Skip to content

Instantly share code, notes, and snippets.

@Chirishman
Last active August 28, 2023 22:10
Show Gist options
  • Save Chirishman/66874e368e805498c50e28883c60bb23 to your computer and use it in GitHub Desktop.
Save Chirishman/66874e368e805498c50e28883c60bb23 to your computer and use it in GitHub Desktop.
Use PowerForensics to get a list of all files and their sizes from a local NTFS volume's Master File Table
# install-module powerforensics
# import-module powerforensics
function Get-LocalDiskReport {
[CmdletBinding()]
Param(
[Parameter(Mandatory)]
[string]
[ValidateSet('\\.\A:','\\.\B:','\\.\C:','\\.\D:','\\.\E:','\\.\F:','\\.\G:','\\.\H:','\\.\I:','\\.\J:','\\.\K:','\\.\L:','\\.\M:','\\.\N:','\\.\O:','\\.\P:','\\.\Q:','\\.\R:','\\.\S:','\\.\T:','\\.\U:','\\.\V:','\\.\W:','\\.\X:','\\.\Y:','\\.\Z:')]
$VolumeName,
[Parameter()]
[uri]$OutputFolder = 'C:\Temp\'
)
$SelectForensicFileRecords = @{
Property = @(
'Name',
@{n='Extension';e={".$(($_.Name -split '\.')[-1])"}},
'Permission',
@{n='ModifiedTime';e={$_.FNModifiedTime}},
@{n='AccessedTime';e={$_.FNAccessedTime}},
@{n='ChangedTime';e={$_.FNChangedTime}},
@{n='BornTime';e={$_.FNBornTime}},
@{n='RealSize';e={$_.Attribute[1].RealSize}},
@{n='AllocatedSize';e={$_.Attribute[1].AllocatedSize}},
'FullName'
)
}
$OutputPath = Join-Path -Path $OutputFolder.LocalPath -ChildPath (-join($env:COMPUTERNAME,'_',[regex]::Matches($VolumeName,'\w').Value,'.csv'))
Get-ForensicFileRecord -VolumeName $VolumeName | ?{(-not $_.Deleted) -and (-not $_.Directory) -and $_.FullName -match 'ai upscale'} | Select-Object @SelectForensicFileRecords | Export-Csv -Path $OutputPath -NoTypeInformation
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment