Skip to main content
PDQ.com mobilePDQ.com desktop
Support
Try Now

How to Use Get-ChildItem to Find Files by Date and Time

Kris PowellKris Powell
·

As sysadmins, taking inventory of the workstations and servers that we manage is a necessary, but taxing, part of the job. We have all likely  stressed ourselves out over similar questions at some point in our jobs:

  • Which workstations and servers are getting full on space?

  • Which users are hogging disk space?

  • Where are all my *.mp3 files?

  • How many marshmallows can I fit into my mouth at once?

These are all important questions, and they can all be answered using the Get ChildItem command. 

While taking inventory of your servers can give you basic information about what’s taking up your storage space,  all the fancy information about an individual file, such as its size, who created it, how old it is, and more, can be found using the Get-ChildItem cmdlet.

Get-ChildItem

Get-ChildItem lets us list the items of one or more locations. This functionality is very similar to “dir” on Windows and “ls” on Unix-like systems. In fact, “dir” and “ls” are aliases that you can use indirectly in PowerShell in place of Get-ChildItem.

Get-ChildItem has many parameters to help us find our desired results.

ParameterInput ValueDescription
-Pathstring or StringArrayPath of the items to list. The default Path is the current directory.
–FilterstringFilter to apply to the Path
–RecurseN/ASearch recursively through all subdirectories of the provided Path.

This list is not a complete list. It only shows the parameters that we’ll be using today.

Finding Files in Multiple Locations

Deleting files that exist in multiple locations can free up precious space on your servers--if you can find them. Using Get-ChildItem, you can find and delete superfluous files instantly.

You can provide multiple paths as a string array or as several paths separated by commas as in the example provided.

Get-ChildItem -Path Path1, Path2

Finding Specific File Types

We can use wildcards to specify specific filetypes. If we wanted to find all .txt files, we could use this:

Get-ChildItem *.txt

Finding Large Files

Sure, disk space is cheaper than ever, but that doesn’t mean we shouldn’t be proactive in keeping our disk space utilized efficiently.

PDQ Inventory does a great job at compiling reports and creating collections based on disk space. These reports make it easy to identify who has less than 25% disk space, for example. At a glance, I can tell that my workstation has 77% disk space free.

There is a lot of great information here, but what if you want to know which files are the suspected large files that are taking up your valuable disk space?

In this case, we’re going to look at the length (or size) of the files. For this example, I’ll specify that I want to see all  files larger than 50 KB.

Get-ChildItem | Where-Object {$_.Length -gt 50KB}

The length is in bytes, so we can use a little trick to get the results back in Megabytes (MB), which is far easier to read. In order to do this, we’ll need to specify the columns by name and then we’ll perform a calculation on the Length column.

Get-ChildItem | Where-Object {$_.Length -gt 50KB} | `
  Select @{Name="Length";Expression={$_.Length/1MB}}, Name

Finding Old Files

This command can be used in a number of ways to locate files that are no longer needed in your system. This can include files that were created before a certain date or within a specific time range, the date it was last modified, and more.

In this case, we’re going to look at the LastWriteTime for each file. In this example, I want to show all files older than 30 days. In order to do that, we have to get the current date with Get-Date, subtract 30 days and then grab everything less than (older than) the resulting date.

Get-ChildItem | Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-30)}

Putting it Together

The great thing about Get-ChildItem is that it allows you to kill several birds (or several hours of inventory) with one stone. You can combine these techniques,as well as others, to make a script that works for you.

For instance, say you wanted to find all files in two paths  plus their respective subdirectories, that were older than 60 days and larger than 1 MB?

Easy peasy:

$time = (Get-Date).AddDays(-60)
$size = 1MB
Get-ChildItem Path1, Path2 -Recurse | `
  Where-Object {$_.LastWriteTime -lt $time -and $_.Length -gt $size}

Be certain to supply your own paths, of course.

Final Notes

Now, you should be able to use Get-ChildItem to find a variety of files in a variety of ways. You can use it to view the file system, the registry or any provider (more info about providers here). You can even take this a step further to delete the found files by piping them into Remove-Item. Just remember that by using the Force parameter, you will have no warning when your files are deleted, so make certain that you know which files you are deleting.

<Insert your awesome script> | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue

Good luck and have fun

  • Did you know that PDQ Deploy has a PowerShell step you can use to deploy your scripts?


This blog post is part of a series on PowerShell:

Ready to put the PowerShell Scanner through its paces?

Take our 14-day Free Trial. Feel the power of the PowerShell scanner.
Start a Trial

Don't miss the next post!

Windows 11 First Look

Microsoft is gearing up for the release of Windows 11. Are you ready for it? Here's everything you need to know about Microsoft's newest operating system.

windows11
PDQ.com
© 2021 PDQ.com Corporation
Products
  • PDQ Deploy ®
  • PDQ Inventory ®
  • Pricing
  • Downloads
  • Licensing
  • Buy