Script returning large files created recently on the server.

bfuchs
bfuchs used Ask the Experts™
on
Hi Experts,
Looking for a script that gives me all large files created on the server in the past 10 days..
should return file name, date created, size of file, user created.
Thanks in advance.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
what size is your considered for you as a "large" ? 1gb ?
Dean ChafeeIT/InfoSec Manager

Commented:
Here is a one liner for ya:

FORFILES /S /P F:\temp /M *.* /C "cmd /c if @fsize GTR 1000000 echo @path  @fsize"

Open in new window


Replace the F:\temp with whatever path you want to search, change 1000000 to whatever size you want to test for.
Returns full file path and size.

Enjoy
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
This is the PS version:
Change line 1 to the path
Change line 2 to what you call big size (1mb, 15mb, 1gb) are options
Change line 3 "LengthInMBytes" for the one you used in line 2, so if you put in line 2: $BigSize=5Gb, then change the name into "LengthInGBytes", and in the round, change the 1MB for 1 GB. and that's it.

$path="F:\j0rt3g4 2018"
$BigSize = 15mb
Get-ChildItem -Path $path -Recurse -File | where{ $_.Length -gt $BigSize} | select CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/1Mb,2)}}

Open in new window


3.png
Changed BaseName for Name :)
Become a CompTIA Certified Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

Hi Experts,
@Dean,
yours works but does not give me all columns needed.

@Jose,
Not sure how to run powershell scripts.
I saw the following two methods in google.
powershell -noexit "& ""C:\temp\largefiles2.ps1"""
Powershell.exe -File C:\temp\largefiles2.ps1

Open in new window

However getting errors when tried.

Thanks,
Ben
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
To run a powershell script.

  • Take my answer and save it into a text file with name "whatever.ps1"
Then open powershell console (as administrator) and run:
Set-Executionpolicy Unrestricted

Open in new window

And accept the change.
Then navigate to the path where you saved the script, by running:
 cd C:\heres\the\script\

Open in new window


and then just run it:
.\whatever.ps1 

Open in new window

and press enter.

Jose
Hi Jose,

See attached error, not sure what am I missing.

Where can I filter for date range on date created, like only last week or so?
Also would like to have results saved in a file if possible.

Thanks,
Ben
Untitled.png
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
Im this case...

$path="F:\j0rt3g4 2018"
$BigSize = 15mb
$Datetime = (Get-Date).AddDays(-10) #you can also use hours, seconds, minutes,week, months (AddMonths)
Get-ChildItem -Path $path -Recurse -File | where{ $_.Length -gt $BigSize -and $_.CreationTime -gt $Datetime } | select CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/1Mb,2)}}

Open in new window


And run this in the console $PSVersionTable, make sure the major number is greater or equal to 4.
if it's not you need to update it
https://aka.ms/wmf5download
CLR version is 2.1
Build version is 6.0
Do I need to update?

Thanks,
Ben
Dean ChafeeIT/InfoSec Manager

Commented:
@Dean,
yours works but does not give me all columns needed.
Right... sorry missed the date and user.  However, FORFILES does not have a user created return parameter.
Here is with date added:
FORFILES /S /P F:\temp /M *.* /C "cmd /c if @fsize GTR 1000000 echo @path  @fdate @fsize"

Open in new window


Here are all possible returns from FORFILES:
                The following variables can be used in the
                        command string:
                        @file    - returns the name of the file.
                        @fname   - returns the file name without
                                   extension.
                        @ext     - returns only the extension of the
                                   file.
                        @path    - returns the full path of the file.
                        @relpath - returns the relative path of the
                                   file.
                        @isdir   - returns "TRUE" if a file type is
                                   a directory, and "FALSE" for files.
                        @fsize   - returns the size of the file in
                                   bytes.
                        @fdate   - returns the last modified date of the
                                   file.
                        @ftime   - returns the last modified time of the
                                   file.

Open in new window

Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
#a42600508
Yes... you need to update.
@Jose,
See attached.

@Dean,
Will first try the other one as user created is very critical for now (we're trying to clean up our server).

Thanks,
Ben
Untitled.png
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
@bfuchs, it's not gonna work until you update the version of the PowerShell. that version has more than 10 years old.
So update it and then we can move on.
and you need to run it like this ".\<file.ps1>" don't need to run them twice ...
Hi Jose,

I did run the update from that link you suggested above,
and you need to run it like this ".\<file.ps1>"
Did that as shown in attachment.
Perhaps I need to restart, however need  to save all my open docs first, which may take days..

Thanks,
Ben
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
Yeah, you need to reboot after the update. It's the way it is :)
Hi Jose,
I just ran it but it didnt do anything.
As mentioned, I would need the results be saved to a local file, how can I accomplish that?
Thanks,
Ben
Top Expert 2016

Commented:
function Get-BigFiles
{
  <#
      .SYNOPSIS
      This function Searches for New Large Files
      .DESCRIPTION
      This function will check a specified directory for files larger than a specified size in MB, created on or after a specified date, and return a list of files into a specified output filename
      .EXAMPLE
      Get-BigFiles -outputfilename c:\test\output.txt -path c:\users -SizeinMB 10 -newerthan 10
      explains how to use the command
      can be multiple lines
      .EXAMPLE
      Get-BigFiles
      another example
      can have as many examples as you like
  #>
  [CmdletBinding()]
  param
  (
    [Parameter(Mandatory = $true,HelpMessage = 'Enter the Path and filename where you want output to be saved', Position = 0)]
    [String] $outputfilename ,
    
    [Parameter(Mandatory = $true,HelpMessage = 'Which Directory do you want to search?', Position = 1)]
    [string]$searchpath,
    
    [Parameter(Mandatory = $true,HelpMessage = 'What Size of Files in MB do you want to find', Position = 2)]
    [int]$SizeinMB ,
    
    [Parameter(Mandatory = $true,HelpMessage = 'How many days back from today do you want to search', Position = 3)]
    [int]$newerthandays
    
  )
  
  #Requires -Version 3.0
  $Datetime = (Get-Date).AddDays(-1*$newerthandays)
  $BigSize = $SizeinMB * 1mb
  if (Test-Path $searchpath )
  {
    #you can also use hours, seconds, minutes,week, months (AddMonths)
    Write-Output -InputObject ('Searching for files larger than {0:N2} Megabytes. Created on or after {1}'-f ($BigSize/1mb) , $Datetime.Date.ToString('MMM-dd-yyyy'))
    $files = Get-ChildItem -Path $searchpath -Recurse -File |
        Where-Object -FilterScript {
        $_.Length -gt $BigSize -and $_.CreationTime -gt $Datetime 
        } | Select-Object -Property CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/1Mb,2)}}
    write-debug ("Found {0} Files" -f ($files.Count))
    if($files.Count -eq 0){
   
      $files | Out-File $outputfilename
      notepad.exe $outputfilename
      }
    else {
      write-output ("No Large Files Found")
    }
  }
  else 
  {
    Write-Output -InputObject ('Cannot find path: {0}' -f $searchpath)
  }
}
Get-BigFiles

Open in new window

Hi David,

two questions.
A- Will this function return all 4 fields needed, Name, Date, UserName and Size?
B- How do I execute this? I'm mainly familiar with VBA, and this seems like C or Java code?

Thanks,
Ben
Top Expert 2016

Commented:
it is powershell and requires version 3.  this is an expanded script that Jose Gabriel Ortega started .. Didn't see the user created so will have to fix that but it does fulfill the other requirements.
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
You just need to change the parameters on the 1st 4 lines.
Path, full path where you want to search (must be a folder)
DaysBehind, the number of days where you wanna search in the "creationTime" and date.
Bigsize = It's the size of the files that you consider big!, ex: 1kb, 1024kb, 1mb, 1gb .. etc.
Size = it's the unit of the above (if it's gb, the value must be 1gb, if the value above is 15mb the value must be 1mb and so on).

$path="F:\cam"
$DaysBehind = 100 #Number of days behind.
$BigSize = 15mb #2gb #1024kb
$size = 1mb #1gb  #1kb  #this will always be the unit (1kb, 1mb,1gb )

$Datetime = (Get-Date).AddDays(-$DaysBehind) #you can also use hours, seconds, minutes,week, months (AddMonths)
Get-ChildItem -Path $path -Recurse -File | where{ $_.Length -gt $BigSize -and $_.CreationTime -gt $Datetime } | select * # CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/$size,2)}}

Open in new window


Sadly There's no way to get the "username" who created those files since that information is not available in the "Get-ChildItem" Cmdlet. The only way I think this can be done is getting the privileges and seeing who has the "CreatorOwner", and that's quite complicated, I'm skipping that.


If my script won't bring any result that means that with the parameters you are searching there are no files with those parameters. It's quite simple.

If the parameters comply you get results, if not, you're not.
@Jose
I dont get anything returned when trying the below
$path="F:\"
$DaysBehind = 100 #Number of days behind.
$BigSize = 1gb #2gb #1024kb
$size = 1gb #1gb  #1kb  #this will always be the unit (1kb, 1mb,1gb )

Open in new window

And I know there are.
Besides I need the output in a file.

@David,
this is an expanded script that Jose Gabriel Ortega started ..
Still not getting how do I suppose to call it, tried copying it to a ps1 file and executing but nothing get saved.

Thanks,
Ben
Jose Gabriel Ortega CastroTop Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018

Commented:
$path="F:\"
$DaysBehind = 100 
$BigSize = 1gb 
$size = 1gb 

Open in new window


Well, that means that there's nothing created 100 days before of today, over a 1Gb in the F:\ directory.

do you have an F: drive? that's where you want to look at it?
if not you do need to change that.
Joe WinogradDeveloper
Fellow 2017
Most Valuable Expert 2018

Commented:
Hi Ben,
Following up on Scott's "special alert", I'm pulling something that I had started earlier off the back burner. I see that you're still working with other folks on batch and PS scripts, but I'm taking a different approach, i.e., a stand-alone program with a standard Windows installer (a Setup.exe file). I want to make it a more general program so that it can be useful to a wide audience. I'm writing it in the AutoHotkey language, but that really doesn't matter, as it will be a compiled program, i.e., users won't need to have AutoHotkey installed — they'll simply run the installer, like installing most Windows apps.

The program does everything you asked for, and then some, but before going further, I wanted to bounce the specs off you (and anyone else interested) to see if there are any other ideas that would make the program more useful. Here are the current specs:

• Allows the user to specify what a "large file" is (in bytes).

• Although you're looking for 10 days, it allows the user to specify the age of the files to be reported (in days).

• Although you're looking for new files, it has an option to look for old files. In other words, it can find large files not older than the days specified (what you want), but it can also find files older than the days specified (what others may want).

• Although you asked for Created date, it allows the user to specify Created, Modified, or Accessed date.

• Although you asked for just four fields, it provides another one in the results, viz., the number of days old for each file that meets the age and size criteria (based, of course, on the date selected, i.e., Created, Modified, or Accessed).

• Allows the user to specify a CSV or TXT report file in which to save the results. If CSV is chosen, each field is in a separate column so that it loads nicely into Excel; if TXT, the fields are separated from each other with a tab character. The report file has yyyy-MM-dd_HH.mm.ss in the file name, so there will not be any duplicates (due to seconds being in the file name).

• Allows the user to specify the root folder for the search. There is an option to process only the root folder or to recurse into all subfolders of the root folder (no doubt this is what you want, in order to analyze all the files on a server).

• Allows the user to specify the root folder with a drive letter (such as R:\RootFolder, presumably mapped for a server) or a UNC path (such as \\192.168.0.100\RootFolder).

• The report file contains a top section with the execution date/time and the parameters for the run (large file size, days old, root folder, etc.) and a bottom section with summary results from the run (elapsed time, number of files that met criteria, number of files that did not meet criteria, etc.). Between the top and bottom sections, the report file has a line for each file that met the age and size criteria, with the following fields:

(1) file name, including full path

(2) file date/time in yyyy-MM-dd_HH.mm.ss format (Created, Modified, or Accessed, depending on option in effect)

(3) number of days old (Created, Modified, or Accessed, depending on option in effect), formatted with commas

(4) file size in bytes, formatted with commas

(5) username of the owner

• Provides a graphical user interface (GUI) and a command line interface (CLI). The GUI version prompts for the parameters and displays a dialog box when it is finished that shows the location of the report file, offering an option to open it before exiting (opens it with whatever program owns the CSV or TXT file type). The CLI version will allow specification of the parameters on the command line or in a config.ini file (I haven't decided yet which way to go on that).

That's it for now. Looking forward to feedback from you and others. Regards, Joe
Hi Experts,
I'm partially on vacation these days, will try to test again next week.

@Joe,
The write-up is definitely nice-:) but seems you're putting much effort to have this tool be useful, great.
Wondering regarding user created, will it give me user name or pc name?
Also whats about certain folders on the server which I cannot browse (do to permission issues setup by IT folks), will that display those as well?

Thanks,
Ben
Joe WinogradDeveloper
Fellow 2017
Most Valuable Expert 2018

Commented:
> The write-up is definitely nice-:)

Glad you like it.

> seems you're putting much effort to have this tool be useful, great.

Yes, I figure if I'm going to do it, I'd like to generalize it so that it's useful for more folks.

> will it give me user name or pc name?

user name (Owner)

> Also whats about certain folders on the server which I cannot browse (do to permission issues setup by IT folks), will that display those as well?

No. If you don't have permission to access the folder, no program is going to be able to violate that. My program looks at each file in the root folder and, optionally, all of its subfolders to an unlimited depth, and checks the properties for each file: Created, Modified, or Accessed time stamp, size, and owner. If you don't have permission to access the folders/files, it can't do that. Regards, Joe
Hi Joe,

Sorry for my late response, was partially on vacation these days, barely managing to catch up with my urgent tasks waiting..
Let me know when is your software ready for release and will gladly take advantage of it-:).

Thanks,
Ben
Joe WinogradDeveloper
Fellow 2017
Most Valuable Expert 2018

Commented:
Hi Ben,
When I didn't hear from you, I put it on the back burner again...now I'll pull it off again. Should take me just a few days to finish it. Regards, Joe
Developer
Fellow 2017
Most Valuable Expert 2018
Commented:
Hi Ben,
The program, which I'm calling FindBigFiles, is working well now, but I want to do more testing and QA. As mentioned earlier, I wrote it in AutoHotkey, but still have to build the installer, which I'll do with NSIS (Nullsoft Scriptable Install System). In the meantime, please review the attached Quick Start Guide and let me know if you think I missed anything or got anything wrong. Thanks, Joe

Edit on 07-30-18: Installer built. Testing and QA done. Everything working fine. Do you have any comments on the Quick Start Guide? Let me know when you're ready to try it. Regards, Joe
FindBigFiles_v1.1_Quick_Start_Guide.pdf
Hi Experts,
At this moment I will be closing this question, awarding all contributors, as I was shifted to another task, and don't want to keep this open, may return to it at a later occasion.
Thanks,
Ben

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial