The amount of blocks contained in the object
StreamCnt: // The amount of streams attached to an object (>= IsoBuster 4.4)
ExtentCnt: // The amount of extents that make up the object (minimum is 1) (>= IsoBuster 4.4)
MemberCnt: // The amount of files and folders in a Folder, or amount of Tracks in a Session, or Sessions on a CD or Partitions on a Disk (>= IsoBuster 4.4)
UnreadableCnt: // The amount of unreadable blocks in an object (>= IsoBuster 4.4)
Range:x:y // Find all objects (files, folders, ..) that are (fully or partially) located in a range starting from block address x over a range of y blocks (>= IsoBuster 4.8)
FromTo:x:y // Find all objects (files, folders, ..) that are (fully or partially) located in a range starting from block address x ending with block address y (>= IsoBuster 4.8)
The rules that look for a numerical value can be AND together (using &). They cannot be ORed together, but they can be preceeded and/or trailed by other ORed rules
Examples:
lba:1000&bytes:10
These same rules can also be used in combination with >, <, >=, <= and = (the latter '=' is implied if absent)
Examples:
lba:>=1000&lba<2000 will find all objects with an address between 1000 and 2000
lba:>=1000&lba<2000&file:*a* will find all files with an address between 1000 and 2000, containing an 'a' in the filename
lba:>=1000&lba<2000|stream:+++ will find all files with an address between 1000 and 2000, and the search will also include streams. Streams with name +++ will be found too, but the idea here is to give a name that is not present, just to make sure the search covers streams as well.
lba:>=1000&lba<2000|stream:+++|extent:+++ Using previous example logic you can also look in the individual extents
uid:14234 will find (on NTFS) the file or folder using MFT record 14234
bytes:<100|stream:$$$ will find all files and streams smaller than 100 bytes. Stream:$$$ assures that the search also looks into the extents, but the name $$$ will likely not be found, so only the bytes criteria will matter
Other rules:
Limit: // Limit the search to (provided number) objects (If no other rules are provided it will default to finding regular objects (files, folders, ...))
Examples:
*|Limit:50 stops the search after 50 objects have been found
Limit:50 does the same as previous
file:*.txt|Limit:50 stops the search after 50 text files have been found
UID:2000|Limit:1 stops the search after the object with unique ID 2000 has been found
You can start a search for any file, folder, stream, extent or ... using a wide range of options, via two different methods.
Via the search dialog, which is triggered via right mouse click on an object, or via the seach toolbar in the top right corner of the program.
1. The option via the search dialog is rather self explaining.
2. The option via the search toolbar in the top right corner takes a wide range of commands and options.
The most straightforward method is a simple search for a file or folder name, with or without wildcards.
For instance *user*, will find all files and folders with "user" in the name (or extension). Case insensitive.
For instance "Users", "System User" etc.
This search (*user*) is essentially the same as: file:*user*|folder:*user*
Rules that combine object properties and object name (case insensitive, supporting wildcard).
PS. the rules' names are case insensitive too.
File:
Folder:
Stream:
Extent:
RF:
ResourceFork:
Readable:
Unreadable:
Hidden:
Compressed:
Encrypted:
Fragmented:
Embedded:
System:
Deleted:
ReadOnly:
Recovered:
Shortcut:
Sparse:
HasStreams:
HasRF: (HasResourceFork:)
Examples:
*.jpg will find all .jpg files (and folders)
*.jpg|*.bmp will find all .jpg and .bmp files (and folders)
file:*.jpg|file:*.bmp will find all .jpg and .bmp files (not folders)
Compressed:*.log will find all compressed .log files (or .log folders if they exist)
Fragmented:* will find all files and folders that are fragmented (consist of multiple extents)
file:z*|stream:z* will find all files and file/folder streams that start with a 'z'
folder:desktop will find the folder 'desktop'
A property without text, for instance ReadOnly: will return all candidates. It is essentially the same as ReadOnly:*
As you can see in the examples (e.g. file:*jpg*|folder:*jpg*), you can use | (OR) between the different rules
Rules that look for numerical values:
LBA: // Start Address
Address: // Start Address
LastLBA: // Last block of object address
ContainsLBA: // Contains the block with address
UID: // Unique ID (MFT record for NTFS, Inode for MFS, HFS, FE for UDF etc)
Bytes: // The amount of bytes of the object
Blocks: // The amount of blocks contained in the object
StreamCnt: // The amount of streams attached to an object (>= IsoBuster 4.4)
ExtentCnt: // The amount of extents that make up the object (minimum is 1) (>= IsoBuster 4.4)
MemberCnt: // The amount of files and folders in a Folder, or amount of Tracks in a Session, or Sessions on a CD or Partitions on a Disk (>= IsoBuster 4.4)
UnreadableCnt: // The amount of unreadable blocks in an object (>= IsoBuster 4.4)
Range:x:y // Find all objects (files, folders, ..) that are (fully or partially) located in a range starting from block address x over a range of y blocks (>= IsoBuster 4.8)
FromTo:x:y // Find all objects (files, folders, ..) that are (fully or partially) located in a range starting from block address x ending with block address y (>= IsoBuster 4.8)
The rules that look for a numerical value can be AND together (using &). They cannot be ORed together, but they can be preceeded and/or trailed by other ORed rules
Examples:
lba:1000&bytes:10
These same rules can also be used in combination with >, <, >=, <= and = (the latter '=' is implied if absent)
Examples:
lba:>=1000&lba<2000 will find all objects with an address between 1000 and 2000
lba:>=1000&lba<2000&file:*a* will find all files with an address between 1000 and 2000, containing an 'a' in the filename
lba:>=1000&lba<2000|stream:+++ will find all files with an address between 1000 and 2000, and the search will also include streams. Streams with name +++ will be found too, but the idea here is to give a name that is not present, just to make sure the search covers streams as well.
lba:>=1000&lba<2000|stream:+++|extent:+++ Using previous example logic you can also look in the individual extents
uid:14234 will find (on NTFS) the file or folder using MFT record 14234
bytes:<100|stream:$$$ will find all files and streams smaller than 100 bytes. Stream:$$$ assures that the search also looks into the extents, but the name $$$ will likely not be found, so only the bytes criteria will matter
Other rules:
Limit: // Limit the search to (provided number) objects (If no other rules are provided it will default to finding regular objects (files, folders, ...))
Examples:
*|Limit:50 stops the search after 50 objects have been found
Limit:50 does the same as previous
file:*.txt|Limit:50 stops the search after 50 text files have been found
UID:2000|Limit:1 stops the search after the object with unique ID 2000 has been found