[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 675
  • Last Modified:

scripted file auditing without updating file attributes

I’ve been trying to write a file audit script that will obtain some basic attributes of all files on a CIFS based file system, but not modify the last accessed date.

I am extracting the filename, size, last modified date, last access date and most importantly the owner of the file. The first attributes can be obtained without issue, but as soon as I try to extract the file owner, the last access date gets modified.

I have considered making the script overwrite the access date after reading the ownership, but feel that adding a write cycle to the script will add a significant delay to the process.

You can read these attributes manually with explorer with out touching the file, so it seems it should be possible to perform the task via the command line as well.

I’ve written ( and re-written) the script in perl, vb script and have just tried my hand with powershell (aka monad), but the same result seems to occur across all the methods.  
0
schalcraft
Asked:
schalcraft
1 Solution
 
Daniel Van Der WerkenIndependent ConsultantCommented:
0
 
schalcraftAuthor Commented:
Seems that this question is out of the capabilities of this forum, Dan7el's response was a meaningless link in relation to the question posed, and hence, didn't deserve a response.
Regardless, will post the various solutions that I have tried so far in case some one may look for it in the future.

File audit using Monad/Powershell
---------------------------------------------------------------------------------------------------
Write-Host "FileName,Size,Modified,Last Access,Owner"
foreach ($file in Get-ChildItem -rec) {
  $filesize=$file.Length
  if ($filesize -lt 0 ) {
    $filesize=""
    }
  $fileacl=get-acl $file.fullname
  Write-Host $file.FullName $filesize $file.LastWriteTime $file.LastAccessTime $fileacl.Owner -Separator ","
  }
---------------------------------------------------------------------------------------------------

File audit using Perl
ntfsowner module availble from http://peter.verhas.com/progs/perl/ntfsowner/index.html
---------------------------------------------------------------------------------------------------
@ARGV = qw(.) unless @ARGV;
use File::Find;
use ntfsowner;
print "FileName,Size,Modified,Last Access,Owner\n";

sub Usage {
  print "Usage: filescan.pl <path>\n";
}

sub PrintFiles {
    *name=*File::Find::name;
    my ($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size,$atime,$mtime,$ctime,$blksize,$blocks) = stat($name);
    @FilePath = split(/\//,$name);
    $owner=GetNtfsOwner($name);
    $name =~ s/\//\\/g;
    $name =~ s/c://;
    print $name.",".$size.",".$mtime.",".$atime.",".$owner."\n";
}

find(\&PrintFiles,@ARGV);
---------------------------------------------------------------------------------------------------

File audit using vbscript
---------------------------------------------------------------------------------------------------
Dim objArgs
Set StdOut = WScript.StdOut

Set FileSystem = WScript.CreateObject("Scripting.FileSystemObject")
Set objArgs = WScript.Arguments
FolderName = objArgs(0)
'StdOut.Write FolderName
StdOut.Write "FileName,Size,Modified,Last Access,Owner" & VbCrlf

Set objShell = CreateObject ("Shell.Application")
ListFiles(FolderName)  

Sub ListFiles(strFolderName)
   Set objFolder = objShell.Namespace (strFolderName)
   if (not objFolder is nothing) Then
   For Each strFileName in objFolder.Items
     if (objFolder.GetDetailsOf(strFileName, 1) = "") Then
       strSubFolderName = strFolderName & "\" & objFolder.GetDetailsOf(strFileName, 0)
       ListFiles(strSubFolderName)
     else
       filesize = replace(objFolder.GetDetailsOf(strFileName, 1),",","")
       filesize = replace(filesize," KB","")
       StdOut.Write chr(34) & strFolderName & "\" & strFileName & chr(34) & "," _
       & filesize & "," _
       & objFolder.GetDetailsOf (strFileName, 3) & "," _
       & objFolder.GetDetailsOf (strFileName, 5) & "," _
       & objFolder.GetDetailsOf (strFileName, 8) & VBCrlf
       end if
     Next
  End if
'  Set objFolder=nothing
End Sub
---------------------------------------------------------------------------------------------------
0
 
VenabiliCommented:
>>Dan7el's response was a meaningless link in relation to the question posed, and hence, didn't deserve a response.
Next time say that something had not helped. otherwise NOONE will EVER post another comment in the question. And ANY expert deserve an answer for volunteering their time to try to help you...
0
 
schalcraftAuthor Commented:
Poor wording on my behalf, no offence intended.
0
 
CetusMODCommented:
PAQed with points refunded (500)

CetusMOD
Community Support Moderator
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now