22

OS: Windows 7 64-bit

Here's a hypothetical problem: there's a folder with multiple sub-folders (which themselves may have sub-folders and so on). A program creates/modifies files in any of these folders say at time t=YYYYMMDDHHMM. Is there are simple command to search for all the files created/modified after time t?

2 Answers 2

32

Take a look at how Advanced Query Syntax works.

Try something like modified:>YYYY-MM-DD hh:mm:ss or datemodified:>YYYY-MM-DD hh:mm:ss

Ranges work like this: datemodified:‎YYYY-MM-DD hh:mm:ss .. ‎YYYY-MM-DD hh:mm:ss

There's also support for various other properties, Boolean operators etc.

(Note that date and time formats may differ according to your locale, system settings and so on.)

6
  • Perfect! That's what I was looking for. Oct 16, 2012 at 4:28
  • 1
    I was looking for something that identifies only files modified in the last hour (no matter when typed in), but date:today type:file seems to be the best it could offer.
    – Marcos
    Apr 24, 2015 at 12:13
  • @Marcos: Yes, but if you specify the exact time range it does work.
    – Karan
    Apr 24, 2015 at 20:04
  • @Karan can you tell me why neither of these work? System.DateModified:>2016-01-04T05:00 and System.DateModified:<2016-01-04T05:00. It is supposed to be January 4, 2016 at 5 AM. I added a > because I thoughts how you after the date and time listed.
    – cokedude
    Jan 4, 2016 at 10:16
  • @Karan I looked at this guide and it said you could do : YYYY-MM-DDThh:mm:ss. msdn.microsoft.com/en-us/library/bb266512%28VS.85%29.aspx
    – cokedude
    Jan 4, 2016 at 10:30
2

The sugested method did not work for me for some reason in Windows 8.1 SL but after trying for 2 or 3 hours I found something out that worked for me. I'm from Brazil and "datemodified" equals "datademodificação" in my language but if you want to use English you can always use system.datemodified instead the equivalent in your language.

This worked in Windows 8.1 SL for me:

system.datemodified:(>YYYY-MM-DD HH:MM .. <YYYY-MM-DD HH:MM)

Ex: To find files modified in 02/28/2017 form 10:50 AM to 10:59 AM (The clock is set to show 24 h):

system.datemodified:(>2017-02-28 10:00 .. <2017-02-28 10:59)

If your clock is set to 12 h you may have to use AM or PM behind the time

Here are some other examples that worked (In Brazil we use DD/MM/YYYY date format):

Datademodificação:>28/02/2017 10:50 .. Datademodificação:<28/02/2017 10:59

Datademodificação:>28/02/2017 10:50 AND Datademodificação:<28/02/2017 10:59

system.datemodified:>28/02/2017 10:50 .. system.datemodified:<28/02/2017 10:59

system.datemodified:>2017-02-28 10:50 .. system.datemodified:<2017-02-28 10:59

It seems to make no differance is you use the date as YYYY-MM-DD or DD/MM/YYYY both worked, what looked like to do the trick for me was using > (bigger than) and < (smaller than) signs.

If you want the "creation date" instead of "modified date" just use: datecreated instead of datemodified.

Greetings, Ricardo Bohner

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .