VolumeIndexer Tools:
Indexing creates an SQLite DB table with fields including the full file path, the file meta-data fields, and the MIME type fields. The meta-data fields, include the mode, which is a bit-field representation of the file access permissions that the operating system enforces. In the index table, the individual permissions are separated into individual fields, one for each of read, write, and execute for each of owner, group, and other users. This facilitates searching and filtering. The time-stamps maintained by the operating system are stored as real numbers rather than readable times, so human readable and sortable time-stamp fields are also included.
The purpose of this is to make all of the files of the scanned folder, down to the lowest branch in the folder hierarchy, searchable and filterable using any of the individual meta-data fields. One simple means of doing the actual filtering is to use a program called DB Browser for SQLite, which is free and easy to install using the software managers built into the various user friendly Linux operating system distributions. If you open the folder/volume indexing database produced by the indexing tool you selected, and then open the index table of the folder you scanned, you can view all of the file index records and filter the records using any combination of the filters which you can enter at the top of each field column.
For evidence files, whether for business, court, or personal use, you will want the file content to be unchangeable. You will at least want to make sure that you know when a file that wasn't supposed to change did. For this purpose, the VolumeIndexer tools optionally produce an archive of the files indexed, along with hash signatures of each file, written to the file's index record. Hashing produces a unique signature which can be generated again any time to check for file content changes. If the file in the file system changed, you can still obtain the original from the archive.
Archiving formats generally available in popular operating systems do not record a file's meta-data, however, other than the last-modified time-stamp, so to use the meta-data of the original file you also need the index table. If you just archive files to lock and protect their content, you lose most of the meta-data and have no way to detect corruption either in the original file or in its archived content.
This does not provide perfect security, but it is a significant improvement over standard archiving for file preservation as well as providing much more searching power than the standard file system search tools.
Here's a demo video of this feature: