Property Value Queries

With property value queries, you can find files that have property values that match a given criterion. The properties for which you can query include basic file information such as file name and file size, and ActiveX properties including the document summary that is stored in files created by ActiveX-aware applications.

There are two types of property queries:

Relational property queries consist of an “at” character (@), a property name, a relational operator, and a property value. For example, to find all of the files larger than one million bytes, issue the query @size > 1000000.

Regular expression property queries consist of a number sign (#), a property name, and a regular expression for the property value. For example, to find to find all of the video (.avi) files, issue the query #filename *.avi. Regular expressions will never match the special properties contents (#contents) and all (#all). Properties that are not retrievable at query time cannot be used in # queries; these include HTML meta properties not stored in the property cache.

This section covers the following topics:

Property Names
Relational Operators
Property Values

Property Names

Property names are preceded by either the “at” sign (@) or number sign (#) character. Use @ for relational queries, and # for regular expression queries.

If no property name is specified, @contents is assumed.

Properties available for all files include:

Property Name	Description
All	Matches words, phrases, and any property
Contents	Words and phrases in the file
Filename	Name of the file
Size	File size
Write	Last time the file was modified

ActiveX property values can also be used in queries. Web sites with files created by most ActiveX-aware applications can be queried for these properties:

Property Name	Description
DocTitle	Title of the document
DocSubject	Subject of the document
DocAuthor	The document’s author
DocKeywords	Keywords for the document
DocComments	Comments about the document

For a complete list of property names, see the List of Property Names later on this page.

Relational Operators

Relational operators are used in relational property queries.

To Search For	Example	Results
Property values in relation to a fixed value	`@size < 100 @size <= 100 @size = 100 @size != 100 @size >= 100 @size > 100`	Files whose size matches the query
Property values with all of a set of bits on	`@attrib ^a 0x820`	Compressed files with the archive bit on
Property values with some of a set of bits on	`@attrib ^s 0x20`	Files with the archive bit on

Property Values

To Search For	Example	Results
A specific value	`@DocAuthor = Bill Barnes`	Files authored by Bill Barnes
Values beginning with a prefix	`#DocAuthor George*`	Files whose author property begins with George
Files with any of a set of extensions	`#filename *.\|(exe\|,dll\|,sys\|)`	Files with .exe, .dll, or .sys file-name extensions
Files modified after a certain date	`@write > 96/2/14 10:00:00`	Files modified after February 14, 1996 at 10:00 GMT
Files modified after a relative date	`@write > -1d2h`	Files modified in the last 26 hours
Vectors matching a vector	`@vectorprop = { 10, 15, 20 }`	ActiveX documents with a vectorprop value of { 10, 15, 20 }
Vectors where each value matches a criterion	`@vectorprop >^a 15`	ActiveX documents with a vectorprop value in which all values in the vector are greater than 15
Vectors where at least one value matches a criterion	`@vectorprop =^s 15`	ActiveX documents with a vectorprop value in which at least one value is 15

Be sure to use the number sign (#) before the property name when using a regular expression in a property value, and an “at” (@) character otherwise. The equal (=) relational operator is assumed for regular-expression queries.

File name (#filename) is the only property that efficiently supports regular expressions with wildcards to the left of text.

Date and time values are of the form yyyy/mm/dd hh:mm:ss or yyyy-mm-dd hh:mm:ss. The first two characters of the year and the entire time can be omitted. If you omit the first two characters of the year, then 29 or less is interpreted as the year 2000, and 30 or greater is interpreted as the year 1900. All dates and times are in Greenwich Mean Time (GMT).

Dates and times relative to the current time can be expressed by using a hyphen as a minus sign (-) followed by zero or by more integer-unit and time-unit pairs. Time units are expressed as: (y) for years, (m) for months, (w) for weeks, (d) for days, (h) for hours, (n) for minutes, and (s) for seconds. A three-digit millisecond value can be optionally specified after the seconds value in date expressions, for example, 1997/12/8 10:10:03:452.

Currency values are of the form x.y, where x is the whole value amount and y is the fractional amount. There is no assumption about units.

Boolean values are (t) or (true) for TRUE and (f) or (false) for FALSE.

Vectors (VT_VECTOR) are expressed as an opening brace ({), followed by a comma-separated list of values, then a closing brace (}).

Single-value expressions that are compared against vectors are expressed as a relational operator, then a (^a) for all of or a (^s) for some of.

Numeric values can be in decimal or hexadecimal (preceded by 0x).
The contents property does not support relational operators. If a relational operator is specified, no results will be found. For example, @contents Microsoft will find documents containing Microsoft, but @contents=Microsoft will find none. However, @title=vector space returns results only if the entire title is vector space. If you leave out the equal sign, @title vector space returns results even if vector space is only a phrase in a longer title.

Regular Expressions

Regular expressions in property queries are defined as follows:

Any character except asterisk (*), period (.), question mark (?), and vertical bar (|) defaults to matching just itself.

Regular expressions can be enclosed in matching quotes ("), and must be enclosed in quotes if they contain a space ( ) or closing parenthesis ()).

The characters *, ., and ? behave as they behave in Windows; they match any number of characters, match (.) or end of string, and match any one character, respectively.

The character | is an escape character. After |, the following characters have special meaning:

( opens a group. Must be followed by a matching ).

) closes a group. Must be preceded by a matching (.

[ opens a character class. Must be followed by a matching (un-escaped) ].

{ opens a counted match. Must be followed by a matching }.

} closes a counted match. Must be preceded by a matching {.

, separates OR clauses.

* matches zero or more occurrences of the preceding expression.

? matches zero or one occurrences of the preceding expression.

+ matches one or more occurrences of the preceding expression.

Anything else, including |, matches itself.

Between square brackets ([]) the following characters have special meaning:

^ matches everything but following classes. Must be the first character.

] matches ]. May only be preceded by ^, otherwise it closes the class.

- range operator. Preceded and followed by normal characters.

Anything else matches itself (or begins or ends a range at itself).

Between curly braces ({}) the following syntax applies:

|{m|} matches exactly m occurrences of the preceding expression. (0 < m < 256).

|{m,|} matches at least m occurrences of the preceding expression. (1 < m < 256).

|{m,n|} matches between m and n occurrences of the preceding expression, inclusive. (0 < m < 256, 0 < n < 256).

To match *, ., and ?, enclose them in brackets (for example, [*]sample will match *sample).