I'm pretty certain that everything doesn't use the NTFS journal[1]. My understanding is that everything uses the file open hooks provided for antivirus to main

I'm pretty certain that everything doesn't use the NTFS journal[1]. My understanding is that everything uses the file open hooks provided for antivirus to maintain the index, which is why it appears instant. Adding a millisecond to each open call is imperceptible to the user, and it takes less time than that if you return immediately and process the index update in the background. [1] happy to be proven wrong.