
close
close
Chance to win $250 in Petri 2023 Audience Survey
We recently published an article about how to use PowerShell to find folders that contain a certain file type, such as the MP3 file format. I showed you how to search the file system using the DIR command. Although this command works fine when run locally, it might not perform very well if you want to search an entire drive. If you want to search remote computers, then querying the file system and even using PowerShell remoting with Invoke-Command is less than optimal. If you are targeting a specific root folder, it might not be that bad, but using Get-ChildItem (DIR) doesn’t scale very well, in my opinion. As an alternative, you can use Windows Management Instrumentation (WMI).
It turns out that WMI can search for files just as easily by querying instances of the CIM_Datafile class. From experience, I know that you should use the most targeted filter you can. This means you need to know property names.
get-cimclass cim_datafile | Select -ExpandProperty CIMClassProperties | Select Name,CimType | out-gridview
The out-gridview for get-cimclass. (Image Credit: Jeff Hicks)
Status : OK Name : c:\work\a\b\demo.mp3 Caption : c:\work\a\b\demo.mp3 Description : c:\work\a\b\demo.mp3 InstallDate : 1/15/2015 8:47:16 AM AccessMask : 18809343 Archive : True Compressed : False CompressionMethod : CreationClassName : CIM_LogicalFile CreationDate : 1/15/2015 8:47:16 AM CSCreationClassName : Win32_ComputerSystem CSName : WIN81-ENT-01 Drive : c: EightDotThreeFileName : c:\work\a\b\demo.mp3 Encrypted : False EncryptionMethod : Extension : mp3 FileName : demo FileSize : 18 FileType : MP3 Format Sound FSCreationClassName : Win32_FileSystem FSName : NTFS Hidden : False InUseCount : LastAccessed : 1/15/2015 8:47:16 AM LastModified : 1/15/2015 8:47:26 AM Path : \work\a\b\ Readable : True System : False Writeable : True Manufacturer : Version : PSComputerName : WIN81-ENT-01 CimClass : root/cimv2:CIM_DataFile CimInstanceProperties : {Caption, Description, InstallDate, Name...} CimSystemProperties : Microsoft.Management.Infrastructure.CimSystemProperties
Let’s start by querying locally, again looking for folders that contain MP3 files under C:\work. Here’s my query.
Get-CimInstance CIM_DataFile -filter "Drive='c:' AND path Like '\\work\\%' AND extension='mp3'" -OutVariable m
I find that these types of queries perform best if I limit the search to a specific drive. You can also see where I’m filtering for the file extension. Note that there is no period. The trickiest part is the path component, where I’m using the LIKE operator and the wildcard (denoted by ‘%’) to retrieve any instance where the path starts with \work\. In WMI, you need to escape the backward-slash character (denoted by ‘\’), which is why I end up with \\work\\. In a WMI filter, use a wildcard instead of an asterik. My command writes results to the pipeline and saves the results to a variable, $m, so that I can look at them later without having to re-run the command.
Using Get-CimInstance in Windows PowerShell. (Image Credit: Jeff Hicks)
Get-CimInstance CIM_DataFile -filter "Drive='c:' AND path Like '\\work\\%' AND extension='mp3'" -OutVariable m | Get-CimAssociatedInstance -ResultClassName Win32_Directory | Select Name
Using WMI to parse out values in PowerShell. (Image Credit: Jeff Hicks)
Get-CimInstance CIM_DataFile -filter "Drive='c:' AND path Like '\\work\\%' AND extension='mp3'" | Get-CimAssociatedInstance -ResultClassName Win32_Directory | Select Name -Unique | Sort
Win32_Directory object results. (Image Credit: Jeff Hicks)
Get-CimInstance CIM_DataFile -filter "Drive='c:' AND path Like '\\work\\%' AND extension='zip'" -computername chi-core01 |
Get-CimAssociatedInstance -ResultClassName Win32_Directory | Select Name,PSComputername -Unique | Sort Name
The result of our PowerShell search. (Image Credit: Jeff Hicks)
Get-CimInstance CIM_DataFile -filter "Drive='c:' AND extension='zip'" -computername chi-core01 |
Get-CimAssociatedInstance -ResultClassName Win32_Directory | Select Name,PSComputername -Unique | Sort Name
This is much faster than using the DIR command and searching C: recursively.
If I can search one computer, I can just as easily search multiple computers.
Get-CimInstance CIM_DataFile -filter "Drive='c:' AND extension='zip'" -computername chi-core01,chi-fp02 |
Get-CimAssociatedInstance -ResultClassName Win32_Directory | Select Name,PSComputername -Unique |
Sort Name | out-gridview -title "Zip Files"
The out-gridview for zip files. (Image Credit: Jeff Hicks)
Get-WMIObject CIM_DataFile -filter "Drive='c:' AND extension='zip'" -computername chi-core01 |
foreach { $_.GetRelated("Win32_Directory")} | Select Name,PSComputername -Unique | Sort Name
The result is the same WMI information.
Using the GetRelated() method in PowerShell to retrieve associations. (Image Credit: Jeff Hicks)
More in PowerShell
Most popular on petri