Either, not and exact: boolean file search on a Mac
· 6 min read
Three operators cover almost every awkward search on a Mac. Quotation marks around a phrase force an exact match instead of a loose one. OR in capitals, between two terms, finds either. A minus sign immediately before a word, or NOT in capitals, excludes it. Those work in the Spotlight window and in the Finder search field.
Finder also has a visual version of the same logic in its criteria rows, and Terminal has a stricter version that never guesses. Here is each, with the cases where one beats the others.
Exact: quotation marks
Type quarterly report and Spotlight looks for documents relating to both words, in any order, plus anything whose name merely starts with one of them.
Type "quarterly report" and you are asking for that phrase, in that order, as written.
This is the single most useful operator, and the one people skip. It is what turns a search for a common word into a search for the thing you actually remember. If you recall a sentence from inside a document, quote four or five words of it rather than one.
Two things to know about exactness on a Mac. Searches are not case sensitive, so quoting does not make them so. And Spotlight matches from the start of words, which is why "report 2024" finds Report 2024 final.pdf but nothing matches a fragment from the middle of a word.
Either: OR, and the Any group
invoice OR receipt returns files matching either. The capitals are required; a lowercase or is treated as a word to search for.
You can combine it with the type filters: kind:pdf OR kind:docx narrows to two document types and nothing else, and invoice kind:pdf OR kind:docx applies the word across both.
Finder has this as a control rather than a syntax, and it is more reliable when a query gets complicated.
- In a Finder window, press Cmd-F.
- Hold the Option key. The plus button at the right of the scope row becomes an ellipsis.
- Click it. A group appears headed All of the following are true.
- Change All to Any.
- Add a row inside the group for each alternative, for example Kind is PDF and Kind is Word document.
Rows inside an Any group are alternatives; rows outside the group still apply to everything. That is how you say “modified this month, and either a PDF or a Word document” without typing a query at all. Finder search tips that actually narrow things down covers the rest of what those rows can filter on.
Not: the minus sign and the None group
budget -draft finds files matching budget while excluding anything matching draft. No space between the minus sign and the word. NOT in capitals does the same job and reads better in a longer query.
Exclusion is what rescues a search from a folder full of near-identical files. contract -signed -old -v2 gets you down to the one you meant faster than adding more positive terms ever will.
The visual version is the same nested group with None of the following are true selected. A None group containing a Name row set to contains screenshot removes every screenshot from a result list in one move, permanently, if you save the search as a Smart Folder.
Where exclusion stops helping: it only removes things the index knows about. If a file is missing from results for a different reason, no amount of narrowing brings it back. Spotlight cannot find a file you know exists works through those causes.
The filters worth pairing them with
Operators get much better with the attribute filters they combine with.
kind:takes plain words:kind:pdf,kind:image,kind:folder,kind:music,kind:presentation.date:takes plain words too:date:today,date:yesterday,date:this week.name:restricts the match to filenames, ignoring document contents.tag:matches Finder tags by color name or by whatever you renamed them to.author:matches the document author recorded in the file, which is often set and often wrong.
So name:invoice kind:pdf date:this month -paid is a complete question: PDFs whose names contain invoice, touched this month, excluding anything about being paid.
Behavior varies a little between macOS versions and between the Spotlight window and the Finder field. If a typed query returns something odd, rebuild it with criteria rows, where nothing is being interpreted.
The Terminal versions, which never guess
Two commands, with different strengths. Open Terminal at a folder on a Mac covers getting a shell pointed at the right place first.
mdfind reads the same Spotlight index, so it is fast and it inherits the same blind spots:
mdfind -onlyin ~/Documents -name invoice
mdfind -onlyin ~/Documents "kMDItemFSName == '*.pdf'c || kMDItemFSName == '*.docx'c"
The c after a pattern means case insensitive. || is either and && is both. Add -count to get a number instead of a list when you are checking whether a query is sane before you read the results.
find walks the disk itself, so it ignores the index entirely and finds things Spotlight refuses to show, at the cost of speed:
find ~/Documents \( -iname "*.pdf" -o -iname "*.docx" \) -iname "*invoice*"
find ~ -iname "*.jpg" ! -path "*/Library/*" 2>/dev/null
-o is either, and the escaped parentheses group it. ! before a test negates it. The 2>/dev/null at the end discards the permission errors you will otherwise get from folders your account cannot read.
When a query gets fiddly, the honest fallback is to search broadly and filter the output: mdfind -name invoice | grep -v Library is easier to reason about than a long predicate, and you can see exactly what it removed.
When the operators are the interface
There is a category of search app built around typing operators rather than clicking filters, and it suits people who already think in these terms.
Everywhere uses a short set: quotes for an exact match, | for either, ! for not, plus path: to restrict to a folder, ext: for a file type and size: for a threshold. They are suggested as you type, and Cmd-slash lists every one of them. Because it holds its own catalog of filenames rather than querying the Spotlight index, exclusions apply to things Spotlight will not show you either, including files inside the Mail store and on drives that are currently unplugged.
The trade is that it searches names and paths, not the text inside documents. For “the file with this sentence in it”, the quoted phrase in Spotlight is still the tool, and no operator changes that.
Questions
Does AND do anything, or is it implied?
It is implied: two words separated by a space are already treated as both. Typing AND is harmless and sometimes makes a long query with several OR clauses easier to read.
Why does OR seem to be ignored?
Usually because it was typed in lowercase, in which case it is searched for as a word. Capitals are required for all three of AND, OR and NOT.
Can I mix quotes and exclusion?
Yes. "annual review" -template is valid, and the quoted phrase is treated as one term. Put the minus sign directly against the word or phrase it applies to, with no space.
Is there a way to test whether my query is doing what I think?
Run it through mdfind with -count first. A query that returns zero when you expected a handful, or forty thousand when you expected ten, tells you the syntax is being read differently than you intended before you start scrolling.