PowerShell cmdLet Get-ChildItem

List files that were modified in the last 24 hours

The following pipeline shows files (not directories) that were modified during the last 24 hours.

The forEach-object part is required to transform the returned objects into strings.

get-childItem -recurse -attributes !directory | where-object { $_.lastWriteTime -gt (get-date).addDays(-1) } | foreach-object { $_.directoryName + '\' + $_.name }

List files that were written at a given date or in a specific period

The following command finds files that were written at a given date, irrespective from the hour, minute or second:

get-childItem -recurse | where-object { $_.LastWriteTime.ToString('yyyy-mm-dd') -eq '2022-06-07' }

This pipieline finds .sql files that were written in the month of January of the current year:

$root = "C:\Path\to\dir

$begDt = get-date -year (get-date).year -month 1 -day 1
$endDt = get-date -year (get-date).year -month 2 -day 1

$files = get-childItem -path $root -filter *.sql -recurse | where-object { $_.lastWriteTime -ge $begDt -and $_.lastWriteTime -lt $endDt }
$files

Find items whose name contain a given pattern (globbing)

With -filter, it is possible to get a list of items whose names have a specific wildcard pattern.

The following command lists files and directories that contain il in their names:

get-childItem -filter *il*

Github repository about-PowerShell, path: /cmdlets/childItem/filter-il.ps1

As per Microsoft's documentation, only the file system provider supports filtering.

Using -filter on filename extensions

Using -filter on filename extensions is problematic. The following snippet also finds files that end in *.sql~, *.sqlx etc:

foreach ($file in get-childItem -recurse -filter *.sql) {
   write-host $file
}

Therefore, it is (probably) better to use -include rather than -filter.

-include

-include allows to specify an array of filename patterns that further removes items from matched files that are not matched by the filename patters.

-include only works in conjunction with at least one -recurse, -depth or -path.

Unlike -filter, -include is implemented by PowerShell.

Because -filter requires -path if -recurse and -depth are not specified, the the first of the following two commands does not return anything, but the second does (if there are *.txt files in the current directory):

get-childItem   -include *.txt
get-childItem * -include *.txt

See also the parameter -include of get-childItem.

List or exclude items with specific attributes (such as files, directories etc.)

The -attributes option allows to only list or excludeitems with a given set of attributes. The list of attributes that can be specified is that of System.IO.FileAttributes.

For example, to list only directories, the following would do

get-childItem -attributes directory

This command can be abbreviated with:

ls -at d

The type given to the -attributes option is a System.Managment.Automation.FlagsExpression<System.IO.FileAttribute>, thus, by the power of FlagsExpression, the FileAttribute flags can be combined:

get-childItem -attributes !directory+!system+encrypted, !directory+!system+compressed

Find files whose size exceeds a given limit

The following pipeline finds files whose size exceed 100 kilobetytes.

Files (-attr !d) that match the criteria ($_.length -gt 100kb) are piped into resolve-path with the -relative to

1) print the relative path only
2) remove the «directory headings» (which is even more important to me)

gci -r -attr !d | ? {$_.length -gt 100kb } | % { resolve-path $_.fullName -relative }

Getting child items from a given location

By default, get-childItem returns items from the current location (get-location).

With the -path option, it is possible to get the child items from another location:

get-childItem -path $env:temp -recurse -name

The explicit text -path can be omitted, so that the following command is equivalent:

get-childItem $env:temp -recurse -name

Returned type of get-childItem

If get-childItem is invoked in a file system drive, get-childItem returns an array of System.IO.DirectoryInfo and System.IO.FileInfo objects, both of which derive from System.IO.FileSystemInfo.

If used in a drive that accesses the registry, it returns an array of Microsoft.Win32.RegistryKey objects.

The fact that get-childItem returns specific objects turns out to be problematic if these objects are compared with comparison operators (such as -eq) to a string. The following probably won't do what the author expected to do:

foreach ($file in get-childItem *) {
   if ($file -eq "readme.txt") {
      ...
   }
}

In order to have get-childItem return an array of strings, it must be invoked with the -name argument.

Let get-childItem return strings with -name

When get-childItem is invoked with the -name parameter, the cmdLet returns an array of strings rather then specialized types for the child items.

This is especially useful to get a more readable (imho) output, especially when combined with -recurse (in which case it behaves like the good old cmd.exe command dir /b …).

Querying child items from another provider (such as the registry, environment variables etc.)

Usually, get-childItem is used to list files and directories. However, it can also list items from a non file system provider by prepending the path with the provider and a colon.

The following command lists all environment variables that contain user in their names:

get-childItem env:*user*

The previous command is of course just an abbreviation that omits the -path attribute and is equivalent to

get-childItem -path env:*user*

Listing items from the registry is possible with

get-childItem 'HKCU:\AppEvents\Schemes' -recurse -name

Alternatively, it is also possible to change the location into another provider so that the provider does not need to be prefixed anymore:

set-location hkcu:
get-childItem appEvents\Schemes

Find git repositories

The following pipeline finds git repositories (or more accurately directories that contain a subdirectory named .git).

get-childItem -recurse -directory | foreach-object { if (test-path -pathType container "$($_.fullName)/.git"){ $_.FullName } }

The same idea, but limiting it to git repositories whose (directory name) are matched by the glob *erm*:

get-childItem -recurse -directory -include *erm* | foreach-object { if (test-path -pathType container "$($_.fullName)/.git"){ $_.FullName } }