powershell - PowerShell获取文件夹的已删除文件

Get-ChildItem -Recurse -File #Can`t get deleted files #I get the deleted files, but I dont know what folder they come $Shell = New-Object -ComObject "Shell.Application" ($Shell.NameSpace(0xa)).items()

该NameSpace方法返回一个Folder对象，该对象提供了一种GetDetailsOf方法，您可以使用它来检索每个成员的详细信息Items：

New-Variable -Name 'ssfBITBUCKET'                       -Option Constant -Value 0x0A;
New-Variable -Name 'BitBucketDetails_Name'              -Option Constant -Value 0;
New-Variable -Name 'BitBucketDetails_ParentPath'        -Option Constant -Value 1;
New-Variable -Name 'BitBucketDetails_DeletionTimeText'  -Option Constant -Value 2;
New-Variable -Name 'BitBucketDetails_SizeText'          -Option Constant -Value 3;
New-Variable -Name 'BitBucketDetails_Type'              -Option Constant -Value 4;
New-Variable -Name 'BitBucketDetails_LastWriteTimeText' -Option Constant -Value 5;
New-Variable -Name 'BitBucketDetails_CreationTimeText'  -Option Constant -Value 6;
New-Variable -Name 'BitBucketDetails_LastAccessTimeText'-Option Constant -Value 7;
New-Variable -Name 'BitBucketDetails_AttributesText'    -Option Constant -Value 8;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

foreach ($deletedItem in $bitBucket.Items())
{
    New-Object -TypeName 'PSObject' -Property @{
        # Same as $deletedItem.Name
        Name =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Name);
        ParentPath =         $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_ParentPath);
        DeletionTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_DeletionTimeText);
        Size =               $deletedItem.Size;
        SizeText =           $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_SizeText);
        # Same as $deletedItem.Type
        Type =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Type);
        LastWriteTime =      $deletedItem.ModifyDate;
        LastWriteTimeText =  $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastWriteTimeText);
        CreationTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_CreationTimeText);
        LastAccessTimeText = $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastAccessTimeText);
        AttributesText =     $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_AttributesText);
        IsFolder =           $deletedItem.IsFolder();
        BitBucketPath =      $deletedItem.Path;
    };
}

ssfBITBUCKET是从ShellSpecialFolderConstants枚举。在我设置为文化的 Windows 10 系统上en-US，当将BitBucketDetails_*TimeText常量传递给GetDetailsOf()它时，它不会返回DateTime实例，而是返回 a 形式的时间戳，String其中年、月和日的前面各有一个从左到右的标记 ( [Char] 0x200E)时间前面有一个从右到左的标记 ( [Char] 0x200F)，后跟一个从左到右的标记。

我自己确定了BitBucketDetails_*常量，因为我没有在任何地方找到它们的文档，但是根据这个答案，您可以通过将它们$null作为第一个参数传递给GetDetailsOf(). 因此，您可以继续从位桶命名空间查询列名，直到它开始String像这样返回空 s...

New-Variable -Name 'ssfBITBUCKET' -Option Constant -Value 0x0A;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

for ($column = 0; -not [String]::IsNullOrEmpty(($details = $bitbucket.GetDetailsOf($null, $column))); $column++)
{
    New-Object -TypeName 'PSObject' -Property @{
        Column = $column;
        Name = $details;
    };
}

...在我的系统上输出...

Column Name
------ ----
     0 Name
     1 Original Location
     2 Date Deleted
     3 Size
     4 Item type
     5 Date modified
     6 Date created
     7 Date accessed
     8 Attributes
     ...

powershell - PowerShell获取文件夹的已删除文件

问题描述

解决方案

推荐阅读