Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The command I am executing is forfiles -p"C:\testdata" -m*.* -d-1 -c"cmd /c echo @PATH\@FILE"

I have specified that I wish to only list files that are a day old however when I execute the statement, it returns me a list of files that were created today.

Why is that? Am I doing something wrong? Would it be better to specify a time period as opposed to a date e.g. 24 hours?

The version of forfiles I have reads as follows FORFILES v 1.1 - emmanubo@microsoft.com - 4/98. The batch file is being run on Windows XP.

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Forfiles version you use is not native XP command. It's an older version of the utility, which was originally distributed with one of the W2K Resource Kits (I think it goes even to NT Resource kit, although I'm not sure). There is nothing wrong using that on XP per se , but if you look closely into it's syntax, it says (emphasis mine):

-d[+|-][DDMMYY|DD] Select files with date >= or <=DDMMYY (UTC) or files having date >= or <= (current date - DD days)

Note UTC in the description. This means (1.1) forfiles uses different time stamps that you think it does - unless your system time is UTC (no offset), no daylight savings.
This will be probably easier with an example. I'm UTC+1, daylight savings time.
(today's date - 2012-09-19)

  • Create file and do a dir:

2012-09-19 00:14 5 zzz_utc.txt

it has today's date, so it should not be selected by forfiles,let's check it:

FORFILES -pc:\temp -mzzz_utc.* -d-1 -c"CMD /C Echo @FILE"

But it does get selected! Why? Let's look at file UTC times (following command is run from powershell):

ls .\zzz_utc.txt |select LastAccessTime,LastAccessTimeUTC

LastAccessTime                          LastAccessTimeUtc
--------------                          -----------------
2012-09-19 00:15:11                     2012-09-18 22:15:11

As you can see, TimeUtc - the one used by (1.1) forfiles is from yesterday! That's why it gets selected by the tool.

share|improve this answer
That makes sense as it is looking at a date and time of x hours behind the actual creation time especially it is using UTC. –  PeanutsMonkey Sep 18 '12 at 23:10
well spotted. Any idea with this one? superuser.com/questions/588608/… –  barlop Jul 16 at 11:24
@barlop Difficult to say esp. without the files/system in question... were both source and dest same filesystem? (timestamps are stored differently, see msdn.microsoft.com/en-us/library/windows/desktop/…) –  wmz Jul 16 at 13:58
@wmz yes they are on two different ntfs hard drives. and I still have the files. I notice that when I do the stat command in cygwin to view the times, it shows four times(access,modified,change,birth), and while the modified and creation time are the same, the 'changed' time is different. I don't know of a windows option to view the changed time though cygwin can. and as of writing, i'm not sure how to change the 'changed' time to some arbitrary time of my choosing, to test. It's not the modification time i'm talking about. –  barlop Jul 16 at 16:38

"... I wish to list only files that are a day old ..."

Do you mean "files that were created yesterday"?  I.e., (today being September 18), files whose modification date/time is ≥ 0000 (midnight in the early morning of) Sept. 17, and ≤ 2359.60 (midnight at the end of) Sept. 17.  Well, that's two date/time constraints, and forfiles doesn't let you specify more than one.  Bottom line: I believe that forfiles will not do that.

...  However, when I try /d -1 on my Windows 7 box, I get files that were created yesterday or before.  So maybe the Windows XP version of forfiles is broken.

share|improve this answer
So what does -d-1 actually do i.e what dates and times does it look at? –  PeanutsMonkey Sep 18 '12 at 22:02
@PeanutsMonkey: I'm not sure what your question is. I told you the behavior I observed. To quote selectively from the documentation, -1 "selects files with a last modified date ... earlier than or equal to ... the current date (i.e., today) minus one (i.e., yesterday)." –  Scott Sep 18 '12 at 22:18
Sorry. I should have been more clear. Does -1 mean that it is looking at the previous day e.g. 17 of September between the time 0000 and 2359 and that it discounts the file created on the 18th at 0000? –  PeanutsMonkey Sep 18 '12 at 22:32
@PeanutsMonkey: OK, I just tried -1 again (on my Windows 7 box), and it did not include a file that had a modification time of 0000 on the 18th. Of course, YMMV. –  Scott Sep 18 '12 at 22:38
Interesting mine does. What version of forfiles.exe do you have? –  PeanutsMonkey Sep 18 '12 at 22:57

From the fine documentation (emphasis mine):

Selects files with a last modified date later than or equal to (+) the current date plus the number of days specified, or earlier than or equal to (-) the current date minus the number of days specified.


Perhaps you could try with a VBScript:

Set args = WScript.Arguments.Named
Set fso  = CreateObject("Scripting.FileSystemObject")

d = 0
p = "."

If args.Exists("?") Or args.Count = 0 Then
  WScript.Echo "Usage: cscript " & WScript.ScriptName & " [/d:DAYS] [/p:PATH]"
End If

If args.Exists("d") Then d = args("d")
If args.Exists("p") Then p = args("p")

refDate = DateAdd("d", d, Now)
TraverseFolders fso.GetFolder(p)

Sub TraverseFolders(fldr)
  For Each f In fldr.Subfolders
  For Each f In fldr.Files
    If f.DateLastModified < refDate Then
      WScript.StdOut.WriteLine f.Path
    End If
End Sub
share|improve this answer
Okay so if I have understood that correctly if I specify d+1 it is looking for files that are greater than 1 day from today inclusive and if I do d-1 it is looking for files less than 1 day from today inclusive. So basically if I wanted to look for files that were older than 1 day, I would have to do d-2. Is that right? –  PeanutsMonkey Sep 18 '12 at 20:08
No, actually, I misread your question. Sorry, my mistake. According to syntax and documentation the command should indeed not list files that were modified today. However, did you check that the last modified date actually is not older than today? (dir /t:w) You could also try -d-DDMMYY instead of -d-1 and see if that yields the desired result. –  Ansgar Wiechers Sep 18 '12 at 20:15
Yes I did. It result it yields is today's date with a timestamp of 1 a.m. The reason I don't wish to use a specific date is because I need to only delete files that are x days old as opposed to between a date range –  PeanutsMonkey Sep 18 '12 at 20:28
Thanks however am limited to using batch files at the moment. –  PeanutsMonkey Sep 18 '12 at 22:57
Of course, you might be able to build a string representing the date in a batch file. This would be a piece of cake in a *nix shell script. I might be able to do it in a .BAT, but I'd have to think about it -- it doesn't strike me as easy. –  Scott Sep 18 '12 at 23:23

Seems FORFILES /D -1 has a bug even on Windows 8 and Windows Server 2008 R2 (can't make it to work - selects all files - on a system with Greek dates)

You could parse the %date% as suggested in some comment above, but note that on Windows 8 for example the date is showing 3 letters with day name and a space char first, then the classic date format. Also that date will be in localized format, whereas FORFILES /D expects a date in dd/MM/yyyy format according to forfiles /? (at least on Win8).

CORRECTION: there seems to be a misunderstanding (by me and others too judging from a search on the net) about what /D -dd does, seems it doesn't search for files being dd days old, but being older than dd days

so you need to use the /D +dd/MM/yyyy syntax of FORFILES and pass in yesterday's date there to find all files with date greater than yesterday. To automate this you could use %date% and parse it with %date:~7,2%/%date:~4,2%/%date:~-4% or something like that (may need to reorder the date parts there depending on your locale)

share|improve this answer
Note that in batch files you have to use %%, not single % –  George Birbilis Jul 16 at 11:12
btw, to find files changed today one can use /D +0 as it seems and to find files older than today can use /D -0 –  George Birbilis Jul 16 at 11:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.