Script returning large files created recently on the server.

what size is your considered for you as a "large" ? 1gb ?

Here is a one liner for ya:

FORFILES /S /P F:\temp /M *.* /C "cmd /c if @fsize GTR 1000000 echo @path  @fsize"

Select allOpen in new window

Replace the F:\temp with whatever path you want to search, change 1000000 to whatever size you want to test for.
Returns full file path and size.

Enjoy

This is the PS version:
Change line 1 to the path
Change line 2 to what you call big size (1mb, 15mb, 1gb) are options
Change line 3 "LengthInMBytes" for the one you used in line 2, so if you put in line 2: $BigSize=5Gb, then change the name into "LengthInGBytes", and in the round, change the 1MB for 1 GB. and that's it.

$path="F:\j0rt3g4 2018"
$BigSize = 15mb
Get-ChildItem -Path $path -Recurse -File | where{ $_.Length -gt $BigSize} | select CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/1Mb,2)}}

Select allOpen in new window

Changed BaseName for Name :)

Hi Experts,
@Dean,
yours works but does not give me all columns needed.

@Jose,
Not sure how to run powershell scripts.
I saw the following two methods in google.

powershell -noexit "& ""C:\temp\largefiles2.ps1"""
Powershell.exe -File C:\temp\largefiles2.ps1

Select allOpen in new window

However getting errors when tried.

Thanks,
Ben

To run a powershell script.

• Take my answer and save it into a text file with name "whatever.ps1"

Then open powershell console (as administrator) and run:

Set-Executionpolicy Unrestricted

Select allOpen in new window

And accept the change.
Then navigate to the path where you saved the script, by running:

 cd C:\heres\the\script\

Select allOpen in new window

and then just run it:

.\whatever.ps1 

Select allOpen in new window

and press enter.

Jose

Hi Jose,

See attached error, not sure what am I missing.

Where can I filter for date range on date created, like only last week or so?
Also would like to have results saved in a file if possible.

Thanks,
Ben
Untitled.png

Im this case...

$path="F:\j0rt3g4 2018"
$BigSize = 15mb
$Datetime = (Get-Date).AddDays(-10) #you can also use hours, seconds, minutes,week, months (AddMonths)
Get-ChildItem -Path $path -Recurse -File | where{ $_.Length -gt $BigSize -and $_.CreationTime -gt $Datetime } | select CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/1Mb,2)}}

Select allOpen in new window

And run this in the console $PSVersionTable, make sure the major number is greater or equal to 4.
if it's not you need to update it
https://aka.ms/wmf5download

CLR version is 2.1
Build version is 6.0
Do I need to update?

Thanks,
Ben

@Dean,
yours works but does not give me all columns needed.

Right... sorry missed the date and user.  However, FORFILES does not have a user created return parameter.
Here is with date added:

FORFILES /S /P F:\temp /M *.* /C "cmd /c if @fsize GTR 1000000 echo @path  @fdate @fsize"

Select allOpen in new window

Here are all possible returns from FORFILES:

                The following variables can be used in the
                        command string:
                        @file    - returns the name of the file.
                        @fname   - returns the file name without
                                   extension.
                        @ext     - returns only the extension of the
                                   file.
                        @path    - returns the full path of the file.
                        @relpath - returns the relative path of the
                                   file.
                        @isdir   - returns "TRUE" if a file type is
                                   a directory, and "FALSE" for files.
                        @fsize   - returns the size of the file in
                                   bytes.
                        @fdate   - returns the last modified date of the
                                   file.
                        @ftime   - returns the last modified time of the
                                   file.

Select allOpen in new window

#a42600508
Yes... you need to update.

@Jose,
See attached.

@Dean,
Will first try the other one as user created is very critical for now (we're trying to clean up our server).

Thanks,
Ben
Untitled.png

@bfuchs, it's not gonna work until you update the version of the PowerShell. that version has more than 10 years old.
So update it and then we can move on.
and you need to run it like this ".\<file.ps1>" don't need to run them twice ...

Hi Jose,

I did run the update from that link you suggested above,

and you need to run it like this ".\<file.ps1>"

Did that as shown in attachment.
Perhaps I need to restart, however need  to save all my open docs first, which may take days..

Thanks,
Ben

Yeah, you need to reboot after the update. It's the way it is :)

Hi Jose,
I just ran it but it didnt do anything.
As mentioned, I would need the results be saved to a local file, how can I accomplish that?
Thanks,
Ben

function Get-BigFiles
{
  <#
      .SYNOPSIS
      This function Searches for New Large Files
      .DESCRIPTION
      This function will check a specified directory for files larger than a specified size in MB, created on or after a specified date, and return a list of files into a specified output filename
      .EXAMPLE
      Get-BigFiles -outputfilename c:\test\output.txt -path c:\users -SizeinMB 10 -newerthan 10
      explains how to use the command
      can be multiple lines
      .EXAMPLE
      Get-BigFiles
      another example
      can have as many examples as you like
  #>
  [CmdletBinding()]
  param
  (
    [Parameter(Mandatory = $true,HelpMessage = 'Enter the Path and filename where you want output to be saved', Position = 0)]
    [String] $outputfilename ,
    
    [Parameter(Mandatory = $true,HelpMessage = 'Which Directory do you want to search?', Position = 1)]
    [string]$searchpath,
    
    [Parameter(Mandatory = $true,HelpMessage = 'What Size of Files in MB do you want to find', Position = 2)]
    [int]$SizeinMB ,
    
    [Parameter(Mandatory = $true,HelpMessage = 'How many days back from today do you want to search', Position = 3)]
    [int]$newerthandays
    
  )
  
  #Requires -Version 3.0
  $Datetime = (Get-Date).AddDays(-1*$newerthandays)
  $BigSize = $SizeinMB * 1mb
  if (Test-Path $searchpath )
  {
    #you can also use hours, seconds, minutes,week, months (AddMonths)
    Write-Output -InputObject ('Searching for files larger than {0:N2} Megabytes. Created on or after {1}'-f ($BigSize/1mb) , $Datetime.Date.ToString('MMM-dd-yyyy'))
    $files = Get-ChildItem -Path $searchpath -Recurse -File |
        Where-Object -FilterScript {
        $_.Length -gt $BigSize -and $_.CreationTime -gt $Datetime 
        } | Select-Object -Property CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/1Mb,2)}}
    write-debug ("Found {0} Files" -f ($files.Count))
    if($files.Count -eq 0){
   
      $files | Out-File $outputfilename
      notepad.exe $outputfilename
      }
    else {
      write-output ("No Large Files Found")
    }
  }
  else 
  {
    Write-Output -InputObject ('Cannot find path: {0}' -f $searchpath)
  }
}
Get-BigFiles

Select allOpen in new window

Hi David,

two questions.
A- Will this function return all 4 fields needed, Name, Date, UserName and Size?
B- How do I execute this? I'm mainly familiar with VBA, and this seems like C or Java code?

Thanks,
Ben

it is powershell and requires version 3.  this is an expanded script that Jose Gabriel Ortega started .. Didn't see the user created so will have to fix that but it does fulfill the other requirements.

You just need to change the parameters on the 1st 4 lines.
Path, full path where you want to search (must be a folder)
DaysBehind, the number of days where you wanna search in the "creationTime" and date.
Bigsize = It's the size of the files that you consider big!, ex: 1kb, 1024kb, 1mb, 1gb .. etc.
Size = it's the unit of the above (if it's gb, the value must be 1gb, if the value above is 15mb the value must be 1mb and so on).

$path="F:\cam"
$DaysBehind = 100 #Number of days behind.
$BigSize = 15mb #2gb #1024kb
$size = 1mb #1gb  #1kb  #this will always be the unit (1kb, 1mb,1gb )

$Datetime = (Get-Date).AddDays(-$DaysBehind) #you can also use hours, seconds, minutes,week, months (AddMonths)
Get-ChildItem -Path $path -Recurse -File | where{ $_.Length -gt $BigSize -and $_.CreationTime -gt $Datetime } | select * # CreationTime,Name,@{Name = 'LengthInMBytes'; Expression = {[math]::Round($_.length/$size,2)}}

Select allOpen in new window

Sadly There's no way to get the "username" who created those files since that information is not available in the "Get-ChildItem" Cmdlet. The only way I think this can be done is getting the privileges and seeing who has the "CreatorOwner", and that's quite complicated, I'm skipping that.


If my script won't bring any result that means that with the parameters you are searching there are no files with those parameters. It's quite simple.

If the parameters comply you get results, if not, you're not.

@Jose
I dont get anything returned when trying the below

$path="F:\"
$DaysBehind = 100 #Number of days behind.
$BigSize = 1gb #2gb #1024kb
$size = 1gb #1gb  #1kb  #this will always be the unit (1kb, 1mb,1gb )

Select allOpen in new window

And I know there are.
Besides I need the output in a file.

@David,

this is an expanded script that Jose Gabriel Ortega started ..

Still not getting how do I suppose to call it, tried copying it to a ps1 file and executing but nothing get saved.

Thanks,
Ben

$path="F:\"
$DaysBehind = 100 
$BigSize = 1gb 
$size = 1gb 

Select allOpen in new window

Well, that means that there's nothing created 100 days before of today, over a 1Gb in the F:\ directory.

do you have an F: drive? that's where you want to look at it?
if not you do need to change that.

Hi Ben,
Following up on Scott's "special alert", I'm pulling something that I had started earlier off the back burner. I see that you're still working with other folks on batch and PS scripts, but I'm taking a different approach, i.e., a stand-alone program with a standard Windows installer (a Setup.exe file). I want to make it a more general program so that it can be useful to a wide audience. I'm writing it in the AutoHotkey language, but that really doesn't matter, as it will be a compiled program, i.e., users won't need to have AutoHotkey installed — they'll simply run the installer, like installing most Windows apps.

The program does everything you asked for, and then some, but before going further, I wanted to bounce the specs off you (and anyone else interested) to see if there are any other ideas that would make the program more useful. Here are the current specs:

• Allows the user to specify what a "large file" is (in bytes).

• Although you're looking for 10 days, it allows the user to specify the age of the files to be reported (in days).

• Although you're looking for new files, it has an option to look for old files. In other words, it can find large files not older than the days specified (what you want), but it can also find files older than the days specified (what others may want).

• Although you asked for Created date, it allows the user to specify Created, Modified, or Accessed date.

• Although you asked for just four fields, it provides another one in the results, viz., the number of days old for each file that meets the age and size criteria (based, of course, on the date selected, i.e., Created, Modified, or Accessed).

• Allows the user to specify a CSV or TXT report file in which to save the results. If CSV is chosen, each field is in a separate column so that it loads nicely into Excel; if TXT, the fields are separated from each other with a tab character. The report file has yyyy-MM-dd_HH.mm.ss in the file name, so there will not be any duplicates (due to seconds being in the file name).

• Allows the user to specify the root folder for the search. There is an option to process only the root folder or to recurse into all subfolders of the root folder (no doubt this is what you want, in order to analyze all the files on a server).

• Allows the user to specify the root folder with a drive letter (such as R:\RootFolder, presumably mapped for a server) or a UNC path (such as \\192.168.0.100\RootFolder).

• The report file contains a top section with the execution date/time and the parameters for the run (large file size, days old, root folder, etc.) and a bottom section with summary results from the run (elapsed time, number of files that met criteria, number of files that did not meet criteria, etc.). Between the top and bottom sections, the report file has a line for each file that met the age and size criteria, with the following fields:

(1) file name, including full path

(2) file date/time in yyyy-MM-dd_HH.mm.ss format (Created, Modified, or Accessed, depending on option in effect)

(3) number of days old (Created, Modified, or Accessed, depending on option in effect), formatted with commas

(4) file size in bytes, formatted with commas

(5) username of the owner

• Provides a graphical user interface (GUI) and a command line interface (CLI). The GUI version prompts for the parameters and displays a dialog box when it is finished that shows the location of the report file, offering an option to open it before exiting (opens it with whatever program owns the CSV or TXT file type). The CLI version will allow specification of the parameters on the command line or in a config.ini file (I haven't decided yet which way to go on that).

That's it for now. Looking forward to feedback from you and others. Regards, Joe

Hi Experts,
I'm partially on vacation these days, will try to test again next week.

@Joe,
The write-up is definitely nice-:) but seems you're putting much effort to have this tool be useful, great.
Wondering regarding user created, will it give me user name or pc name?
Also whats about certain folders on the server which I cannot browse (do to permission issues setup by IT folks), will that display those as well?

Thanks,
Ben

> The write-up is definitely nice-:)

Glad you like it.

> seems you're putting much effort to have this tool be useful, great.

Yes, I figure if I'm going to do it, I'd like to generalize it so that it's useful for more folks.

> will it give me user name or pc name?

user name (Owner)

> Also whats about certain folders on the server which I cannot browse (do to permission issues setup by IT folks), will that display those as well?

No. If you don't have permission to access the folder, no program is going to be able to violate that. My program looks at each file in the root folder and, optionally, all of its subfolders to an unlimited depth, and checks the properties for each file: Created, Modified, or Accessed time stamp, size, and owner. If you don't have permission to access the folders/files, it can't do that. Regards, Joe

Hi Joe,

Sorry for my late response, was partially on vacation these days, barely managing to catch up with my urgent tasks waiting..
Let me know when is your software ready for release and will gladly take advantage of it-:).

Thanks,
Ben

Hi Ben,
When I didn't hear from you, I put it on the back burner again...now I'll pull it off again. Should take me just a few days to finish it. Regards, Joe

Hi Experts,
At this moment I will be closing this question, awarding all contributors, as I was shifted to another task, and don't want to keep this open, may return to it at a later occasion.
Thanks,
Ben