# Need query to find files written in the last 30 days

I have a 2003 server that has a folder that I have many users saving data to. But I need to find out who is still writing to this folder. Looking for a query that will show the files and the folders they are contained in that have been written to in the last 30 days.

I was trying to use:  dir /O:D /T:W /A:-D /s

But now sure how to set it to show just the last 30days.  Maybe someone has a better query to run.
###### Who is Participating?

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Commented:
Why not simplify your life and look at the computer management shares sessions/shares to see which users have a connection to this share.

your likely have to use powershell to enumerate the files based on recent modify/create date and look at the owner of the files.
Author Commented:
But that doesn't tell me is someone has written to the folder and now is not connected.
Commented:
robocopy.exe can be used for this. For 2003, it's part of the Resource Kit Tools (https://www.microsoft.com/en-us/download/details.aspx?id=17657 (If you don't want to run the install on the server, you can extract the content with 7-zip and just copy robocopy.exe to the machine, or install the ResKit on a test client and copy robocopy to the server).
Since Vista/W2k8, it's part of the OS (so you can run the query remote, if you want to.
The command will not really copy anything, it will just create a list with files with a write stamp in the last 30 days.
Just change "C:\Source" to the folder where you want to start the search; leave the "C:\Dummy", it will not be used.
robocopy.exe "C:\Source" "C:\Dummy" *.* /maxage:30 /L /s /np /r:0 /ndl /njh /njs /nc /ts /fp

To create a file, just add logging (and /tee, so that the console doesn't look so empty ...):
robocopy.exe "C:\Source" "C:\Dummy" *.* /maxage:30 /L /s /np /r:0 /ndl /njh /njs /nc /ts /fp /tee /log:"C:\Temp\FileAgeReport.txt"

I recommend you use FORFILES -- you can use this to check just one directory or the directory and its sub directories; you can then also have to echo (or write to a file) all files that are 30 days old and younger ( /d -30). here is an example
forfiles /p c:\test /s /m *.* /d -30 /c "cmd /c echo @file is at least 30 days old."
Will that work for you?

Experts Exchange Solution brought to you by

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

IT / Software Engineering ConsultantCommented:
@lionelmm,

I also was going to recommend FORFILES, but it also won't be pre-installed so they have to get it out of a resource kit.  But more importantly, FORFILES works well for finding files older than a specified number of days, but not newer than, which is what this question needs.  To do that I think you always have to specify the actual date you want to find files newer than, nut the number of days in the past.  Always seemed odd to me the way they use sign on the /d option to me, who would ever want to look for files modified after some date in the future.

~bp
Well Bill you are the expert on these types of things so I won't disagree except that this is an examples they gave, the one I copied, it was for files less than 360 days or earlier, so I just changed it to -30
IT / Software Engineering ConsultantCommented:
Okay, perhaps an example will help.  O created a folder with three test files in it and set the last modified dates as follows (one older than 30 days, one older than today but newer than 30 days, and one in the future more than 30 days):

B:\ee>dir b:\ee\forfiles

Directory of b:\ee\forfiles

08/06/2015  01:18 PM    <DIR>          .
08/06/2015  01:18 PM    <DIR>          ..
10/01/2015  12:00 AM                 2 file3.txt
08/01/2015  12:00 AM                 2 file2.txt
07/01/2015  12:00 AM                 2 file1.txt
3 File(s)              6 bytes

Now let's do some tests.  First, lets use the /D with a number of days, and the minus sign.  This should select all files older than the specified number of days.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d -30 /c "cmd /c echo @fdate - @path"

7/1/2015 - "b:\ee\forfiles\file1.txt"

Good, that works as expected.  First, lets use the /D with a number of days, and the plus sign.  This should select all files newer than than the specified number of days forward in the future from today (I know, weird).

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d +30 /c "cmd /c echo @fdate - @path"

10/1/2015 - "b:\ee\forfiles\file3.txt"

Okay, that works as documented.  Notice it doesn't find what we need in this question though, which is all files modified more recently than 30 days ago.

The other option with /D is to specify a date.  First, lets use the /D with a date, and the minus sign.  This should select all files older than the specified date.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d -7/06/2015 /c "cmd /c echo @fdate - @path"

7/1/2015 - "b:\ee\forfiles\file1.txt"

Good, as expected.  First, lets use the /D with a number of days, and the plus sign.  This should select all files newer than the specified number of days.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d +7/06/2015 /c "cmd /c echo @fdate - @path"

10/1/2015 - "b:\ee\forfiles\file3.txt"
8/1/2015 - "b:\ee\forfiles\file2.txt"

Works as expected, and could be used to solve this question.  The only wrinkle is rather than specify the cutoff point in days before today, you have to calculate the exact date of that day.

Make any more sense?

~bp
IT / Software Engineering ConsultantCommented:
I'm not really advocating for this one, but if you did want a pure DOS approach without additional EXE files, here is a solution for that.  Adjust the SET lines near the top as needed, and save as a BAT file.

@echo off
setlocal EnableDelayedExpansion

REM Define base for folders, and days to find newer files than
Set BaseDir=c:\temp
set DaysToFind=30

REM Get current date in MM/DD/YYYY format
set Today=
for /f "tokens=* skip=1" %%A in ('wmic os get LocalDateTime') do (
if not defined LocalDateTime (
set LocalDateTime=%%A
set Today=!LocalDateTime:~4,2!/!LocalDateTime:~6,2!/!LocalDateTime:~0,4!
)
)

REM Convert todays date to julian for age checks
call :jDate jToday %Today%

REM Process all Files in the directory, display if newer than days specified
for /r "%BaseDir%" %%A in ("*.*") do (
call :jDate jFile %%~tA
set /A FileAge = !jToday! - !jFile!
if !FileAge! LEQ %DaysToFind% (
ECHO File:[%%A] is [!FileAge!] days old.
)
)

REM Done
exit /b

REM Subroutine to calculate julian date
:jDate return-variable date-string(MM/DD/YYYY)
set DateStr=%~2
set yy=%DateStr:~6,4%
set /A mm=1%DateStr:~0,2%-100
set /A dd=1%DateStr:~3,2%-100
set /a "yy=10000%yy% %%10000,mm=100%mm% %% 100,dd=100%dd% %% 100"
set /a %~1=dd-32075+1461*(yy+4800+(mm-14)/12)/4+367*(mm-2-(mm-14)/12*12)/12-3*((yy+4900+(mm-14)/12)/100)/4
exit /b

~bp
###### It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.