Powershell - List all alternate data stream information from one directory












2















My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.



I currently have the first two parts scripted:



cd c:usersprofilenamedownloads
gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'


To open an example data stream file, open cmd, cd to a directory, then run:



dir /r


After this, grab the zone identified name of one of the files and run this command without the :$data.



Example before removing :$Data



notepad test.docx:Zone.Identifier:$Data


After removing(run this command):



notepad test.docx:Zone.Identifier


How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?



Any help is greatly appreciated.










share|improve this question





























    2















    My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.



    I currently have the first two parts scripted:



    cd c:usersprofilenamedownloads
    gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'


    To open an example data stream file, open cmd, cd to a directory, then run:



    dir /r


    After this, grab the zone identified name of one of the files and run this command without the :$data.



    Example before removing :$Data



    notepad test.docx:Zone.Identifier:$Data


    After removing(run this command):



    notepad test.docx:Zone.Identifier


    How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?



    Any help is greatly appreciated.










    share|improve this question



























      2












      2








      2








      My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.



      I currently have the first two parts scripted:



      cd c:usersprofilenamedownloads
      gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'


      To open an example data stream file, open cmd, cd to a directory, then run:



      dir /r


      After this, grab the zone identified name of one of the files and run this command without the :$data.



      Example before removing :$Data



      notepad test.docx:Zone.Identifier:$Data


      After removing(run this command):



      notepad test.docx:Zone.Identifier


      How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?



      Any help is greatly appreciated.










      share|improve this question
















      My end goal here is to cd to a directory in powershell and then list all the alternate data stream files, then output all their content to a CSV.



      I currently have the first two parts scripted:



      cd c:usersprofilenamedownloads
      gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data'


      To open an example data stream file, open cmd, cd to a directory, then run:



      dir /r


      After this, grab the zone identified name of one of the files and run this command without the :$data.



      Example before removing :$Data



      notepad test.docx:Zone.Identifier:$Data


      After removing(run this command):



      notepad test.docx:Zone.Identifier


      How would I go about taking the output of the second command and using the PSPath field to open each of these files and then output all the contents in to one CSV file?



      Any help is greatly appreciated.







      powershell alternate-data-stream






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Nov 19 '18 at 19:02









      mklement0

      130k20243280




      130k20243280










      asked Nov 19 '18 at 18:18









      user3290171user3290171

      56112




      56112
























          2 Answers
          2






          active

          oldest

          votes


















          1














          Presuming your are after the Stream content:



          ## Q:Test20181119SO_53380498.ps1
          Pushd $ENV:USERPROFILEDownloads
          Get-ChildItem -Recurse | ForEach-Object {
          Get-Item $_.FullName -Stream *
          } | Where-Object Stream -ne ':$Data' |
          Select-Object FileName,Stream,
          @{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
          @{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
          @{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
          Export-Csv Streams.csv -NoTypeInformation


          Shorted output of the generated Streams.csv file

          (date format depends on locale/user settings):



          > gc .Streams.csv
          "FileName","Stream","CreationTime","LastWriteTime","Content"
          "C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"


          If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.






          share|improve this answer


























          • This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.

            – user3290171
            Nov 20 '18 at 9:18











          • Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime

            – LotPings
            Nov 20 '18 at 9:30











          • See changed answer.

            – LotPings
            Nov 20 '18 at 9:49



















          0














          I think this might be close to what you want:



          $files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}


          Broken into multi-lines for legibility:



          $files = Get-ChildItem -Recurse | 
          Where-Object { Get-Item $_.FullName -Stream * } |
          Where-Object {$_.Stream -ne ':$Data'} |
          Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}





          share|improve this answer

























            Your Answer






            StackExchange.ifUsing("editor", function () {
            StackExchange.using("externalEditor", function () {
            StackExchange.using("snippets", function () {
            StackExchange.snippets.init();
            });
            });
            }, "code-snippets");

            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "1"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53380498%2fpowershell-list-all-alternate-data-stream-information-from-one-directory%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            1














            Presuming your are after the Stream content:



            ## Q:Test20181119SO_53380498.ps1
            Pushd $ENV:USERPROFILEDownloads
            Get-ChildItem -Recurse | ForEach-Object {
            Get-Item $_.FullName -Stream *
            } | Where-Object Stream -ne ':$Data' |
            Select-Object FileName,Stream,
            @{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
            @{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
            @{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
            Export-Csv Streams.csv -NoTypeInformation


            Shorted output of the generated Streams.csv file

            (date format depends on locale/user settings):



            > gc .Streams.csv
            "FileName","Stream","CreationTime","LastWriteTime","Content"
            "C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"


            If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.






            share|improve this answer


























            • This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.

              – user3290171
              Nov 20 '18 at 9:18











            • Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime

              – LotPings
              Nov 20 '18 at 9:30











            • See changed answer.

              – LotPings
              Nov 20 '18 at 9:49
















            1














            Presuming your are after the Stream content:



            ## Q:Test20181119SO_53380498.ps1
            Pushd $ENV:USERPROFILEDownloads
            Get-ChildItem -Recurse | ForEach-Object {
            Get-Item $_.FullName -Stream *
            } | Where-Object Stream -ne ':$Data' |
            Select-Object FileName,Stream,
            @{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
            @{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
            @{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
            Export-Csv Streams.csv -NoTypeInformation


            Shorted output of the generated Streams.csv file

            (date format depends on locale/user settings):



            > gc .Streams.csv
            "FileName","Stream","CreationTime","LastWriteTime","Content"
            "C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"


            If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.






            share|improve this answer


























            • This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.

              – user3290171
              Nov 20 '18 at 9:18











            • Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime

              – LotPings
              Nov 20 '18 at 9:30











            • See changed answer.

              – LotPings
              Nov 20 '18 at 9:49














            1












            1








            1







            Presuming your are after the Stream content:



            ## Q:Test20181119SO_53380498.ps1
            Pushd $ENV:USERPROFILEDownloads
            Get-ChildItem -Recurse | ForEach-Object {
            Get-Item $_.FullName -Stream *
            } | Where-Object Stream -ne ':$Data' |
            Select-Object FileName,Stream,
            @{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
            @{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
            @{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
            Export-Csv Streams.csv -NoTypeInformation


            Shorted output of the generated Streams.csv file

            (date format depends on locale/user settings):



            > gc .Streams.csv
            "FileName","Stream","CreationTime","LastWriteTime","Content"
            "C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"


            If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.






            share|improve this answer















            Presuming your are after the Stream content:



            ## Q:Test20181119SO_53380498.ps1
            Pushd $ENV:USERPROFILEDownloads
            Get-ChildItem -Recurse | ForEach-Object {
            Get-Item $_.FullName -Stream *
            } | Where-Object Stream -ne ':$Data' |
            Select-Object FileName,Stream,
            @{n='CreationTime';e={(Get-Item $_.FileName).CreationTime}},
            @{n='LastWriteTime';e={(Get-Item $_.FileName).LastWriteTime}},
            @{n='Content';e={gc "$($_.FileName):$($_.Stream)"}} |
            Export-Csv Streams.csv -NoTypeInformation


            Shorted output of the generated Streams.csv file

            (date format depends on locale/user settings):



            > gc .Streams.csv
            "FileName","Stream","CreationTime","LastWriteTime","Content"
            "C:UsersLotPingsDownloads2018-06-27-raspbian-stretch.zip","Zone.Identifier","2018-07-29 22:13:03","2018-07-29 22:16:41","[ZoneTransfer] ZoneId=3"


            If your final destination for the csv supports multiline fields, you could do -join "`n" on the content.







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited Nov 20 '18 at 9:48

























            answered Nov 19 '18 at 23:19









            LotPingsLotPings

            19k61532




            19k61532













            • This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.

              – user3290171
              Nov 20 '18 at 9:18











            • Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime

              – LotPings
              Nov 20 '18 at 9:30











            • See changed answer.

              – LotPings
              Nov 20 '18 at 9:49



















            • This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.

              – user3290171
              Nov 20 '18 at 9:18











            • Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime

              – LotPings
              Nov 20 '18 at 9:30











            • See changed answer.

              – LotPings
              Nov 20 '18 at 9:49

















            This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.

            – user3290171
            Nov 20 '18 at 9:18





            This works exactly as I would like, thanks! How would I go about getting the date created and date modified for each file? I mean the date modified and date created of original file, not the data stream file.

            – user3290171
            Nov 20 '18 at 9:18













            Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime

            – LotPings
            Nov 20 '18 at 9:30





            Problem is that the inital properties of the gci are no more accessible. I see two ways, 1st replace line 2 with ForEach($File in (gci -r){..} and subsequently use $file instead of $_ . 2nd use another calculated property to (Get-Item $Filename).CreationTime

            – LotPings
            Nov 20 '18 at 9:30













            See changed answer.

            – LotPings
            Nov 20 '18 at 9:49





            See changed answer.

            – LotPings
            Nov 20 '18 at 9:49













            0














            I think this might be close to what you want:



            $files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}


            Broken into multi-lines for legibility:



            $files = Get-ChildItem -Recurse | 
            Where-Object { Get-Item $_.FullName -Stream * } |
            Where-Object {$_.Stream -ne ':$Data'} |
            Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}





            share|improve this answer






























              0














              I think this might be close to what you want:



              $files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}


              Broken into multi-lines for legibility:



              $files = Get-ChildItem -Recurse | 
              Where-Object { Get-Item $_.FullName -Stream * } |
              Where-Object {$_.Stream -ne ':$Data'} |
              Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}





              share|improve this answer




























                0












                0








                0







                I think this might be close to what you want:



                $files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}


                Broken into multi-lines for legibility:



                $files = Get-ChildItem -Recurse | 
                Where-Object { Get-Item $_.FullName -Stream * } |
                Where-Object {$_.Stream -ne ':$Data'} |
                Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}





                share|improve this answer















                I think this might be close to what you want:



                $files = gci -recurse | % { gi $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}


                Broken into multi-lines for legibility:



                $files = Get-ChildItem -Recurse | 
                Where-Object { Get-Item $_.FullName -Stream * } |
                Where-Object {$_.Stream -ne ':$Data'} |
                Select-Object -Properties filename, stream, @{'name'='identifier';"e"={"$($_.filename)$($_.stream)"}}






                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited Nov 19 '18 at 19:42









                JohnLBevan

                14.4k146107




                14.4k146107










                answered Nov 19 '18 at 18:38









                thom schumacherthom schumacher

                848515




                848515






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Stack Overflow!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53380498%2fpowershell-list-all-alternate-data-stream-information-from-one-directory%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Guess what letter conforming each word

                    Port of Spain

                    Run scheduled task as local user group (not BUILTIN)