Powershell - List all Files Changed / Added in the Past 24 hours and Include File Size

I have a Windows 2012 R2 server and need to run a script to list all file that have been added / Changed in the in the lat 24 hours and included their files size.

Here is a sample output I am looking for and if possible export to a CSV.

Date Modified        Size                                    Path
11/17/2015         1.4GB                               w:\user\Stuff\.txt

I am not strong in Powershell yet but getting better and hoping to learn from other on this one as well.
LVL 20
compdigit44Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

oBdACommented:
Here's a script that should do the job. You can optionally pass it an include filter ("*.log", "*.txt").
MinAge and MaxAge expect the respective file ages in hours, and if ExportPath is set, it will write a csv file to the path specified here; otherwise the output will be written to the PS pipeline for further processing.
Param(
	[string]$Path = "C:\",
	[array]$Include,
	[int]$MinAge = 0,
	[int]$MaxAge = 24,
	[string]$ExportPath
)
$MinAccess = (Get-Date).AddHours(-$MinAge)
$MaxAccess = (Get-Date).AddHours(-$MaxAge)
$gciArgs = @{}
If ($Include) {
	$gciArgs["Include"] = $Include
}
$Expression = {
	Get-ChildItem -Path $Path -Recurse -File -Force @gciArgs -ErrorAction SilentlyContinue |
		Where-Object {(($MaxAccess -le $_.LastWriteTime) -And ($_.LastWriteTime -lt $MinAccess)) -Or (($MaxAccess -le $_.CreationTime) -And ($_.CreationTime -lt $MinAccess))} | 
		Select-Object -Property FullName, @{Name="Size MB"; Expression={[math]::Round(($_.Length / 1MB), 3)}}, CreationTime, LastWriteTime
}
If ([string]::IsNullOrEmpty($ExportPath)) {
	Invoke-Command -ScriptBlock $Expression
} Else {
	Invoke-Command -ScriptBlock $Expression |
		ForEach-Object {
			$_
			Write-Host -ForegroundColor White "." -NoNewline
		} |
		Export-Csv -Path $ExportPath -NoTypeInformation
	Write-Host -ForegroundColor White "`r`nResults written to '$($ExportPath)'."
}

Open in new window

1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jose TorresSenior SQL Server DBACommented:
This is a shorter version. oBdA gives you more options
$StartPath = 'C:'
$OutputFile = 'C:\FileList.csv'
Get-ChildItem -Path $StartPath -Recurse -File | Where-Object {$_.LastWriteTime -gt (Get-Date).AddHours(-24)} | Select Name, DirectoryName, LastWriteTime, @{Name="KBytes";Expression={$_.Length / 1Kb}} | Export-Csv $OutputFile -NoTypeInformation

Open in new window

0
oBdACommented:
Jose Torres,
I see two functional issues with your script:
1. Searching a directory tree can take a considerable amount of time, and the cutoff time is calculated in the Where clause when each pipeline element arrives. In other words: the comparison date constantly changes, so a file 23.75 hours old when the script started will not qualify anymore if it's found after the script ran for half an hour.
2. The creation time is not checked to find added files (as per compdigit44's request); LastWriteTime is not enough. If a file is copied to the server, it will keep its original LastWriteTime (which might be way back in the past), and only CreationTime will indicate whether it was added recently.
0
What were the top attacks of Q1 2018?

The Threat Lab team analyzes data from WatchGuard’s Firebox Feed, internal and partner threat intelligence, and a research honeynet, to provide insightful analysis about the top threats on the Internet. Check out our Q1 2018 report for smart, practical security advice today!

compdigit44Author Commented:
Thank you both so very much... One thing I should add though is the fact the volumes I needs to run the script against at 5+TB in side
0
oBdACommented:
Well, try it with a smaller test folder first to see if it suits your needs.
The whole tree might take a while, but that depends on the speed of your storage and the amount of files.
0
compdigit44Author Commented:
When I run the script it does work but does not export anything to a CSV.... What am I doing wrong?
0
oBdACommented:
Did you see a file list in the console? If so, then you didn't pass the -ExportPath argument with a csv file path.
As in
.\Whatever.ps1 -Path C:\Test -ExportPath C:\Temp\report.csv
0
compdigit44Author Commented:
I copied your script as is and did not make any changes except for the path I wanted to scan for file changes.. :o(
0
oBdACommented:
As I said: the script will by default only generate output to the Powershell pipeline, so if you want to, you can assign its output to a variable or pass it down the pipeline to some other function.
To generate a csv, you need to call it with "-ExportPath" as described above.
0
compdigit44Author Commented:
Thank you for your test. The script works fine when I run it again c:\ but when I run it against my target volume which is a mount point the the screen just sits there with no error and not data in the CSV..  I found if I back all the way up to the Q:\ it works but breaks when listing the Drive F mount point

The target path looks like this.... "Q:\Drive F\Marketing"
0
oBdACommented:
What do you mean with "just sits there with no error and not data in the CSV"?
If the prompt is back, then it didn't find anything.
If the prompt isn't back, it should still be busy searching for files matching the date.
0
compdigit44Author Commented:
I found my issue... for what ever reason it does not like the space in my drive path and works fine when I use the root drive letter i.e: C:\ , Q:\ etc...

I tried using quotes but does not help
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.