Everywhere All articles Download

How macOS actually works

The MFT, and why APFS has nothing like it

Updated 2026-07-31 · 8 min read

One structural difference between the two filesystems explains almost every complaint a Windows switcher has about Mac search. It is worth ten minutes.

What the MFT is

Every NTFS volume contains a Master File Table. It is a flat array of fixed-size records, one per file and directory, holding the name, size, timestamps and location of every single thing on that volume. NTFS needs it to function — it is not a search feature, it is the filesystem's own bookkeeping.

The important property is that it is *contiguous and enumerable*. A program with the right permission can open the volume, read the MFT from beginning to end as one long sequential stream, and come out the other side knowing every file on the disk.

On a modern SSD, reading a few hundred megabytes sequentially takes about a second.

What Everything does with it

Everything reads the MFT once at startup, keeps the filenames in memory, and then watches the USN journal — NTFS's change log — for updates. When a file is created or renamed, the journal says so, and Everything patches its in-memory copy.

Searching is then trivial. It walks its array of names and keeps the ones matching your text. There is no clever index, no inverted word list, no ranking model. It is a linear scan over memory, which on a few million entries takes single-digit milliseconds.

This is why Everything has no settings worth configuring and no "please wait, indexing" phase to speak of. The hard part was already done by NTFS.

What APFS offers instead

APFS is a good filesystem with genuinely useful properties — snapshots, clones, space sharing, strong crash consistency. What it does not offer is a readable, enumerable table of every file on the volume.

Its metadata lives in B-trees, keyed for looking things up by parent directory. That structure is excellent for the question a filesystem is normally asked — "what is inside this folder?" — and useless for the question a search tool asks: "what exists anywhere?"

There is no supported way to read it in one pass. So a Mac tool has to ask the first question, over and over, for every directory on the disk:

readdir("/")            -> Applications, Library, System, Users, ...
readdir("/Users")       -> sam, Shared, ...
readdir("/Users/sam")   -> Desktop, Documents, Downloads, ...

Millions of calls, each one a round trip into the kernel. Parallelising helps, because the calls are independent and modern Macs have cores to spare. It does not turn millions of calls into one sequential read.

The numbers

On a six-million-file Mac, a well-optimised parallel directory walk takes about 31 seconds. Reading an MFT describing the same number of files takes about one second. That gap is the filesystem, not the programmer.

The good news is that the gap only applies to the *first* index. Afterwards both platforms are in the same position: keep an in-memory list current from a change-notification stream, and search it by scanning. macOS provides FSEvents for that, which is a perfectly good equivalent to the USN journal.

So the realistic Mac version of Everything is: wait about half a minute once, then have instant search forever. Every Mac tool that claims otherwise is either querying Spotlight's index (and inheriting its exclusions) or searching live each time (and paying the cost per search instead of once).

Why Spotlight does not solve this

Spotlight *does* maintain an index, and it is built during a similar directory walk. But Spotlight is a content and metadata index, not a filename table. It deliberately skips ~/Library, package contents, developer directories and anything in a .noindex folder, and it ranks results by relevance rather than listing all of them.

That is a reasonable design for "find me the document about the merger" and the wrong one for "show me every file called config.json". Everything was always the second kind of tool, which is why Spotlight front-ends do not scratch the itch.

Common questions

Why can't a Mac app just read APFS metadata directly?

APFS stores metadata in B-trees keyed by parent directory, with no supported API to enumerate the whole volume. Parsing the raw structures would break on every macOS update.

Does an SSD make the first index fast?

It helps, but the bottleneck is millions of kernel round trips rather than raw disk throughput. That is why parallelism helps more than drive speed.

Is FSEvents as good as the USN journal?

For staying current, yes. Both report changes cheaply. The difference is only in building the initial list.

Could Apple add an MFT-like table to APFS?

Technically yes, and Spotlight's own index is a partial version of one. Nothing suggests it is planned as a public interface.

Find any file before you finish typing

Everywhere keeps track of every file on your Mac — including the folders Spotlight hides and drives you have unplugged. Free for a day, then $19 once.

Download for Mac

Related

© 2026 Caretopia Network Private Limited Everywhere for Mac Articles Privacy Support