Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Gets data from Windows Desktop Search
<#
.SYNOPSIS
Gets data from Windows Desktop Search.
.DESCRIPTION
Uses Windows API (ADO) to get data from Windows Desktop Search JET (ESE) database.
.NOTES
File Name : Get-DesktopSearchData.ps1
Author : Dan O'Day - d@4n68r.com
Currently this must be run live directly on a system.
See https://msdn.microsoft.com/en-us/library/windows/desktop/ff521715(v=vs.85).aspx
and https://msdn.microsoft.com/en-us/library/windows/desktop/bb419046(v=vs.85).aspx
for fields / properties to extract.
#>
# connection and record set
$conn = New-Object -ComObject ADODB.Connection
$conn.CommandTimeOut = 0
$recordSet = New-Object -ComObject ADODB.Recordset
$conn.Open("Provider=Search.CollatorDSO;Extended Properties='Application=Windows';")
# query
$recordSet.Open("SELECT System.ItemName, System.ItemTypeText, System.Size, System.IsDeleted, System.DateAccessed, System.Kind, System.ItemDate, System.Search.Store, System.ItemParticipants, System.ItemAuthors, System.IsRead, System.Message.AttachmentNames, System.Search.AutoSummary FROM SystemIndex", $conn, 0, 1)
# iterate over record set
$output = @()
$recordSet.MoveFirst()
do {
$record = [PSCustomObject]@{
'System.ItemName' = $recordSet.Fields.Item("System.ItemName").Value
'System.ItemTypeText' = $recordSet.Fields.Item("System.ItemTypeText").Value
'System.Size' = $recordSet.Fields.Item("System.Size").Value
'System.IsDeleted' = $recordSet.Fields.Item("System.IsDeleted").Value
'System.DateAccessed' = $recordSet.Fields.Item("System.DateAccessed").Value
'System.Kind' = $recordSet.Fields.Item("System.Kind").Value
'System.ItemDate' = $recordSet.Fields.Item("System.ItemDate").Value
'System.Search.Store' = $recordSet.Fields.Item("System.Search.Store").Value
'System.ItemParticipants' = $recordSet.Fields.Item("System.ItemParticipants").Value
'System.ItemAuthors' = $recordSet.Fields.Item("System.ItemAuthors").Value
'System.IsRead' = $recordSet.Fields.Item("System.IsRead").Value
'System.Message.AttachmentNames' = $recordSet.Fields.Item("System.Message.AttachmentNames").Value
'System.Search.AutoSummary' = $recordSet.Fields.Item("System.Search.AutoSummary").Value
};
$output += $record
$recordSet.MoveNext();
} until ($recordSet.EOF -eq $true)
# cleanup
$recordSet.Close()
$conn.Close()
$output | Export-Csv DSOutput.csv -NoTypeInformation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.