Skip to main content desktop

Using Get-ChildItem to Find Files by Date and Time

Kris PowellKris Powell

As sysadmins, we often find ourselves needing to take inventory of the workstations and servers that we manage. We have all likely faced similar questions at some point in our careers. Answers to these questions can be found with the Get-ChildItem command.

  • Which workstations and servers are getting full on space?

  • Which user is a disk hog?

  • Where are all my *.mp3 files?

  • How many marshmallows can I fit into my mouth at once?

These are important questions. We have all probably had the wonderful opportunity to panic when realizing that we’re getting dangerously low on disk space (or marshmallows).

Sure, disk space is cheaper than ever, but that doesn’t mean we shouldn’t be proactive in keeping our disk space utilized efficiently.

PDQ Inventory does a great job at making reports and creating collections based on disk space. It?s easy to identify who has less than 25% disk space, for example. At a glance, I can tell that my workstation has 77% disk space free.

There is a lot of great information here, but what if you want to know which files are the suspect old/large files that you may be able to delete in order to restore your valuable disk space?

In order to determine the all the fancy information about a file (its size, who created it, how old it is, etc), we can use the Get-ChildItem cmdlet.


Get-ChildItem lets us list the items of one or more locations. This functionality is very similar to “dir” on Windows and “ls” on Unix-like systems. In fact, “dir” and “ls” are aliases that you can use indirectly in PowerShell in place of Get-ChildItem.

Get-ChildItem has many parameters (link) to help us find our desired results.

ParameterInput ValueDescription
-Pathstring or StringArrayPath of the items to list. The default Path is the current directory.
–FilterstringFilter to apply to the Path
–RecurseN/ASearch recursively through all subdirectories of the provided Path.

This list is not a complete list. It only shows the parameters that we’ll be using today.

Finding Files in Multiple Locations

You can provide multiple paths as a string array or as several paths separated by commas as in the example provided.

Get-ChildItem -Path Path1, Path2

Finding Specific File Types

We can use wildcards to specify specific filetypes. If we wanted to find all .txt files, we could use this:

Get-ChildItem *.txt

Finding Large Files

In this case, we’re going to look at the length (or size) of the files. In this example, I want to show all files larger than 50 KB.

Get-ChildItem | Where-Object {$_.Length -gt 50KB}

The length is in bytes, so we can use a little trick to get the results back in Megabtyes (MB), which is far easier to read. In order to do this, we’ll need to specify the columns by name and then we’ll perform a calculation on the Length column.

Get-ChildItem | Where-Object {$_.Length -gt 50KB} | `
  Select @{Name="Length";Expression={$_.Length/1MB}}, Name

Finding Old Files

In this case, we’re going to look at the LastWriteTime for each file. In this example, I want to show all files older than 30 days. In order to do that, we have to get the current date with Get-Date, subtract 30 days and then grab everything less than (older than) the resulting date.

Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}

Putting it Together

You can combine these techniques (as well as others) to make a script that works for you.

So, you wanted to find all files in 2 paths (and their respective subdirectories) that were older than 60 days and were larger than 1 MB?

Easy peasy:

$time = (Get-Date).AddDays(-60)
$size = 1MB
Get-ChildItem Path1, Path2 -Recurse | `
  Where-Object {$_.LastWriteTime -lt $time -and $_.Length -gt $size}

Be certain to supply your own paths, of course.

Final Notes

Now, you should be able to find a variety of files in a variety of ways. You can use it to view the file system, the registry or any provider (more info about providers).

You can even take this a step further to delete the found files by piping them into Remove-Item. Just remember that by using the Force parameter, you will have no warning when your files are deleted, so make certain that you know which files you are deleting.

<Insert your awesome script> | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue

Good luck and have fun

  • Did you know that PDQ Deploy has a PowerShell step you can use to deploy your scripts?

This blog post is part of a series on PowerShell:

Ready to put the PowerShell Scanner through its paces?

Take our 14-day Free Trial. Feel the power of the PowerShell scanner.
Start a Trial

Don't miss the next post!

Advanced Filtering - Webcast Transcript

Stay with me on this. Alright. First, let's just do some basics. So we're all on the same page, how do you find data in PDQ inventory

© 2021 Corporation


  • PDQ Deploy ®
  • PDQ Inventory ®
  • Enterprise SL
  • Pricing
  • Downloads
  • Licensing
  • Buy