First, lets learn how to get more information. Powershell uses cmdlets that should be in the format of verb-noun. So in order to get help, we use the command Get-Help. If we want to get help on a specific command we can run get-help [command]
In the below example we’re trying to get-help on the cmdlet get-childitem.
As you can see, you’ll be given some syntax and more information about the command you’re running.
Let’s try it out.
Lets run the get-childitem cmdlet with a path of c:userseshanksdesktoptestfolder
The cmdlet returned four files in that folder and you can see that there are a couple of other attributes listed as well.
Let’s continue with this and modify our results to exclude executables. This can be done by adding the “exclude” switch.
As you would expect, we show the contents of the folder, except now without anything with a .exe extension.
Similar to the get-childitem cmdlet there is a get-item cmdlet. This cmdlet is used to specify one specific file or folder. (Remember, if you don’t know how to use it, we can always run “get-help get-item” to give us some extra information.)
In this next test, we’ll run get-item on one of the documents in the folder we were testing the get-childitem on.
Get-Childitem returns almost the same results as the get-childitem except it works with only one item at a time.
What if there is more information about this item that we want to know about? Let’s run the command again but use the | Format-List cmdlet with it. (FL for short)
The Format-List cmdlet gives us more information about the file we’re working with. The FL cmdlet should show us the attributes that we can get by using get-item.
Notice in the example above, that one of the attributes is “LastAccessTime.” So we should be able to get that information directly.
Let’s run get-item again, but try to only get the LastAccessTime.
As you can see the returned results only show the LastAccessTime.
Let’s look further at what can be done with the pipe { | }.
The pipe is used to pass results from one cmdlet to another cmdlet in the same script.
Let’s see an example of this by using the childitem cmdlet we learned earlier and adding the “select-string” cmdlet which is similar to the linux “grep” command"
Here, we’ll call the same “get-childitem” cmdlet but then pipe those results over to the select-string cmdlet. This means that we’re going to run the select-string cmdlet on the results of get-childitem.
Our childitems included:
When we combine that with the select-string cmdlet, it returns one document as well as the string. I’ve added a screenshot of the document as well just to prove that it works.
Now that we know how to use pipes, lets move on and add a “foreach” loop. We’ll also use a variable which is written as $_. This is a special variable that will contain only the item it’s working with at the time. An example might be useful to explain this.
Get-childitem is returning four items and then calls the foreach loop to perform an operation on them.
Essentially, the foreach loop is doing the following since it’s used in conjunction with a pipe.
Write-host Doc1.txt
Write-host Doc2.txt
Write-host Executable1.exe
Write-host Shortcut.lnk
You can see that the $_ takes the place of each filename returned by get-childitem.
Now that we can do a loop, and can pipe cmdlets together, and know how to do variables correctly, we should be able to get the lastaccesstimes of all of the files in the “TestFolder”
We’ve now run the get-childitem cmdlet again, and passed the results to a foreach loop to return the name, and the name.lastaccesstime results as seen in the picture above.
There are countless ways that powershell can be used to retrieve data. This is just a short tutorial on how some of the concepts work together and hopefully they are useful to you when building your new scripts.