Comment on page
Get-BluGenieChildItemList

﻿
Get-BluGenieChildItemList
SYNOPSIS
Query for a list of files and folders that match a specific pattern
SYNTAX
Get-BluGenieChildItemList [[-SearchPath] <Object>] [-Recurse] [[-FilterType] <String>] [[-Pattern] <Object>] [-Remove] [[-StopWatchCounter] <Int32>] [[-SleepTimerSec] <Int32>] [[-Algorithm] <String>] [-Signature] 
[-Permissions] [-ShowProgress] [-ClearGarbageCollecting] [-UseCache] [[-CachePath] <String>] [-RemoveCache] [[-DBName] <String>] [[-DBPath] <String>] [-UpdateDB] [-ForceDBUpdate] [-NewDBTable] [-Walkthrough] 
[-ReturnObject] [-OutUnEscapedJSON] [-OutYaml] [[-FormatView] <String>] [<CommonParameters>]
DESCRIPTION
Query for a list of files and folders that match a specific pattern
Fastest search is based on the filter type set to "Name" this is default Slower search is based on all other filter type properties (Reference the Parameter FilterType to review)
EXAMPLES
EXAMPLE 1
Command: Get-BluGenieChildItemList -SearchPath C:\Temp -Recurse -Pattern '^notepad\.\w{3}$'
Description: Search C:\Temp and all sub directories for any file or directory named Notepad.*
Notes:
EXAMPLE 2
Command: Get-BluGenieChildItemList -SearchPath C:\Temp,C:\Trash,C:\Users -Recurse -Pattern '^notepad\.\w{3}$'
Description: Search multiple directories and all sub directories for any file or directory named Notepad.*.
Notes:
EXAMPLE 3
Command: Get-BluGenieChildItemList -SearchPath C:\Temp,C:\Trash,C:\Users -Recurse -Pattern '0e61079d3283687d2e279272966ae99d' -FilterType
HashDescription: Search multiple directories and the sub directories for a Hash value determined by the default Algorithm type of MD5
Notes:
EXAMPLE 4
Command: Get-BluGenieChildItemList -SearchPath C:\Windows -Pattern '^notepad\.\w{3}$' -Permissions -ShowStreamValue -Signature
Description: Query the C:\Windows dir for a file or directory named Notepad.* and return all associated Permissions, Alternate Data
Streams, and Signature information
Notes:
EXAMPLE 5
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse
Description: Search for all file(s) under (All Temp Locations for each user and the system) and sub directories
Notes:
EXAMPLE 6
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse -UseCache
Description: Cache found objects to disk to not over tax Memory resources
Notes: By default the Cache location is %SystemDrive%\Windows\Temp
EXAMPLE 7
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse -UseCache -RemoveCache
Description: Remove Cache data
Notes:
EXAMPLE 8
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse -UseCache -CachePath $Env:Temp
Description: Change the Cache path to the current users Temp directory
Notes: By default the Cache location is %SystemDrive%\Windows\Temp
EXAMPLE 9
Command: Get-ChildItem -path $env:temp -File | Get-BluGenieChildItemList -SearchPath Temp -Recurse -UseCache -ClearGarbageCollecting
Description: Scan large directories and limit the memory used to track data
Notes:
EXAMPLE 10
Command: Get-BluGenieChildItemList -SearchPath 'Temp' -Recurse -FilterType NameIncludeAll -UpdateDB
Description: Search every user and system Temp directory for all normal file information including hash and save the return to a DB
Notes: The default path is $('{0}\BluGenie' -f $env:ProgramFiles)  Example: C:\Program Files\BluGenie
EXAMPLE 11
Command: Get-BluGenieChildItemList -Help
Description: Call Help Information
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
Get-Help will be called with the -Full parameter
EXAMPLE 12
Command: Get-BluGenieChildItemList -WalkThrough
Description: Call Help Information [2]
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal
Get-Help will be called with the -Full parameter
EXAMPLE 13
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse -OutUnEscapedJSON
Description: Return a detailed function report in an UnEscaped JSON format
Notes:  The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters.  Normal return data is a Hash Table.
EXAMPLE 14
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse -OutYaml
Description: Return a detailed function report in YAML format
Notes:  The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters.  Normal return data is a Hash Table.
EXAMPLE 15
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse -ReturnObject
Description: Return Output as a Object
Notes:  The ReturnObject is used to return a PowerShell Object.  Normal return data is a Hash Table.
This parameter is also used with the ForMat
EXAMPLE 16
Command: Get-BluGenieChildItemList -SearchPath Temp -Recurse -ReturnObject -FormatView Yaml
Description: Output PSObject information in Yaml format
Notes:  Current formats supported by default are ('Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml', 'XML')
Default is set to (None) and normal PSObject.
PARAMETERS
SearchPath
-SearchPath <Object>
   Description: The path to start your search from
   Notes:
           If you specify "Temp" in the SearchPath field all the %SystemDrive%\Users\* Temp directories and the
           %SystemRoot%\Temp will be searched only.
   
           If you specify "AllUsers" in the SearchPath path all User Profiles from %SystemDrive%\Users will be
           prefixed to the rest of the path.
               Example:  -SearchPath 'AllUsers\AppData\Roaming'
   
               Output:     C:\Users\Administrator\AppData\Roaming
                           C:\Users\User1\AppData\Roaming
                           C:\Users\User2\AppData\Roaming
                           C:\Users\User3\AppData\Roaming
                           C:\Users\User4\AppData\Roaming
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    1
   Default value                $(Get-Location).Path
   Accept pipeline input?       false
   Accept wildcard characters?  false
Recurse
-Recurse [<SwitchParameter>]
   Description: Recurse through subdirectories
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
FilterType
-FilterType <String>
   Description:  Which property to filter by
   Notes:
           Filter Option = "Path"					-   Path Query with general file information
           Filter Option = "PathIncludeAll"        -   Path Query with extended file metadata
           Filter Option = "Name"                 	-   Name Query with general file information
           Filter Option = "NameIncludeAll"        -   Name Query with extended file metadata
           Filter Option = "Type"             		-   File Type Query with general file information
           Filter Option = "TypeIncludeAll"        -   File Type Query with extended file metadata
           Filter Option = "Hash"                  -   Hash Value Query with general file information
           Filter Option = "HashIncludeAll"		-	Hash Value Query with extended file metadata
           Filter Option = "ADS"					-	Alternate Data Stream Query (True Only) with general file information
           Filter Option = "ADSIncludeAll"		    -	Alternate Data Stream Query (True Only) with extended file metadata
   
           Default is a "Name" Query
   Alias:
   ValidateSet: 'Path','PathIncludeAll','Name','NameIncludeAll','Type','TypeIncludeAll','Hash','HashIncludeAll','ADS','ADSIncludeAll'
   
   Required?                    false
   Position?                    2
   Default value                Name
   Accept pipeline input?       false
   Accept wildcard characters?  false
Pattern
-Pattern <Object>
   Description: Search Pattern using RegEx
   Notes: Using -SearchHidden will convert the Pattern to RegEx Automatically but without the comma or
   the -SearchHidden the -Pattern is viewed as as a Command Console Search pattern.  You can use (*) wildcards.
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    3
   Default value                .*
   Accept pipeline input?       false
   Accept wildcard characters?  false
Remove
-Remove [<SwitchParameter>]
   Description: Remove the File(s) and Directory(s) found
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
StopWatchCounter
-StopWatchCounter <Int32>
   Description: Determine how many times the recheck for removing a file or directory happenes.  By default (12) times with a 5 second sleep
   Notes:  Determine how many times the recheck for removing a file or directory happenes.  By default (12) times with a 5 second sleep
           inbetween which is (60 seconds total)
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    4
   Default value                12
   Accept pipeline input?       false
   Accept wildcard characters?  false
SleepTimerSec
-SleepTimerSec <Int32>
   Description: Determine the Sleep time in seconds before the next recheck.  By default this is a 5 second sleep with 12 rechecks
   Notes:  Determine the Sleep time in seconds before the next recheck.  By default this is a 5 second sleep with 12 rechecks which is
           (60 seconds total)
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    5
   Default value                5
   Accept pipeline input?       false
   Accept wildcard characters?  false
Algorithm
-Algorithm <String>
   Description:  Specifies the cryptographic hash to use for computing the hash value of the contents of the specified file.
   Notes:  The acceptable values for this parameter are:
   
           - SHA1
           - SHA256
           - SHA384
           - SHA512
           - MACTripleDES
           - MD5 = (Default)
           - RIPEMD160
   Alias:
   ValidateSet: 'MACTripleDES','MD5','RIPEMD160','SHA1','SHA256','SHA384','SHA512'
   
   Required?                    false
   Position?                    6
   Default value                MD5
   Accept pipeline input?       false
   Accept wildcard characters?  false
Signature
-Signature [<SwitchParameter>]
   Description: Query Signature information
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
Permissions
-Permissions [<SwitchParameter>]
   Description: Query Access Control List (ACL) information
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ShowProgress
-ShowProgress [<SwitchParameter>]
   Description: Display file count information to the Host to show query progress
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ClearGarbageCollecting
-ClearGarbageCollecting [<SwitchParameter>]
   Description: Garbage Collection in Powershell to Speed up Scripts and help lower memory consumption
   Notes: This is enabled by default.  To disable use -ClearGarbageCollecting:$False
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
UseCache
-UseCache [<SwitchParameter>]
   Description: Cache found objects to disk.  This is to not over tax Memory resources with found artifacts
   Notes: By default the Cache location is %SystemDrive%\Windows\Temp
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
CachePath
-CachePath <String>
   Description: Path to store the Cache information
   Notes: By default the Cache location is %SystemDrive%\Windows\Temp
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    7
   Default value                $('{0}\Windows\Temp\{1}.log' -f $env:SystemDrive, $(New-BluGenieUID))
   Accept pipeline input?       false
   Accept wildcard characters?  false
RemoveCache
-RemoveCache [<SwitchParameter>]
   Description: Remove Cache data on completion
   Notes: Cache information is removed right before the data is returned to the calling process
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
DBName
-DBName <String>
   Description: Database Name (Without extention)
   Notes: The default name is set to 'BluGenie'
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    8
   Default value                BluGenie
   Accept pipeline input?       false
   Accept wildcard characters?  false
DBPath
-DBPath <String>
   Description: Path to either Save or Update the Database
   Notes: The default path is $('{0}\BluGenie' -f $env:ProgramFiles)  Example: C:\Program Files\BluGenie
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    9
   Default value                $('{0}\BluGenie' -f $env:ProgramFiles)
   Accept pipeline input?       false
   Accept wildcard characters?  false
UpdateDB
-UpdateDB [<SwitchParameter>]
   Description: Save return data to the Sqlite Database
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ForceDBUpdate
-ForceDBUpdate [<SwitchParameter>]
   Description: Force an update of the return data to the Sqlite Database
   Notes: By default only new items are saved.  The primary key is ( FullName )
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
NewDBTable
-NewDBTable [<SwitchParameter>]
   Description: Delete and Recreate the Database Table
   Notes:
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
Walkthrough
-Walkthrough [<SwitchParameter>]
   Description:  Start the dynamic help menu system to help walk through the current command and all of the parameters
   Notes:
   Alias: Help
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
ReturnObject
-ReturnObject [<SwitchParameter>]
   Description: Return information as an Object
   Notes: By default the data is returned as a Hash Table
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
OutUnEscapedJSON
-OutUnEscapedJSON [<SwitchParameter>]
   Description: Remove UnEsacped Char from the JSON information.
   Notes: This will beautify json and clean up the formatting.
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
OutYaml
-OutYaml [<SwitchParameter>]
   Description: Return detailed information in Yaml Format
   Notes: Only supported in Posh 3.0 and above
   Alias:
   ValidateSet:
   
   Required?                    false
   Position?                    named
   Default value                False
   Accept pipeline input?       false
   Accept wildcard characters?  false
FormatView
-FormatView <String>
   Description: Automatically format the Return Object
   Notes: Yaml is only supported in Posh 3.0 and above
   Alias:
   ValidateSet: 'Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml'
   
   Required?                    false
   Position?                    10
   Default value                None
   Accept pipeline input?       false
   Accept wildcard characters?  false
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Get-BluGenieAutoRuns
Get-BluGenieCOMObjectInfo
Last modified 1yr ago