How Windows 2000 Indexes Local Files

Microsoft Windows 2000 utilizes an integrated background component known as the Indexing Service to catalog local files for rapid retrieval. By continuously scanning storage volumes and tracking file system modifications, the service extracts both file properties and full-text content into specialized databases called catalogs. This article explains the underlying architecture of the Windows 2000 Indexing Service, how it parses and stores data, and how it enables fast search queries across local drives.

The Indexing Service Architecture

The Indexing Service (executed via the process cisvc.exe) is a core Windows 2000 subsystem adapted from the earlier Index Server technology found in Windows NT 4.0. It runs as a low-priority background service designed to minimize system performance impact while maintaining up-to-date search records.

The service organizes indexed information into structures called Catalogs. By default, Windows 2000 creates a "System" catalog that maps to all local hard drives formatted with NTFS or FAT/FAT32 file systems.

Content and Metadata Extraction

To index both structured file attributes and unstructured file contents, the Indexing Service relies on a modular pipeline:

  1. IFilter Interfaces: The service uses document-specific filters (implemented as DLLs adhering to the IFilter COM interface) to read different file formats. Windows 2000 includes native IFilters for plain text, HTML, and Microsoft Office documents. Third-party applications can register their own IFilters to allow the indexing of proprietary formats.
  2. Word Breakers: Once the raw text is extracted, language-specific word breakers separate streams of characters into individual words based on linguistic rules.
  3. Noise Word Lists: The service filters out common words that provide little search value (such as "the," "is," or "at") using predefined stop-word lists to conserve disk space and speed up queries.
  4. Property Extraction: Standard metadata, including file name, size, creation date, modification date, and author, is recorded alongside the text data.

Change Tracking and the NTFS Journal

On volumes formatted with NTFS, the Indexing Service integrates directly with the NTFS Change Journal (Update Sequence Number or USN Journal). When files are created, modified, or deleted, NTFS records these events in the USN Journal.

Rather than constantly re-scanning the entire storage drive, the Indexing Service reads this log to identify modified files immediately. It then queues only the altered files for re-indexing, dramatically reducing disk I/O. On FAT volumes where the USN Journal is unavailable, the service relies on periodic directory scans.

Search and Query Processing

When a user searches for files using the Windows 2000 Search Companion, Windows Explorer, or custom scripts using Microsoft ActiveX Data Objects (ADO), the query does not perform a brute-force search across the physical disk sectors. Instead, the query engine searches the pre-built indexes stored in the catalog.

The catalog stores inverted indexes, mapping individual terms and metadata attributes directly to file pointers. This enables Windows 2000 to return complex full-text and property-based search results almost instantly, even across drives containing tens of thousands of files.