Powershell: Find files modified after a certain date

Had a requirement to find any files that had been added/modified within a folder structure after a certain date. This seems to do the job nicely:
get-childitem "some folder" -recurse | where-object {$_.mode -notmatch "d"} | where-object {$_.lastwritetime -gt [datetime]::parse("18/07/2010")} | format-table lastwritetime, fullname -autosize | out-file newfiles.log -append

Explanation:

get-childitem is equivalent to the DOS (or PowerShell!) dir command, -recurse is fairly obvious, similar to dir /s
where-object allows you to filter out stuff based on criteria being true (or false if you use {-not (code)}. The $_.mode “d” parameter marks folders (aka directories) and -notmatch therefore means we only pass on things that are not folders. lastwritetime is the NTFS last modified date/time, a bit of fiddling is required to get the date into a format that -gt (greater than) can handle (but only if you are not used to using American date formatting of mm/dd/yyyy or UTC style yyyy/mm/dd – if I had written the date as 07/18/2010 or 2010/07/18 the [datetime]::parse() is not required – not very intuitive as the date is listed in the localised format in the output of this script, in my case dd/mm/yyyy).
format-table allows you to get the output in table format (vs list, custom, wide), to specify which columns you’re interested in, and -autosize stops it being stupid (loads of padding after the date/time and truncated filenames/paths)
out-file send the output to a file, and -append does as you’d expect, and can still be used if the file does not already exist

This entry was posted in PowerShell, Scripting. Bookmark the permalink.

4 Responses to Powershell: Find files modified after a certain date

  1. Jeshii says:

    Thank you! This is exactly what I needed. XD

  2. Alan Miller says:

    I ended up with something similar, but added a couple of things based on other searching due to filename truncation. My final was
    get-childitem “c:\” -recurse | where-object {$_.mode -notmatch “d”} | where-object {$_.lastwritetime -gt [datetime]::parse(“11/01/2012″)} | format-table @{Expression={$_.lastwritetime};Label=”LastWrite”;width=25}, fullname -wrap -autosize | out-file newfiles6.log -width 800 -append

    The width=25 formatting for the date/time made it fixed-width wide enough for all the data so I could import to Excel as fixed-width. The -wrap after fullname was one way to keep it from truncating filenames, but the -width 800 at the end is what really fixed that issue for me. The -width argument tells it that’s how wide the console is, because apparently PowerShell defaults to wrapping (or truncating with …) at the console width.

  3. Alex Aberle-Leeming says:

    I actually needed something to find files modified in the last hour, and this simple modification using AddHours worked really well:

    get-childitem “some_dir” -recurse | where-object {$_.mode -notmatch “d”} | where-object {$_.lastwritetime -gt [datetime]::Now.AddHours(-1)} | format-table lastwritetime, fullname -autosize | out-file newfiles.log -append

    Thanks very much for the original post!!

  4. Gary says:

    Kudos mate! Nothing better than a one liner!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s