On a Microsoft Windows system, you can find files created before or after
a specified date using the Get-ChildItem cmdlet. To use the
cmdlet, open a PowerShell window - you can do so on a Windows 10 system by
typing powershell in the
Cortana "Ask me anything" window, hitting Enter, and then clicking
on Windows PowerShell, which should be returned as the best match. If
you wish to find files and directories before a certain date, you can use a
command in the form Get-ChildItem | Where-Object {$_.LastWriteTime -lt
date where date is the relevant date. E.g., on a system
that uses the date format of mm/dd/yyyy where mm represents the month, dd the
day and yyyy the year, a command like the one shown below, which returns a
list of the files with a modification time prior to January 1, 2013, can be
used:
PS C:\Users\Lila\documents> Get-ChildItem | Where-Object {$_.LastWriteTime -lt '1/1/2013'} Directory: C:\Users\Lila\documents Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 9/9/2012 10:36 PM Book Collector d----- 11/8/2012 8:25 AM Corel PaintShop Pro d----- 4/6/2012 2:37 PM recovered -a---- 4/14/2012 4:16 PM 761476464 Disc1.bin -a---- 4/14/2012 4:16 PM 941 Disc1.cue PS C:\Users\Lila\documents>
In the above example the -lt stands for "less than". If,
however, you wished to find files with a modification time after a specific
date, you could use -gt, instead. For instance, if I wished to
see the list of files with a modification time after January 1, 2017 in the
C:\windows\system32 directory, I could use the command below:
PS C:\Users\Lila\documents> Get-ChildItem \windows\system32 | Where-Object {$_.LastWriteTime -gt '1/1/2017'} Directory: C:\windows\system32 Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 2/23/2017 8:08 PM CatRoot d----- 3/3/2017 9:35 PM catroot2 d----- 3/5/2017 10:39 PM config d----- 2/23/2017 8:08 PM drivers d----- 2/23/2017 8:08 PM DriverStore d----- 1/29/2017 3:25 PM en-US d---s- 1/29/2017 3:25 PM lxss d----- 2/14/2017 7:27 PM Macromed d----- 2/25/2017 11:55 AM MRT d----- 1/17/2017 8:58 PM oobe d----- 3/6/2017 8:39 PM SleepStudy d----- 3/6/2017 8:54 PM sru d----- 3/1/2017 2:45 PM Tasks d----- 1/17/2017 8:58 PM wbem d----- 1/29/2017 3:31 PM WDI d----- 1/17/2017 8:58 PM WinBioPlugIns -a---- 1/29/2017 3:20 PM 70656 bash.exe -a---- 3/3/2017 8:52 PM 348048 FNTCACHE.DAT -a---- 1/29/2017 3:20 PM 132608 LxRun.exe -a---- 2/25/2017 11:41 AM 138020592 MRT.exe -a---- 1/29/2017 3:31 PM 207470 perfc009.dat -a---- 1/29/2017 3:31 PM 947126 perfh009.dat -a---- 1/29/2017 3:31 PM 1157478 PerfStringBackup.INI PS C:\Users\Lila\documents>
If I wanted to see the list of files in that directory that were created
after March 1, but before March 6, I could use the command
Get-ChildItem \windows\system32 | Where-Object
{$_.LastWriteTime -gt '3/1/2017' -and $_.LastWriteTime -lt '3/6/2017'}
as shown below:
PS C:\Users\Lila\documents> Get-ChildItem \windows\system32 | Where-Object {$_.LastWriteTime -gt '3/1/2017' -and $_.LastWriteTime -lt '3/6/2017'} Directory: C:\windows\system32 Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 3/3/2017 9:35 PM catroot2 d----- 3/5/2017 10:39 PM config d----- 3/1/2017 2:45 PM Tasks -a---- 3/3/2017 8:52 PM 348048 FNTCACHE.DAT PS C:\Users\Lila\documents>
The -and stipulates a
logical conjunction where, in this case, the file modification time
is between the first moment of March 1 and prior to the first moment of March
6.
If you are only interested in certain types of files, say images, such
as portable
network graphics (PNG) files, you can restrict the results returned to
just those files. E.g., with Get-ChildItem *.png | Where-Object
{$_.LastWriteTime -gt '3/6/2016' -and $_.LastWriteTime -lt '3/6/2017'}:
PS C:\Users\Lila\documents> Get-ChildItem *.png | Where-Object {$_.LastWriteTime -gt '3/6/2016' -and $_.LastWriteTime -l t '3/6/2017'} Directory: C:\Users\Lila\documents Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 12/20/2016 9:20 AM 246 040293962234.png -a---- 10/27/2016 5:36 PM 2570 blank_page.png -a---- 12/10/2016 10:15 PM 31798 change.png -a---- 11/29/2016 5:20 PM 5208 found.png -a---- 1/10/2017 10:51 AM 15381 Build_14393.576.png PS C:\Users\Lila\documents>
The above example found all of the PNG files modified within the last year,
since the command was run on March 6, 2017. But I could also use a different
command to perform that search based on the current date and the number of
days from that date using Get-Date. E.g., I could find files
modified in the last 365 days using the command below:
PS C:\Users\Lila\documents> Get-ChildItem *.png | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-365)} Directory: C:\Users\Lila\documents Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 12/20/2016 9:20 AM 246 040293962234.png -a---- 10/27/2016 5:36 PM 2570 blank_page.png -a---- 12/10/2016 10:15 PM 31798 change.png -a---- 11/29/2016 5:20 PM 5208 found.png -a---- 1/10/2017 10:51 AM 15381 Build_14393.576.png PS C:\Users\Lila\documents>
I added a negative number, -365, to the current date returned by
Get-Date, so that I could have the command look for files with
a modification time 365 days in the past or greater. If I used Get-Date
by itself, I see the following for today's date:
PS C:\Users\Lila\documents> Get-Date
Monday, March 06, 2017 9:45:13 PM
PS C:\Users\Lila\documents>You can also have a search performed recursively down through subdirectories
using -Recurse as shown below where, in the first instance of
the command, the only file found for a search of those updated in the last week
is the one in the specified directory whereas in the second instance, where
-Recurse is used, that file is found as well as one in the
"images" subdiretory that lies beneath the specified directory.
PS C:\Users\Lila\documents> Get-ChildItem C:\users\public\documents\*.png | Where-Object {$_.LastWriteTime -gt (Get-Date ).AddDays(-7)} Directory: C:\users\public\documents Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 3/4/2017 7:42 PM 238817 leopard.png PS C:\Users\Lila\documents> Get-ChildItem C:\users\public\documents\*.png -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} Directory: C:\users\public\documents\images Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 3/6/2017 9:52 PM 633 rectangle.png Directory: C:\users\public\documents Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 3/4/2017 7:42 PM 238817 leopard.png PS C:\Users\Lila\documents>