asked on

Need help with Powershell script

Greeting Experts,

I have been asked by my boss to create a Power-shell script to scan for Credit Cards and Social Security Numbers on any open shares (Including sub-folders) our network.... After working with the following script below I have not been able to parse any documents ( i.e. .txt, .doc/.docx, .xls/.xlsx, .csv). The script runs fin but the select-String does not pick up anything when I attempt to run it.... I not for sure if I have it correct. Can some one take a look at the script and see what I may be missing.

Get-ChildItem -Path "\\Server\share" -Recurse -Force -Include *.doc, *.docx, *.xls, *.xlsx, *.txt, *.pdf, *.ppt, *.pptx | Select-String “[4|5|3|6][0-9]{3}[-| ][0-9]{4}[-| ][0-9]{4}[-| ][0-9]{4}” | Select-Object Path, Line, LineNumber | Export-Csv “C:\CC_PII.csv”

Open in new window

ASKER CERTIFIED SOLUTION

Bill Prew

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

footech

Just for searching the text files, it should work (though some of the regex looks odd, it works in my testing). You need to make sure that your Get-ChildItem command is finding the files first. Things change a bit when you use the -Include parameter instead of the -Filter parameter. I suggest changing your path to
"\\Server\share\*"

Mike

ASKER

What do you mean when you refer to using -Filter instead of the -Include parameter , footech

footech

Actually, since you're using the -Recurse parameter, the path as listed should be fine. So you can pretty much ignore my prior post.

Let's say you have a folder (c:\temp) with .txt files.
This finds the files as expected.
gci c:\temp -filter *.txt
This doesn't.
gci c:\temp -include *.txt
These also work.
gci c:\temp\* -include *.txt
gci c:\temp -include *.txt -recurse

footech

Bill's post correctly points out that natively PowerShell can only search for strings within text documents. Third-party software is required to parse other formats.

And so #a41888566 should be accepted as the answer.