{"id":5814,"date":"2013-11-07T07:57:00","date_gmt":"2013-11-07T07:57:00","guid":{"rendered":""},"modified":"2026-04-18T22:44:37","modified_gmt":"2026-04-18T22:44:37","slug":"windows-search-for-files-using-wql","status":"publish","type":"post","link":"https:\/\/hellem.org\/wblog\/?p=5814","title":{"rendered":"Windows &#8211; Search for files using WQL"},"content":{"rendered":"<p>Needed a script that searches a the entire disk for Java dump files (core, snap, heap, javacore). In addition the files should not be older than X days to limit the search results. Since I have decided that all scripts I create that is related to server maintenance should be written in Powershell I just had to roll up my sleeves and head on to Google to be inspired. Below you can see the result. <\/p>\n<p><!-- codeblock lang= line=1 --><\/p>\n<pre class=\"codeblock\"><code>\r\nparam (\r\n    [string]$logFile = $(throw \"******************************`n\" + \r\n\t\t\t\"Custom error:`nMissing required parameter -logFile.\" +\r\n\t\t\t\"`nSpecify name without full path`n******************************`n`n\")    \r\n)\r\n### Uncomment line below to enable debug\r\n#$DebugPreference = \"Continue\"\r\n\r\n# The script will search the d-drive by default\r\n# If d does not exist it will search the c drive \r\n$drive = \"d:\"\r\nIf (!(Test-Path d:))\r\n{\r\n\t$drive = \"c:\"\r\n\tIf (!(Test-Path c:)) {\r\n\t\tthrow \"Did not find d or c-drive, script will cannot continue\"\r\n\t}\r\n}\r\n$fullLogFile = Join-Path \"$drive\\temp\\\" \"$logFile\";\r\nStart-Transcript $fullLogFile;\r\n\r\n\r\n####\r\n# Fixed variables\r\n####\r\n$notOlderThanDays = -7 # Change this to whatever amount of time you are looking for\r\n\r\n$wmiQuery = \"Select * from CIM_DataFile where Drive='$drive' AND FileName Like '{0}' AND Extension='{1}' AND CreationDate >= '{2}'\"\r\n\r\n# E.g core.20131030.052140.5448.0002.dmp\r\n$core = \"core%\"\r\n$coreExt = \"dmp\"\r\n\r\n# E.g Snap.20131030.052140.5448.0001.trc\r\n$snap = \"Snap%\"\r\n$snapExt = \"trc\"\r\n\r\n# E.g heapdump.20131030.052140.5448.0004.phd\r\n$heap = \"heapdump%\"\r\n$heapExt = \"phd\"\r\n\r\n# javacore.20131030.052140.5448.0003.txt\r\n$javacore = \"javacore%\"\r\n$javacoreExt = \"txt\"\r\n\r\n$date = Get-Date # Current time\r\n$date = $date.AddDays($notOlderThanDays) \r\n$creationdate = Get-Date $date -Format G # This format is the format that the WMI commandlet likes\r\n\r\n#####\r\n# Start the fun\r\n#####\r\n\r\n# Corefiles\r\n$runQuery = [String]::format($wmiQuery,$core,$coreExt,$creationdate)\r\nWrite-Debug \"Start searching for core files\"\r\nWrite-Debug $runQuery\r\nGet-WmiObject -Query $runQuery | select Name\r\n\r\n# Snapfiles\r\n$runQuery = [String]::format($wmiQuery,$snap,$snapExt,$creationdate)\r\nWrite-Debug \"Start searching for snap files\"\r\nWrite-Debug $runQuery\r\nGet-WmiObject -Query $runQuery\r\n\r\n# Heapdumps\r\n$runQuery = [String]::format($wmiQuery,$heap,$heapExt,$creationdate)\r\nWrite-Debug \"Start searching for heap files\"\r\nWrite-Debug $runQuery\r\nGet-WmiObject -Query $runQuery\r\n\r\n# Javacore\r\n$runQuery = [String]::format($wmiQuery,$javacore,$javacoreExt,$creationdate)\r\nWrite-Debug \"Start searching for javacore files\"\r\nWrite-Debug $runQuery\r\nGet-WmiObject -Query $runQuery\r\n\r\nStop-Transcript <\/code><\/pre>\n<p><!-- \/codeblock --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Needed a script that searches a the entire disk for Java dump files (core, snap, heap, javacore). In addition the files should not be older than X days to limit the search results. Since I have decided that all scripts I create that is related to server maintenance should be written in Powershell I just [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47],"tags":[],"class_list":["post-5814","post","type-post","status-publish","format-standard","hentry","category-work-geek"],"_links":{"self":[{"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=\/wp\/v2\/posts\/5814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5814"}],"version-history":[{"count":1,"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=\/wp\/v2\/posts\/5814\/revisions"}],"predecessor-version":[{"id":11813,"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=\/wp\/v2\/posts\/5814\/revisions\/11813"}],"wp:attachment":[{"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hellem.org\/wblog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}