Need query to find files written in the last 30 days

I have a 2003 server that has a folder that I have many users saving data to. But I need to find out who is still writing to this folder. Looking for a query that will show the files and the folders they are contained in that have been written to in the last 30 days.

I was trying to use:  dir /O:D /T:W /A:-D /s

But now sure how to set it to show just the last 30days.  Maybe someone has a better query to run.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Why not simplify your life and look at the computer management shares sessions/shares to see which users have a connection to this share.

your likely have to use powershell to enumerate the files based on recent modify/create date and look at the owner of the files.
rdefinoAuthor Commented:
But that doesn't tell me is someone has written to the folder and now is not connected.
robocopy.exe can be used for this. For 2003, it's part of the Resource Kit Tools ( (If you don't want to run the install on the server, you can extract the content with 7-zip and just copy robocopy.exe to the machine, or install the ResKit on a test client and copy robocopy to the server).
Since Vista/W2k8, it's part of the OS (so you can run the query remote, if you want to.
The command will not really copy anything, it will just create a list with files with a write stamp in the last 30 days.
Just change "C:\Source" to the folder where you want to start the search; leave the "C:\Dummy", it will not be used.
robocopy.exe "C:\Source" "C:\Dummy" *.* /maxage:30 /L /s /np /r:0 /ndl /njh /njs /nc /ts /fp

Open in new window

To create a file, just add logging (and /tee, so that the console doesn't look so empty ...):
robocopy.exe "C:\Source" "C:\Dummy" *.* /maxage:30 /L /s /np /r:0 /ndl /njh /njs /nc /ts /fp /tee /log:"C:\Temp\FileAgeReport.txt"

Open in new window

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Lionel MMSmall Business IT ConsultantCommented:
I recommend you use FORFILES -- you can use this to check just one directory or the directory and its sub directories; you can then also have to echo (or write to a file) all files that are 30 days old and younger ( /d -30). here is an example
forfiles /p c:\test /s /m *.* /d -30 /c "cmd /c echo @file is at least 30 days old."
here is more info on forfiles
Will that work for you?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Bill PrewCommented:

I also was going to recommend FORFILES, but it also won't be pre-installed so they have to get it out of a resource kit.  But more importantly, FORFILES works well for finding files older than a specified number of days, but not newer than, which is what this question needs.  To do that I think you always have to specify the actual date you want to find files newer than, nut the number of days in the past.  Always seemed odd to me the way they use sign on the /d option to me, who would ever want to look for files modified after some date in the future.

Lionel MMSmall Business IT ConsultantCommented:
Well Bill you are the expert on these types of things so I won't disagree except that this is an examples they gave, the one I copied, it was for files less than 360 days or earlier, so I just changed it to -30
Bill PrewCommented:
Okay, perhaps an example will help.  O created a folder with three test files in it and set the last modified dates as follows (one older than 30 days, one older than today but newer than 30 days, and one in the future more than 30 days):

B:\ee>dir b:\ee\forfiles

 Directory of b:\ee\forfiles

08/06/2015  01:18 PM    <DIR>          .
08/06/2015  01:18 PM    <DIR>          ..
10/01/2015  12:00 AM                 2 file3.txt
08/01/2015  12:00 AM                 2 file2.txt
07/01/2015  12:00 AM                 2 file1.txt
               3 File(s)              6 bytes

Open in new window

Now let's do some tests.  First, lets use the /D with a number of days, and the minus sign.  This should select all files older than the specified number of days.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d -30 /c "cmd /c echo @fdate - @path"

7/1/2015 - "b:\ee\forfiles\file1.txt"

Open in new window

Good, that works as expected.  First, lets use the /D with a number of days, and the plus sign.  This should select all files newer than than the specified number of days forward in the future from today (I know, weird).

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d +30 /c "cmd /c echo @fdate - @path"

10/1/2015 - "b:\ee\forfiles\file3.txt"

Open in new window

Okay, that works as documented.  Notice it doesn't find what we need in this question though, which is all files modified more recently than 30 days ago.  

The other option with /D is to specify a date.  First, lets use the /D with a date, and the minus sign.  This should select all files older than the specified date.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d -7/06/2015 /c "cmd /c echo @fdate - @path"

7/1/2015 - "b:\ee\forfiles\file1.txt"

Open in new window

Good, as expected.  First, lets use the /D with a number of days, and the plus sign.  This should select all files newer than the specified number of days.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d +7/06/2015 /c "cmd /c echo @fdate - @path"

10/1/2015 - "b:\ee\forfiles\file3.txt"
8/1/2015 - "b:\ee\forfiles\file2.txt"

Open in new window

Works as expected, and could be used to solve this question.  The only wrinkle is rather than specify the cutoff point in days before today, you have to calculate the exact date of that day.

Make any more sense?

Bill PrewCommented:
I'm not really advocating for this one, but if you did want a pure DOS approach without additional EXE files, here is a solution for that.  Adjust the SET lines near the top as needed, and save as a BAT file.

@echo off
setlocal EnableDelayedExpansion

REM Define base for folders, and days to find newer files than
Set BaseDir=c:\temp
set DaysToFind=30

REM Get current date in MM/DD/YYYY format
set Today=
for /f "tokens=* skip=1" %%A in ('wmic os get LocalDateTime') do (
  if not defined LocalDateTime (
    set LocalDateTime=%%A
    set Today=!LocalDateTime:~4,2!/!LocalDateTime:~6,2!/!LocalDateTime:~0,4!

REM Convert todays date to julian for age checks
call :jDate jToday %Today%

REM Process all Files in the directory, display if newer than days specified
for /r "%BaseDir%" %%A in ("*.*") do (
  call :jDate jFile %%~tA
  set /A FileAge = !jToday! - !jFile!
  if !FileAge! LEQ %DaysToFind% (
    ECHO File:[%%A] is [!FileAge!] days old.

REM Done
exit /b

REM Subroutine to calculate julian date
:jDate return-variable date-string(MM/DD/YYYY) 
  set DateStr=%~2
  set yy=%DateStr:~6,4%
  set /A mm=1%DateStr:~0,2%-100
  set /A dd=1%DateStr:~3,2%-100
  set /a "yy=10000%yy% %%10000,mm=100%mm% %% 100,dd=100%dd% %% 100"
  set /a %~1=dd-32075+1461*(yy+4800+(mm-14)/12)/4+367*(mm-2-(mm-14)/12*12)/12-3*((yy+4900+(mm-14)/12)/100)/4
  exit /b

Open in new window

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.