File Search – Using Powershell

How to search a file located in LocalRemote System using PowerShell

As you can see,  this is about a simple WMI query + Powershell for searching a file with the file extension. In this script, we are connecting to the WMI service of a LocalRemote computer and executing the query to get the file details. After getting the details we setup a foreach loop for the collection to extract the details.

Below is the two important WMI query which we are executing through Powershell. I am searching files with the BMP extension.

$SearchObject = Get-Wmiobject -namespace "rootCIMV2" -computername $System -Query "Select * from CIM_DataFile Where Extension = 'bmp'" $query = "ASSOCIATORS OF {Win32_LogicalFileSecuritySetting='" + $filepath + "'} WHERE AssocClass=Win32_LogicalFileOwner ResultRole=Owner"

1
2
3
4
5
6
7
8

MACHINE_NAME
PING_STATUS
FILE_PATH
USER_NAME
FILE_SIZE
LAST_MODIFIED
SYSTEM_MAKE
SYSTEM_MODEL

Below is the script which is created based on a  project requirement. In this script, I have copied the system hostnames in a .TXT file for searching from multiple systems. ( This is required only if you are searching the files in multiple systems.)

$details = @()
$PCList = Get-Content C:tempPC.TXT

foreach ($System in $PCList)
{
$pstsize = ""
$modified = ""
$Make = ""
$model = ""
$SearchObject = $null

If(!(Test-Connection -Cn $System -BufferSize 16 -Count 1 -ea 0 -quiet))
{
$Result = @{
MACHINE_NAME = "$System"
PING_STATUS = "FAILED"
FILE_PATH = "N/A"
USER_NAME = "N/A"
FILE_SIZE = "N/A"
LAST_MODIFIED = "N/A"
SYSTEM_MAKE = "N/A"
SYSTEM_MODEL = "N/A"
}
$Details += New-Object PSObject -Property $Result
}
Else
{

$MakeDetails = Get-WmiObject -Class win32_computersystem -ComputerName $System
$Make = $MakeDetails.Manufacturer
$Model = $MakeDetails.Model

$SearchObject = Get-Wmiobject -namespace "rootCIMV2" -computername $System -Query "Select * from CIM_DataFile Where Extension = 'bmp'"
#$SearchObject = Get-WmiObject CIM_Datafile -ComputerName $System | Where-Object {$_.Extension -eq 'txt'}

if($SearchObject)
{

foreach ($ObjectFile in $SearchObject)
{

$filepath = $ObjectFile.Drive + $ObjectFile.Path + $ObjectFile.FileName + "." + $ObjectFile.Extension
$query = "ASSOCIATORS OF {Win32_LogicalFileSecuritySetting='" + $filepath + "'} WHERE AssocClass=Win32_LogicalFileOwner ResultRole=Owner"
$FileOwner = Get-Wmiobject -namespace "rootCIMV2" -computername $System -Query $query

$FileOwnerName = $FileOwner.AccountName

$output = $System + "," + $filepath + "," + $filepath + "," + $ObjectFile.FileSize/1KB + "," + $ObjectFile.LastModified
$modified = $ObjectFile.LastModified
$pstsize = $ObjectFile.FileSize/1KB

$Result = @{
MACHINE_NAME = "$System"
PING_STATUS = "SUCCESS"
FILE_PATH = "$filepath"
USER_NAME = "$FileOwnerName"
FILE_SIZE = "$pstsize"
LAST_MODIFIED = "$modified"
SYSTEM_MAKE = "$Make"
SYSTEM_MODEL = "$model"
}
$Details += New-Object PSObject -Property $Result
}
}
else
{
$Result = @{
MACHINE_NAME = "$System"
PING_STATUS = "SUCCESS"
FILE_PATH = "NO PST FILE FOUND"
USER_NAME = "N/A"
FILE_SIZE = "N/A"
LAST_MODIFIED = "N/A"
SYSTEM_MAKE = "$Make"
SYSTEM_MODEL = "$model"
}
$Details += New-Object PSObject -Property $Result
}
}
}

$pathofcsv = "C:TEMP" + "FILE_DETAILS" + "$date" + ".csv"
$Details | export-csv -Path $pathofcsv -Append -NoTypeInformation

The output of the script will be as given below.