1

I'm writing a script to collect all file hashes in the C: drive but doesn't grab everything. Anyone have any ideas? I tried a mix of things.

gci -Path C:\ -Recurse | Get-FileHash -Algorithm MD5 | Out-File C:\test.txt
mklement0
  • 382,024
  • 64
  • 607
  • 775
Hakdicap
  • 45
  • 4
  • 1
    Does it silently ignore files and/or folders, or does it produce error messages? Does the user you're running the script under have access to all the files you want hashes of? – Lasse V. Karlsen Jun 28 '20 at 17:29
  • The script does have the SilentlyIgnore variable because i was getting denied messages. The user does indeed have access to all files. – Hakdicap Jun 28 '20 at 17:40
  • 1
    If you were getting denied messages then indeed the user does not have access to all files. There are some system files that nobody except the system have access to, likely them. – Lasse V. Karlsen Jun 28 '20 at 17:44

1 Answers1

3

  • Since you're calculating file hashes, make Get-ChildItem return files only, using the -File switch.

  • In order to also process hidden files, additionally use the -Force switch.

  • You must run the command with elevation (as admin) to ensure that you have access to all files, though it is still possible for access to be denied to certain directories and files.

    • By default, this happens with the hidden, system-defined junctions, e.g. in the root of user profiles (e.g., C:\Users\jdoe\Cookies) that exist for backward compatibility only; however, you can ignore those, because they simply point to other directories that can be accessed.
    • Note that Get-ChildItem in this scenario would also ignore any NTFS reparse points that point to other drives or directories (junctions, symbolic links, mount points) even if they are accessible - which is probably what you want.
    • By using -ea SilentlyContinue -ev errs (short for: -ErrorAction SilentlyContinue -ErrorVariable errs), you can examine array $errs afterwards to see which files, specifically, could not be accessed.
# Examine $errs afterwards to see which paths couldn't be accessed.
Get-ChildItem C:\ -Recurse -File -Force -ea SilentlyContinue -ev errs | 
  Get-FileHash -Algorithm MD5 | 
    Out-File C:\test.txt

Note: The Out-File cmdlet saves the for-display representation of the command's output to a file, which isn't designed for further programmatic processing.
To save a representation that is suitable for subsequent programmatic processing, use a cmdlet such as Export-Csv.

mklement0
  • 382,024
  • 64
  • 607
  • 775