CODEWITHSUNDEEP
powershell
Sam Amedeo
Sam Amedeo

Reputation: 31

Using Powershell to identify all files modified by a program

I am looking to find a way to list all files modified by a program following an action in the program. My thought process for this script is:

  1. Take a snapshot of all objects on the H:\ drive.
  2. Pause the script and go out to the program I am testing and take an action that will modify one or multiple files on the H:\ drive.
  3. Take a second snapshot of the H:\ drive and output only files that have a different last modified time.

I already have a running script that will examine all files modified within the last hour but I wanted to set up a script that was more or less real time.

So far I have 

$before = get-childitem H:\ -recurse
read-host
$after = get-childitem H:\ -recurse
Compare-object -referenceobject $before -differenceobject $after -Property lastwritetime -passThru | 
out-host
powershell -noexit

I am only getting a return on the first sub directory (alphabetically) that has been modified. I am not getting a return on any other sub directories or files.

Upvotes: 0

Views: 359

Answers (1)

Keith Hill
Keith Hill

Reputation: 201822

I would use the FileSystemWatcher .NET type to monitor the directory. You should be able to use the Register-ObjectEvent command to hook the Changed event and process the directory only when something has changed.

Upvotes: 1

Related Questions