scripted file auditing without updating file attributes

Posted on 2006-05-08
Last Modified: 2013-11-23
I’ve been trying to write a file audit script that will obtain some basic attributes of all files on a CIFS based file system, but not modify the last accessed date.

I am extracting the filename, size, last modified date, last access date and most importantly the owner of the file. The first attributes can be obtained without issue, but as soon as I try to extract the file owner, the last access date gets modified.

I have considered making the script overwrite the access date after reading the ownership, but feel that adding a write cycle to the script will add a significant delay to the process.

You can read these attributes manually with explorer with out touching the file, so it seems it should be possible to perform the task via the command line as well.

I’ve written ( and re-written) the script in perl, vb script and have just tried my hand with powershell (aka monad), but the same result seems to occur across all the methods.  
Question by:schalcraft
    LVL 19

    Expert Comment

    by:Daniel Van Der Werken
    LVL 2

    Author Comment

    Seems that this question is out of the capabilities of this forum, Dan7el's response was a meaningless link in relation to the question posed, and hence, didn't deserve a response.
    Regardless, will post the various solutions that I have tried so far in case some one may look for it in the future.

    File audit using Monad/Powershell
    Write-Host "FileName,Size,Modified,Last Access,Owner"
    foreach ($file in Get-ChildItem -rec) {
      if ($filesize -lt 0 ) {
      $fileacl=get-acl $file.fullname
      Write-Host $file.FullName $filesize $file.LastWriteTime $file.LastAccessTime $fileacl.Owner -Separator ","

    File audit using Perl
    ntfsowner module availble from
    @ARGV = qw(.) unless @ARGV;
    use File::Find;
    use ntfsowner;
    print "FileName,Size,Modified,Last Access,Owner\n";

    sub Usage {
      print "Usage: <path>\n";

    sub PrintFiles {
        my ($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size,$atime,$mtime,$ctime,$blksize,$blocks) = stat($name);
        @FilePath = split(/\//,$name);
        $name =~ s/\//\\/g;
        $name =~ s/c://;
        print $name.",".$size.",".$mtime.",".$atime.",".$owner."\n";


    File audit using vbscript
    Dim objArgs
    Set StdOut = WScript.StdOut

    Set FileSystem = WScript.CreateObject("Scripting.FileSystemObject")
    Set objArgs = WScript.Arguments
    FolderName = objArgs(0)
    'StdOut.Write FolderName
    StdOut.Write "FileName,Size,Modified,Last Access,Owner" & VbCrlf

    Set objShell = CreateObject ("Shell.Application")

    Sub ListFiles(strFolderName)
       Set objFolder = objShell.Namespace (strFolderName)
       if (not objFolder is nothing) Then
       For Each strFileName in objFolder.Items
         if (objFolder.GetDetailsOf(strFileName, 1) = "") Then
           strSubFolderName = strFolderName & "\" & objFolder.GetDetailsOf(strFileName, 0)
           filesize = replace(objFolder.GetDetailsOf(strFileName, 1),",","")
           filesize = replace(filesize," KB","")
           StdOut.Write chr(34) & strFolderName & "\" & strFileName & chr(34) & "," _
           & filesize & "," _
           & objFolder.GetDetailsOf (strFileName, 3) & "," _
           & objFolder.GetDetailsOf (strFileName, 5) & "," _
           & objFolder.GetDetailsOf (strFileName, 8) & VBCrlf
           end if
      End if
    '  Set objFolder=nothing
    End Sub
    LVL 20

    Expert Comment

    >>Dan7el's response was a meaningless link in relation to the question posed, and hence, didn't deserve a response.
    Next time say that something had not helped. otherwise NOONE will EVER post another comment in the question. And ANY expert deserve an answer for volunteering their time to try to help you...
    LVL 2

    Author Comment

    Poor wording on my behalf, no offence intended.

    Accepted Solution

    PAQed with points refunded (500)

    Community Support Moderator

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Why You Should Analyze Threat Actor TTPs

    After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

    Introduction Raise your hands if you were as upset with FireMonkey as I was when I discovered that there was no TListview.  I use TListView in almost all of my applications I've written, and I was not going to compromise by resorting to TStringGrid…
    Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    Viewers will learn how to properly install Eclipse with the necessary JDK, and will take a look at an introductory Java program. Download Eclipse installation zip file: Extract files from zip file: Download and install JDK 8: Open Eclipse and …

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now