3
votes

To recursively search for a hidden file, I am using:

gci -Path C:\ -Filter part_of_filename* -Recurse -Force | where { $_.Attributes -match "Hidden"}

The output shows me many errors exactly like this (depending on the path):

Get-ChildItem : Access to the path 'C:\Documents and Settings' is denied. At C:\Users\USERNAME\Documents\powershell\searchdisk.ps1:10 char:5 + gci <<<< -Path C:\ -Filter part_of_filename* -Recurse -Force | where { $_.Attributes -match "Hidden"} + CategoryInfo : PermissionDenied: (C:\Documents and Settings:String) [Get-ChildItem], UnauthorizedAccessException + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

I need a PowerShell command that recursively searches ANY directory including hidden directories and shows me all files including hidden files of the name part_of_filename* (for this example)

I ran the command using PowerShell ISE as Administrator. It won't search inside directories like

C:\Windows\System32\LogFiles\WMI\RtBackup

1
This would definately need to run with Elevated rightsMatt
The problem is that Documents and settings is not a directory, but a junction point. Some NTFS-trick to make programs believe the directory is still there, while it really is a shortcut to Users. Here's a SO question about the topic: stackoverflow.com/questions/2311105/…Kenned

1 Answers

9
votes

You're doing it right. Just run it in an elevated console and remove the filter. If you don't care about permission errors, append -ErrorAction SilentlyContinue:

Get-ChildItem -Path C:\ -Filter lush* -Recurse -Force `
              -ErrorAction SilentlyContinue


Directory: C:\

Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-arhs        25.09.2013     12:16       1208 lush.asx

lush.asx has the ReadOnly, Hidden and System attributes.

You may also want to pipe to | select Name, Length, Directory to get rid of that unfortunate Directory: C:\ line. There's also a DirectoryName if you want the full path without the filename.