10

My PC has entered an infinite BSOD loop - but I do have access to a safe-mode command prompt.

I'm trying to get an idea of "what changed" that might have triggered this. e.g. I might have gotten a virus, or an app update went belly up.

I'd like to thus see which files were created/modified in the last few days/week or at least the *.exe, *.dll, *.com, *.bat etc.

I thought I was ok with my Batch-fu but I'm stumped on how to write a quick batch file/command that would list the files for me.

REM This will find the files, but the results are all muddled
REM all EXE files, reverse sort by date, recursively through sub-directories

dir *.exe /O-D /S

What I'd really like is to find all (executable filetypes) that were created/modified in the last 3-7 days.

Can anyone point me in the right direction?

Improve this question
8
  • Totally separate from the command to run, it sounds like there is a corrupted setting someone, not an additional executable (which is what your script would find).
    – soandos
    Aug 21, 2011 at 16:25
  • @soandos - quite possible, I'm going to guess that something I installed or updated... is what triggered the setting change. Either way I think a quick batch file for the above scenario would still be a really handy tool.
    – Todd McArthur
    Aug 21, 2011 at 16:27
  • @Todd, have you tried booting from Last Known Good Configuration? windows.microsoft.com/en-US/windows7/… (same concept applies to WinXP/2003)
    – Robert Kerr
    Aug 21, 2011 at 16:46
  • Why don't you analyze the memory dump from the BSOD?
    – ZippyV
    Aug 21, 2011 at 16:46
  • @ZippyV - I suppose I could but I have no idea how to do that.
    – Todd McArthur
    Aug 21, 2011 at 17:14

1 Answer 1

Reset to default
13

this is a simple, albeit roundabout way, using xcopy. you can look at xcopy /? to see the switches etc.

xcopy \windows\*.exe /L /S /D:12-01-2000 .

This command will output a list of .EXE files and paths in the \windows folder recursively, that were modified on or after 12/1/2000, without actually copying them. NOTE there is a period at then end of the command. Its hard to see with a small font.

Edit 1: I took out the /F from the original command, as it was extraneous.

Edit 2: You can pipe the output to "| more" if you want

Improve this answer
7
  • 2
    just before I jump on this... which part is the part that says "don't actually copy"? ... is it the . e.g. copy to the files original position?
    – Todd McArthur
    Aug 21, 2011 at 17:05
  • 3
    /L just lists, not copies
    – Keltari
    Aug 21, 2011 at 17:12
  • @Todd McArthur do xcopy /? man
    – barlop
    Aug 21, 2011 at 18:01
  • 1
    xcopy is a great, yet underutilized tool, in Windows. xxcopy, a 3rd party program is even better. xxcopy.com/xcpymain.htm
    – Keltari
    Aug 21, 2011 at 18:48
  • 1
    Elegant. Thanks. I piped the results to a file with > results.txt. Note, if you run the command in the folder you are xcopying from then you will need to replace the last . with a dummy target or you will get a warning about cyclic copying.
    – CAD bloke
    Sep 1, 2015 at 23:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .