# Get-BluGenieFileADS Get-BluGenieFileADS ### SYNOPSIS Query for a files Alternate Data Stream Content ### SYNTAX ``` Get-BluGenieFileADS [[-Path] ] [-ShowAll] [-ClearGarbageCollecting] [-UseCache] [-CachePath ] [-RemoveCache] [-Walkthrough] [-ReturnObject] [-OutUnEscapedJSON] [-OutYaml] [-FormatView ] [] ``` ### DESCRIPTION Query for a files Alternate Data Stream Content ### EXAMPLES #### EXAMPLE 1 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt","%SystemDrive%\Windows\Notepod.exe" ``` ``` Description: Query files for any ADS Information using the Path Parameter Notes: ``` #### EXAMPLE 2 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt,%SystemDrive%\Windows\Notepod.exe" ``` ``` Description: Query files for any ADS Information using a Single String Array with a comma separator Notes: ``` #### EXAMPLE 3 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt;%SystemDrive%\Windows\Notepod.exe" ``` ``` Description: Query files for any ADS Information using a Single String Array with a semicolon separator Notes: ``` #### EXAMPLE 4 ``` Command: Get-ChildItem -path $env:temp -File | Get-BluGenieFileADS ``` ``` Description: Query files for any ADS Information using Named value from Pipeline Notes: ``` #### EXAMPLE 5 ``` Command: Get-ChildItem -path $env:temp -File | Select-Object -ExpandProperty Fullname | Get-BluGenieFileADS ``` ``` Description: Query files for any ADS Information using value from Pipeline Notes: ``` #### EXAMPLE 6 ``` Command: Get-FileADS -path "C:\Temp\File1.txt" ``` ``` Description: Query files for any ADS Information using the Function Alias Notes: ``` #### EXAMPLE 7 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt" -UseCache ``` ``` Description: Cache found objects to disk to not over tax Memory resources Notes: By default the Cache location is %SystemDrive%\Windows\Temp ``` #### EXAMPLE 8 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt" -UseCache -RemoveCache ``` ``` Description: Remove Cache data Notes: ``` #### EXAMPLE 9 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt" -UseCache -CachePath $Env:Temp ``` ``` Description: Change the Cache path to the current users Temp directory Notes: By default the Cache location is %SystemDrive%\Windows\Temp ``` #### EXAMPLE 10 ``` Command: Get-ChildItem -path $env:temp -File | Get-BluGenieFileADS -UseCache -ClearGarbageCollecting ``` ``` Description: Scan large directories and limit the memory used to track data Notes: ``` #### EXAMPLE 11 ``` Command: Get-BluGenieFileADS -Help ``` ``` Description: Call Help Information Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter ``` #### EXAMPLE 12 ``` Command: Get-BluGenieFileADS -WalkThrough ``` ``` Description: Call Help Information [2] Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter ``` #### EXAMPLE 13 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt" -OutUnEscapedJSON ``` ``` Description: Return a detailed function report in an UnEscaped JSON format Notes: The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters. Normal return data is a Hash Table. ``` #### EXAMPLE 14 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt" -OutYaml ``` ``` Description: Return a detailed function report in YAML format Notes: The OutUnEscapedJSON is used to Beautify the JSON return and not Escape any Characters. Normal return data is a Hash Table. ``` #### EXAMPLE 15 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt" -ReturnObject ``` ``` Description: Return Output as a Object Notes: The ReturnObject is used to return a PowerShell Object. Normal return data is a Hash Table. This parameter is also used with the ForMat ``` #### EXAMPLE 16 ``` Command: Get-BluGenieFileADS -path "C:\Temp\File1.txt" -ReturnObject -FormatView Yaml ``` ``` Description: Output PSObject information in Yaml format Notes: Current formats supported by default are ('Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml', 'XML') Default is set to (None) and normal PSObject. ``` ### PARAMETERS #### Path ``` -Path Description: File Path Notes: Alias: 'Fullname' ValidateSet: Required? false Position? 1 Default value Accept pipeline input? true (ByValue, ByPropertyName) Accept wildcard characters? false ``` #### ShowAll ``` -ShowAll [] Description: Query all Data Stream values Notes: By default the :DATA Stream is bypassed Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### ClearGarbageCollecting ``` -ClearGarbageCollecting [] Description: Garbage Collection in Powershell to Speed up Scripts and help lower memory consumption Notes: This is enabled by default. To disable use -ClearGarbageCollecting:$False Alias: ValidateSet: Required? false Position? named Default value True Accept pipeline input? false Accept wildcard characters? false ``` #### UseCache ``` -UseCache [] Description: Cache found objects to disk. This is to not over tax Memory resources with found artifacts Notes: By default the Cache location is %SystemDrive%\Windows\Temp Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### CachePath ``` -CachePath Description: Path to store the Cache information Notes: By default the Cache location is %SystemDrive%\Windows\Temp Alias: ValidateSet: Required? false Position? named Default value $('{0}\Windows\Temp\{1}.log' -f $env:SystemDrive, $(New-BluGenieUID)) Accept pipeline input? false Accept wildcard characters? false ``` #### RemoveCache ``` -RemoveCache [] Description: Remove Cache data on completion Notes: Cache information is removed right before the data is returned to the calling process Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### Walkthrough ``` -Walkthrough [] Description: Start the dynamic help menu system to help walk through the current command and all of the parameters Notes: Alias: Help ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### ReturnObject ``` -ReturnObject [] Description: Return information as an Object Notes: By default the data is returned as a Hash Table Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### OutUnEscapedJSON ``` -OutUnEscapedJSON [] Description: Remove UnEsacped Char from the JSON information. Notes: This will beautify json and clean up the formatting. Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### OutYaml ``` -OutYaml [] Description: Return detailed information in Yaml Format Notes: Only supported in Posh 3.0 and above Alias: ValidateSet: Required? false Position? named Default value False Accept pipeline input? false Accept wildcard characters? false ``` #### FormatView ``` -FormatView Description: Automatically format the Return Object Notes: Yaml is only supported in Posh 3.0 and above Alias: ValidateSet: 'Table','Custom','CustomModified','None','JSON','OutUnEscapedJSON','CSV', 'Yaml' Required? false Position? named Default value None Accept pipeline input? false Accept wildcard characters? false ``` #### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216). --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://manuals.blusapphire.io/blugenie/full-function-list/get-blugeniefileads.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.