Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Get the Creation Date information from office files, Sent / Received Date from outlook emails. UK Date format.
Function Get-FileInformation # This function will gather date information and other properties about a file
param([string]$LiteralFilePath) # Target is the full path to a file
$Target = $LiteralFilePath
$Directory = ($Target -replace '[^\\]*$')
#region Filetypes
#region Outlook
if (
$Target -like "*.msg" # Handle Outlook Files (Has to open OutLook to get sent and received dates)
$application = New-Object -ComObject "Outlook.Application"
$NameSpace = $application.GetNamespace('MAPI')
$document = $NameSpace.OpenSharedItem($Target.replace("\\?\UNC","\"))
$MessageReceived = $document.ReceivedTime
$MessageSent = $document.SentOn
$CreationDate = $null
#region Old Office Files
elseif ( # Handle old Office Files (This was a complete pain to get working!)
$Target -like "*.doc" -or
$Target -like "*.dot" -or
$Target -like "*.wbk" -or
$Target -like "*.xls" -or
$Target -like "*.vsd" -or
$Target -like "*.xlt" -or
$Target -like "*.xlm"
$Folder = ($Target -replace '[^\\]*$').replace("\\?\UNC\","\\")
#$File = Split-Path $Target -leaf
Function OldCreatedDate()
foreach($sFolder in $Folder)
$a = 0
$objShell = New-Object -ComObject Shell.Application
$objFolder = $objShell.namespace($sFolder)
foreach ($strFileName in $objFolder.items())
if ($strFileName.Path -eq ($Target).replace("\\?\UNC\","\\"))
for ($a ; $a -le 266; $a++)
if($objFolder.getDetailsOf($strFileName, $a))
$hash += `
$($objFolder.getDetailsOf($objFolder.items, $a)) = $($objFolder.getDetailsOf($strFileName, $a))
function ConvertHashtableTo-Object ` # credit where credit is due, this is taken from (
$results = @()
$ht | %{
$result = New-Object psobject;
foreach ($key in $_.keys) {
$result | Add-Member -MemberType NoteProperty -Name $key -Value $_[$key]
$results += $result;
return $results
$ContentreatedObject = (OldCreatedDate | where {$_.Keys -eq "Content created"} | ConvertHashtableTo-Object)."Content created"
$CreationDate = Get-Date ([Datetime]::ParseExact(($ContentreatedObject -replace '[^\p{L}\p{Nd}]', ''), 'ddMMyyyyHHmm', $null)) -Format "dd/MM/yyyy HH:mm:ss" -ErrorAction Stop
$CreationDate = $null
#region New Office Files
#Handle Newer Formats
elseif ( #Handles New Office Files (Opens them like a Zip and reads the date from an XML file inside)
$Target -like "*.xlsx" -or
$Target -like "*.xlsm" -or
$Target -like "*.xltx" -or
$Target -like "*.xltm" -or
$Target -like "*.vsdx" -or
$Target -like "*.docm" -or
$Target -like "*.dotx" -or
$Target -like "*.docb" -or
$Target -like "*.docx" -or
$Target -like "*.pptx" -or
$Target -like "*.pptm" -or
$Target -like "*.potx" -or
$Target -like "*.ppam" -or
$Target -like "*.ppsx" -or
$Target -like "*.ppsm" -or
$Target -like "*.sldx" -or
$Target -like "*.sldm"
Add-Type -assembly ""
$zip = [io.compression.zipfile]::OpenRead($Target)
$file = $zip.Entries | where-object {$_.Name -eq "core.xml"}
$stream = $file.Open()
$reader = New-Object IO.StreamReader($stream)
$text = $reader.ReadToEnd()
$XMLText = [XML]$text
$UnFormattedDate = $XMLText.coreProperties.created.'#text'
$FormattedDate = Get-Date $UnFormattedDate -Format "dd/MM/yyyy HH:mm:ss"
$CreationDate = $FormattedDate
#Everything else
$CreationDate = $null
#region Variables
$ItemProperties = Get-ItemProperty $Target | select CreationTime, LastAccessTime, LastWriteTime, Name, Length
$CreationTime = $ItemProperties.CreationTime
$LastAccessTime = $ItemProperties.LastAccessTime
$LastWriteTime = $ItemProperties.LastWriteTime
$FileName = $ItemProperties.Name
$FileSize = $ItemProperties.Length
$FileType = [System.IO.Path]::GetExtension($Target)
$PathLength = $LiteralFilePath.Length
$FolderPath = Split-Path -Path $LiteralFilePath
$ParentFolder = Split-Path (Split-Path $LiteralFilePath -Parent) -Leaf
#region Earliest Date
$Dates = @($CreationDate, $CreationTime, $LastAccessTime, $LastWriteTime, $MessageReceived, $MessageSent)
$EarliestDate = $Dates | Sort-Object | Select-Object -First 1
#region Build Object And Get Earliest Date
New-Object -TypeName psobject -Property `
Filename = $FileName;
FileSize = $FileSize;
FileType = $FileType;
PathLength = ($Directory.replace("\\?\UNC\","\\")).Length;
ParentFolder = Split-Path $Directory -Leaf;
LiteralFilePath = $LiteralFilePath;
LiteralFolderPath = $FolderPath;
EarliestDate = $EarliestDate;
CreationDateOffice = $CreationDate;
CreationTimeWindows = $CreationTime;
LastAccessTimeWindows = $LastAccessTime;
LastWriteTimeWindows = $LastWriteTime;
MessageReceived = $MessageReceived;
MessageSent = $MessageSent;
Get-FileInformation -LiteralFilePath "\\?\UNC\STUPIDLY\LONG\PATH\TO\FILE.docx"

This comment has been minimized.

Copy link
Owner Author

nullldata commented Jun 19, 2019

Added a comment to credit Gordon Byers for a small function used inside my function.

I wish I could remember all the sources that helped me make this script

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.