Powershell - List all alternate data stream information from one directory
My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.
I currently have the first two parts scripted:
cd c:usersprofilenamedownloads
gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'
To open an example data stream file, open cmd, cd to a directory, then run:
dir /r
After this, grab the zone identified name of one of the files and run this command without the :$data.
Example before removing :$Data
notepad test.docx:Zone.Identifier:$Data
After removing(run this command):
notepad test.docx:Zone.Identifier
How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?
Any help is greatly appreciated.
powershell alternate-data-stream
edited Nov 19 '18 at 19:02
mklement0
128k20242271
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
add a comment |
My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.
I currently have the first two parts scripted:
cd c:usersprofilenamedownloads
gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'
To open an example data stream file, open cmd, cd to a directory, then run:
dir /r
After this, grab the zone identified name of one of the files and run this command without the :$data.
Example before removing :$Data
notepad test.docx:Zone.Identifier:$Data
After removing(run this command):
notepad test.docx:Zone.Identifier
How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?
Any help is greatly appreciated.
powershell alternate-data-stream
edited Nov 19 '18 at 19:02
mklement0
128k20242271
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
add a comment |
My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.
I currently have the first two parts scripted:
cd c:usersprofilenamedownloads
gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'
To open an example data stream file, open cmd, cd to a directory, then run:
dir /r
After this, grab the zone identified name of one of the files and run this command without the :$data.
Example before removing :$Data
notepad test.docx:Zone.Identifier:$Data
After removing(run this command):
notepad test.docx:Zone.Identifier
How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?
Any help is greatly appreciated.
powershell alternate-data-stream
edited Nov 19 '18 at 19:02
mklement0
128k20242271
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.
I currently have the first two parts scripted:
cd c:usersprofilenamedownloads
gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'
To open an example data stream file, open cmd, cd to a directory, then run:
dir /r
After this, grab the zone identified name of one of the files and run this command without the :$data.
Example before removing :$Data
notepad test.docx:Zone.Identifier:$Data
After removing(run this command):
notepad test.docx:Zone.Identifier
How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?
Any help is greatly appreciated.
powershell alternate-data-stream
powershell alternate-data-stream
edited Nov 19 '18 at 19:02
mklement0
128k20242271
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
edited Nov 19 '18 at 19:02
mklement0
128k20242271
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
edited Nov 19 '18 at 19:02
mklement0
128k20242271
edited Nov 19 '18 at 19:02
mklement0
128k20242271
edited Nov 19 '18 at 19:02
mklement0
128k20242271
128k20242271
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
asked Nov 19 '18 at 18:18
user3290171user3290171
56112
56112
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
Presuming your are after the Stream content:
## Q:Test20181119SO_53380498.ps1
Pushd $ENV:USERPROFILEDownloads
Get-ChildItem -Recurse | ForEach-Object {
Get-Item $_.FullName -Stream *
} | Where-Object Stream -ne ':$Data' |
Select-Object FileName,Stream,
@{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
@{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
@{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
Export-Csv Streams.csv -NoTypeInformation
Shorted output of the generated Streams.csv file
(date format depends on locale/user settings):
> gc .Streams.csv
"FileName","Stream","CreationTime","LastWriteTime","Content"
"C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"
If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.
– user3290171
Nov 20 '18 at 9:18
Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 withForEach($File in (gci -r){..}and subsequently use $file instead of $_ . 2nd use another calculated property to(Get-Item $Filename).CreationTime
– LotPings
Nov 20 '18 at 9:30
See changed answer.
– LotPings
Nov 20 '18 at 9:49
add a comment |
I think this might be close to what you want:
$files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
Broken into multi-lines for legibility:
$files = Get-ChildItem -Recurse |
Where-Object { Get-Item $_.FullName -Stream * } |
Where-Object {$_.Stream -ne ':$Data'} |
Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53380498%2fpowershell-list-all-alternate-data-stream-information-from-one-directory%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Presuming your are after the Stream content:
## Q:Test20181119SO_53380498.ps1
Pushd $ENV:USERPROFILEDownloads
Get-ChildItem -Recurse | ForEach-Object {
Get-Item $_.FullName -Stream *
} | Where-Object Stream -ne ':$Data' |
Select-Object FileName,Stream,
@{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
@{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
@{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
Export-Csv Streams.csv -NoTypeInformation
Shorted output of the generated Streams.csv file
(date format depends on locale/user settings):
> gc .Streams.csv
"FileName","Stream","CreationTime","LastWriteTime","Content"
"C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"
If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.
– user3290171
Nov 20 '18 at 9:18
Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 withForEach($File in (gci -r){..}and subsequently use $file instead of $_ . 2nd use another calculated property to(Get-Item $Filename).CreationTime
– LotPings
Nov 20 '18 at 9:30
See changed answer.
– LotPings
Nov 20 '18 at 9:49
add a comment |
Presuming your are after the Stream content:
## Q:Test20181119SO_53380498.ps1
Pushd $ENV:USERPROFILEDownloads
Get-ChildItem -Recurse | ForEach-Object {
Get-Item $_.FullName -Stream *
} | Where-Object Stream -ne ':$Data' |
Select-Object FileName,Stream,
@{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
@{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
@{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
Export-Csv Streams.csv -NoTypeInformation
Shorted output of the generated Streams.csv file
(date format depends on locale/user settings):
> gc .Streams.csv
"FileName","Stream","CreationTime","LastWriteTime","Content"
"C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"
If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.
– user3290171
Nov 20 '18 at 9:18
Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 withForEach($File in (gci -r){..}and subsequently use $file instead of $_ . 2nd use another calculated property to(Get-Item $Filename).CreationTime
– LotPings
Nov 20 '18 at 9:30
See changed answer.
– LotPings
Nov 20 '18 at 9:49
add a comment |
Presuming your are after the Stream content:
## Q:Test20181119SO_53380498.ps1
Pushd $ENV:USERPROFILEDownloads
Get-ChildItem -Recurse | ForEach-Object {
Get-Item $_.FullName -Stream *
} | Where-Object Stream -ne ':$Data' |
Select-Object FileName,Stream,
@{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
@{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
@{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
Export-Csv Streams.csv -NoTypeInformation
Shorted output of the generated Streams.csv file
(date format depends on locale/user settings):
> gc .Streams.csv
"FileName","Stream","CreationTime","LastWriteTime","Content"
"C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"
If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
Presuming your are after the Stream content:
## Q:Test20181119SO_53380498.ps1
Pushd $ENV:USERPROFILEDownloads
Get-ChildItem -Recurse | ForEach-Object {
Get-Item $_.FullName -Stream *
} | Where-Object Stream -ne ':$Data' |
Select-Object FileName,Stream,
@{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
@{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
@{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
Export-Csv Streams.csv -NoTypeInformation
Shorted output of the generated Streams.csv file
(date format depends on locale/user settings):
> gc .Streams.csv
"FileName","Stream","CreationTime","LastWriteTime","Content"
"C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"
If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
edited Nov 20 '18 at 9:48
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
answered Nov 19 '18 at 23:19
LotPingsLotPings
18.6k61532
18.6k61532
This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.
– user3290171
Nov 20 '18 at 9:18
Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 withForEach($File in (gci -r){..}and subsequently use $file instead of $_ . 2nd use another calculated property to(Get-Item $Filename).CreationTime
– LotPings
Nov 20 '18 at 9:30
See changed answer.
– LotPings
Nov 20 '18 at 9:49
add a comment |
This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.
– user3290171
Nov 20 '18 at 9:18
Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 withForEach($File in (gci -r){..}and subsequently use $file instead of $_ . 2nd use another calculated property to(Get-Item $Filename).CreationTime
– LotPings
Nov 20 '18 at 9:30
See changed answer.
– LotPings
Nov 20 '18 at 9:49
This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.
– user3290171
Nov 20 '18 at 9:18
This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.
– user3290171
Nov 20 '18 at 9:18
Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with
ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime– LotPings
Nov 20 '18 at 9:30
Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with
ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime– LotPings
Nov 20 '18 at 9:30
See changed answer.
– LotPings
Nov 20 '18 at 9:49
See changed answer.
– LotPings
Nov 20 '18 at 9:49
add a comment |
I think this might be close to what you want:
$files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
Broken into multi-lines for legibility:
$files = Get-ChildItem -Recurse |
Where-Object { Get-Item $_.FullName -Stream * } |
Where-Object {$_.Stream -ne ':$Data'} |
Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
add a comment |
I think this might be close to what you want:
$files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
Broken into multi-lines for legibility:
$files = Get-ChildItem -Recurse |
Where-Object { Get-Item $_.FullName -Stream * } |
Where-Object {$_.Stream -ne ':$Data'} |
Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
add a comment |
I think this might be close to what you want:
$files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
Broken into multi-lines for legibility:
$files = Get-ChildItem -Recurse |
Where-Object { Get-Item $_.FullName -Stream * } |
Where-Object {$_.Stream -ne ':$Data'} |
Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
I think this might be close to what you want:
$files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
Broken into multi-lines for legibility:
$files = Get-ChildItem -Recurse |
Where-Object { Get-Item $_.FullName -Stream * } |
Where-Object {$_.Stream -ne ':$Data'} |
Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
edited Nov 19 '18 at 19:42
JohnLBevan
14.4k146107
14.4k146107
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
answered Nov 19 '18 at 18:38
thom schumacherthom schumacher
848515
848515
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53380498%2fpowershell-list-all-alternate-data-stream-information-from-one-directory%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
