As sysadmins, taking inventory of the workstations and servers that we manage is a necessary, but taxing, part of the job. We have all likely stressed ourselves out over similar questions at some point in our jobs:
Which workstations and servers are getting full on space?
Which users are hogging disk space?
Where are all my *.mp3 files?
How many marshmallows can I fit into my mouth at once?
These are all important questions, and they can all be answered using the Get-ChildItem command.
While taking inventory of your servers can give you basic information about what’s taking up your storage space, all the fancy information about an individual file, such as its size, who created it, how old it is, and more, can be found using the Get-ChildItem cmdlet.
Get-ChildItem
Get-ChildItem lets us list the items of one or more locations. This functionality is very similar to “dir” on Windows and “ls” on Unix-like systems. In fact, “dir” and “ls” are aliases that you can use indirectly in PowerShell in place of Get-ChildItem.
Get-ChildItem has many parameters to help us find our desired results.
This list is not a complete list. It only shows the parameters that we’ll be using today.
Finding Files in Multiple Locations
Deleting files that exist in multiple locations can free up precious space on your servers--if you can find them. Using Get-ChildItem, you can find and delete superfluous files instantly.
You can provide multiple paths as a string array or as several paths separated by commas as in the example provided.
Get-ChildItem -Path Path1, Path2
Finding Specific File Types
We can use wildcards to specify specific filetypes. If we wanted to find all .txt files, we could use this:
Get-ChildItem *.txt
Finding Large Files
Sure, disk space is cheaper than ever, but that doesn’t mean we shouldn’t be proactive in keeping our disk space utilized efficiently.
PDQ Inventory does a great job at compiling reports and creating collections based on disk space. These reports make it easy to identify who has less than 25% disk space, for example. At a glance, I can tell that my workstation has 77% disk space free.
There is a lot of great information here, but what if you want to know which files are the suspected large files that are taking up your valuable disk space?
In this case, we’re going to look at the length (or size) of the files. For this example, I’ll specify that I want to see all files larger than 50 KB.
Get-ChildItem | Where-Object {$_.Length -gt 50KB}
The length is in bytes, so we can use a little trick to get the results back in Megabytes (MB), which is far easier to read. In order to do this, we’ll need to specify the columns by name and then we’ll perform a calculation on the Length column.
Get-ChildItem | Where-Object {$_.Length -gt 50KB} | `
Select @{Name="Length";Expression={$_.Length/1MB}}, Name
Finding Old Files
This command can be used in a number of ways to locate files that are no longer needed in your system. This can include files that were created before a certain date or within a specific time range, the date it was last modified, and more.
In this case, we’re going to look at the LastWriteTime for each file. In this example, I want to show all files older than 30 days. In order to do that, we have to get the current date with Get-Date, subtract 30 days and then grab everything less than (older than) the resulting date.
Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}
Putting it Together
The great thing about Get-ChildItem is that it allows you to kill several birds (or several hours of inventory) with one stone. You can combine these techniques,as well as others, to make a script that works for you.
For instance, say you wanted to find all files in two paths plus their respective subdirectories, that were older than 60 days and larger than 1 MB?
Easy peasy:
$time = (Get-Date).AddDays(-60)
$size = 1MB
Get-ChildItem Path1, Path2 -Recurse | `
Where-Object {$_.LastWriteTime -lt $time -and $_.Length -gt $size}Be certain to supply your own paths, of course.
Final Notes
Now, you should be able to use Get-ChildItem to find a variety of files in a variety of ways. You can use it to view the file system, the registry or any provider (more info about providers here).
You can even take this a step further to delete the found files by piping them into Remove-Item. Just remember that by using the Force parameter, you will have no warning when your files are deleted, so make certain that you know which files you are deleting.
<Insert your awesome script> | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
