Summary: Use Get-Childitem to search the files system with PowerShell.
I saved a file somewhere on my computer and can’t find it. Is there a way to use Windows PowerShell to find it?
Honorary Scripting Guy, Sean Kearney, is here today to show you a cool trick I use all the time. I use PowerShell to search for things constantly!
Why PowerShell? Well, to be honest, I have a bad, bad, bad habit of putting data where it shouldn’t be. Sometimes I’d use locations that the Indexer in Windows isn’t watching. In these situations, even Cortana can’t help me.
We can use Get-Childitem to show a list of files and/or directories quite easily. The following example lists all files on the root of Drive C:
Get-Childitem –Path C:\
If we add a –Recurse parameter, we can show everything that we have access to.
Get-Childitem –Path C:\ -Recurse
So far, this is no different from running the following command in the CMD prompt.
Dir C:\*.* /s
So, why PowerShell?
For searching, PowerShell offers us all the things that we don’t see under the hood. In that folder structure, there are bound to be many files that I cannot access. Those will throw an error (red by default) and makes it very hard to read.
So, we tell PowerShell, “Don’t bother showing me those minor errors, just continue.”
Get-Childitem –Path C:\ -Recurse -ErrorAction SilentlyContinue
But, how do we use this as a search tool? Get-Childitem includes two additional parameters, -include and –exclude . Their functions are pretty simple.
The -include parameter says, “Show me only these files in the search,” and -exclude says, “Keep that stuff out of my way.”
As the person on TV used to say, “But wait! There’s more!”. Sometimes the reason you can’t find a file is because it was stored in the Temporary Outlook folder.
That used to drive me bananas! Because Temporary is a hidden folder, you often will miss that, and so will Get-Childitem. To bypass those issues, add the –force parameter to let it examine those folders as well.
Get-Childitem –Path C:\ -Recurse –force -ErrorAction SilentlyContinue
We could now use this same command to show only the Word documents that I can access or maybe even all the files that I put the letters, HSG, in. Yes, odds are that I was watching too much Babylon 5 and stored a file in my Pictures folder.
Get-Childitem –Path C:\ -Include *HSG* -Recurse -ErrorAction SilentlyContinue
Unfortunately, it pulls up everything, and I mean everything. with the letters, HSG, in it, including folder titles. We can tell it to show only files by using PowerShell. This was introduced in version 3 of PowerShell.
Get-Childitem –Path C:\ -Include *HSG* -File -Recurse -ErrorAction SilentlyContinue
We can also use the the -Exclude parameter to say, “Don’t show me any TMP, MP3, or JPG files.:
Get-Childitem –Path C:\ -Include *HSG* -Exclude *.JPG,*.MP3,*.TMP -File -Recurse -ErrorAction SilentlyContinue
Here is where things really get powerful. Let’s get right down to the nitty gritty. Imagine that it was a really long weekend.
You did the work on Friday. You even forgot the file name! Just how do you sort that out?
In PowerShell, we can filter out files based upon date and time quite easily.
Right now, let’s get the date for June 24, 2016. I’m not planning on this being a long weekend but, hey, I could be sick on Monday so, it’s possible 
There are fancier ways of doing this, but I’m going to use Get-Date because it works internationally. First, supply the year, month, and day.
$FindDate=Get-Date -Year 2016 -Month 06 -Day 24
With this information, I can first off target two things. First, show me all my Word documents, files only, on the entire C: drive, and keep the error messages to yourself, PowerShell.
Get-ChildItem -Path C:\ -Include *.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
Now I can use Where-Object to show only files that were created since the day that I stored in $FindDate. This will include everything since 12:00 AM the morning of that day. We will compare the list against the LastWriteTime property, which is the “Last Time the File was Written to.”
Get-ChildItem -Path C:\ -Include *.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge $FindDate }
Hey, wait. I did some work on the weekend. I only want Friday! Well, we can filter on that, too, by using the AddDays() method to our date and give it a range of 24 hours!
Get-ChildItem -Path C:\ -Include *.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge $FindDate -and $_.LastWriteTime -le $Finddate.adddays(1) }
Of course, most people might want to search only a few spots. Get-Childitem can even be told to “Search only this list of folders.” In the following example, I am going to search the C:\Users folder, an HSG folder on my USB key (Drive L: ), and a folder named “Whoops\Not\This\One” on Drive X:
Get-Childitem -Path C:\Users, L:\HSG, X:\Whoops\Not\This\One -Include HSG*.doc? -Recurse
I hope this helped you along today and empowered you a little further in your daily tasks.
I invite you to follow the Scripting Guys on Twitter and Facebook. If you have any questions, send email to them at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow.
Until then always remember that with Great PowerShell comes Great Responsibility.
Sean Kearney
Honorary Scripting Guy
Cloud and Datacenter Management MVP