- [Instructor] Modern operating systems offer metadata based
file indexing and searching, a feature which allows us
to find files on our system very quickly by name
or by content once the system has found
and cataloged our files.
On Windows systems, the file searching function
is called Windows Search.
By default, it indexes a user's content from the documents,
pictures, music and desktop directories.
This includes the name of the files and if Windows Search
or a plugin provided to it can read the file,
it will index the file's contents as well,
allowing us to search for a text within a text document,
office document, or pdf.
The index is stored in a system folder
and is periodically updated as content changes.
We can explore the settings for this feature
in the settings application.
Here we can also set some advanced options.
In the advanced options, we can choose specific sub folders
to exclude from the search scope
and we can add other items too.
And when we plug in an external disc,
we can open its properties to indicate whether
or not it should be indexed as well.
Discs or volumes are tracked by unique identifiers written
to the system volume information directory at their route.
To use the Search feature,
we can search in the start menu or the taskbar
or within Explorer Windows.
macOS offers a metadata based
search function called Spotlight.
On a Mac, the Spotlight service scans files
and records metadata,
and if it can read it, some of the file contents as well.
Once the process of building this index is complete,
we can search for our files and content
on our system very quickly.
Individual Spotlight indexes are stored
on each index volume,
so if we have a disc of sensitive data
and we disconnect that disc from the system,
either by unmounting or ejecting it,
the Spotlight Search feature won't return results for files
that are on that disc.
When we attach the disc again,
the index for that disc will be available to Spotlight
and it will be able to return results on that disc.
Spotlight works this way for a few reasons,
one being security or more specifically secrecy
as we've seen and the other is consistency.
If our Mac keeps the index of removable drives locally and
those drives are subsequently modified in another system,
then our local index would be out of sync with reality.
And an unreliable index isn't very useful.
There's still a little bit of consistency risk
with an index stored on the device,
but Spotlight on any Mac plug a disc into
will eventually update the index.
Windows and Linux won't update the Spotlight index though.
The index data for Spotlight volumes are stored
in the route directory
in a directory called .Spotlight-V100.
This directory can be deleted
without harming our actual data, but if it's missing,
the Mac may attempt to rebuild the index when it discovers
the data it expects to have is missing.
We can search the Spotlight index
through the graphical user interface with Command Space
or at the command line using the command mdfind.
I'll cancel this though.
We can view metadata about the items in the index
with the mdls command.
Spotlight can be administered from the system settings area
or through the mdutility terminal command.
In the spotlight settings,
we can exclude a disc or a folder from being indexed.
The Spotlight index is updated in response
to file system changes.
So when files are created, modified and so on,
the FSEvents feature of macOS tells Spotlight to update
its stored information.
After major operations though like a system update
or extensive changes to a disc's contents,
the Spotlight service may spend
a sizable amount of time re-indexing.
Like Windows Search, Spotlight gives us some flexibility
about what is indexed and allows us to quickly search
for content on our attached discs.
On a Linux system, we can use the mlocate software
to build and search an index of our files.
To create an index or update it periodically
we'd run the updatedb command.
This generates a database file
at var, lib, mlocate, mlocate.db.
Once the database is created,
we can search it with the locate command followed
by a search term.
Unlike on Windows and macOS,
this index isn't updated automatically when files change,
but it is updated on a daily basis by default
by the system's task scheduler
and it only keeps track of file names,
not file contents or other metadata.
There are other file indexing solutions available
for Linux too, but and mlocate is widely used.
All of these indexes
that we've discussed here contain some amount
of information about files they have to in order to operate.
And that means they can present a security risk,
especially if the index is copied or otherwise distributed
to people who shouldn't have it.
That doesn't mean we should totally turn off
these helpful features though,
we just need to be mindful of how their information
is stored and collected
and what options we have to exclude sensitive information
from being indexed.
We can mitigate the risk of information breached through
through these databases by following practices
that we should already have adopted.
Don't mix work and personal files or systems
and keep shared volumes clean.
Take steps to protect sensitive information
such as excluding it from indexers you don't control
or encrypted at rest so it's contents aren't available
to be indexed.
Metadata indexing and the search capabilities
it enables make dealing with a huge amount of data
that we use on a daily basis possible.
But like anything else in the digital world
and in the real world,
there are risks we should be aware of.