How to Use PowerShell to Find Files Modified After a Certain Date?

In this tutorial, I will explain how to use PowerShell to find files modified after a specific date. This is a common task for system administrators and IT professionals who must efficiently manage and audit file systems. By using PowerShell, you can automate this process and save significant time and effort.

Table of Contents

Find Files Modified After a Certain Date using PowerShell using Get-ChildItem

Now, let me show you how to find files modified after a certain date using PowerShell.

The Get-ChildItem cmdlet is used to find files and directories in PowerShell. It retrieves the items in one or more specified locations. To find files modified after a certain date, we will use this cmdlet in combination with Where-Object.

Let me show you an example.

Suppose you are an IT administrator for a company in New York, and you need to find all files modified after June 1, 2024, in the directory C:\CompanyData.

First, open PowerShell with administrative privileges. You can do this by right-clicking on the PowerShell icon and selecting “Run as administrator.”

Now, you can use the Get-ChildItem cmdlet to list all files in the directory. The basic syntax is:

Get-ChildItem -Path "C:\CompanyData"

Now, let me show you how to filter files by modification date.

To filter files modified after a specific date, use the Where-Object cmdlet. This cmdlet allows you to filter the output based on conditions you specify.

Here is the complete command to find files modified after June 1, 2024:

Get-ChildItem -Path "C:\CompanyData" -Recurse | Where-Object { $_.LastWriteTime -gt "2024-06-01" }

Explanation

Get-ChildItem -Path "C:\CompanyData" -Recurse: This part lists all files and directories under C:\CompanyData recursively.
Where-Object { $_.LastWriteTime -gt "2024-06-01" }: This part filters the files based on the LastWriteTime property, which indicates the last modification date. The $_ symbol represents the current object in the pipeline.

To make the output more readable, you can format the results. For example, you can display only the file names and their modification dates:

Get-ChildItem -Path "C:\CompanyData" -Recurse | Where-Object { $_.LastWriteTime -gt "2024-06-01" } | Select-Object Name, LastWriteTime

Here is the exact output in the screenshot below:

Find Files Modified After a Certain Date using PowerShell using Get-ChildItem

If you need to export the results to a CSV file for further analysis, you can use the Export-Csv cmdlet:

Get-ChildItem -Path "C:\CompanyData" -Recurse | Where-Object { $_.LastWriteTime -gt "2024-06-01" } | Select-Object Name, LastWriteTime | Export-Csv -Path "C:\ModifiedFiles.csv" -NoTypeInformation

Read Read Log Files with PowerShell

Filter by File Type

You might want to filter files not only by modification date but also by type. For example, to find all .docx files modified after June 1, 2024, use:

Get-ChildItem -Path "C:\CompanyData" -Recurse -Filter "*.docx" | Where-Object { $_.LastWriteTime -gt "2024-06-01" }

Search in Specific Subdirectories

If you are only interested in specific subdirectories, you can adjust the -Path parameter accordingly. For example, to search only in C:\CompanyData\Reports:

Get-ChildItem -Path "C:\CompanyData\Reports" -Recurse | Where-Object { $_.LastWriteTime -gt "2024-06-01" }

Combine Multiple Conditions

You can combine multiple conditions using logical operators. For instance, to find .docx and .xlsx files modified after June 1, 2024:

Get-ChildItem -Path "C:\CompanyData" -Recurse | Where-Object { ($_.LastWriteTime -gt "2024-06-01") -and ($_.Extension -eq ".docx" -or $_.Extension -eq ".xlsx") }

Read How to Use PowerShell new-item to Create Files and Directories?

Automate the PowerShell Script

To automate this task, you can save the PowerShell script in a .ps1 file and schedule it using Task Scheduler. Here’s a sample script:

$path = "C:\CompanyData"
$date = "2024-06-01"
$output = "C:\ModifiedFiles.csv"

Get-ChildItem -Path $path -Recurse | Where-Object { $_.LastWriteTime -gt $date } | Select-Object Name, LastWriteTime | Export-Csv -Path $output -NoTypeInformation

Save this script as FindModifiedFiles.ps1 and use Task Scheduler to run it at your preferred intervals.

Conclusion

In this tutorial, I explained how to use PowerShell to find files modified after a certain date. We can use cmdlets like Get-ChildItem and Where-Object for like this.