I'm looking for a way to search my Windows drive for files that I personally created and have not been modified in over 10 years. I want to exclude any system files, temporary files, or anything else that might have been created by software installations. Ideally, I would like the search results in a CSV format. Can someone guide me on how to achieve this?
3 Answers
You could try using `Get-ChildItem -Attributes !System`, but it may not work perfectly because files in `C:Windows` aren't always flagged as system files. Here's a basic script you could adapt for your situation:
```powershell
$CutoffDate = (Get-Date).AddYears(-10)
$Owner = '{0}{1}' -f $env:USERDOMAIN, $env:USERNAME
Get-ChildItem -Path $path -File | Where-Object -Property CreationTime -lt $CutoffDate | ForEach-Object { Get-Acl $_.FullName } | Where-Object -Property Owner -Like $Owner | Select-Object -Property @{Name='Path';Expression={Resolve-Path $_.path}.providerpath}, Owner, CreationTime
```
It filters files by creation date and owner, which should help you narrow down your search.
One approach is to use PowerShell to check NTFS Streams metadata. You can get a file's streams and filter them based on your needs. Here's a command you can use to check the streams: `Get-Item "C:pathtoyourfile.txt" -Stream *`. You'll need to build a list of files based on the stream you'd like to search, such as files created by the user.
If you don’t usually create files in `C:Windows`, you can focus on the more common user folders. Check locations like `C:UsersDocuments`, `Desktop`, `Downloads`, etc. It might help you avoid unwanted files and get to the ones you want faster!
Yeah, I typically don't use those folders, but I've noticed some shareware seems to have created files there. Thanks for the tip!