Hacker News Reader

some endpoint protection services will block anything not signed by a trusted signature or that doesn't match an allow-list of known-good file hashes

My work had software that disables any execution of nonwhitelisted binaries.

How does it maintain the index then? Isn't using the Windows indexing service the reason it works so fast?

It reads the MFT. Then it stores its own index in a file called 'everything.db' which I am pretty sure is a sqlite file.

I don't think the windows indexing service is utilized at all.

Correct, you can turn off windows search index if you want to use everything instead.