21

OS: Windows 7 64-bit

Here's a hypothetical problem: there's a folder with multiple sub-folders (which themselves may have sub-folders and so on). A program creates/modifies files in any of these folders say at time t=YYYYMMDDHHMM. Is there are simple command to search for all the files created/modified after time t?

30

Take a look at how Advanced Query Syntax works.

Try something like modified:>YYYY-MM-DD hh:mm:ss or datemodified:>YYYY-MM-DD hh:mm:ss

Ranges work like this: datemodified:‎YYYY-MM-DD hh:mm:ss .. ‎YYYY-MM-DD hh:mm:ss

There's also support for various other properties, Boolean operators etc.

(Note that date and time formats may differ according to your locale, system settings and so on.)

| improve this answer | |
  • Perfect! That's what I was looking for. – Shashank Sawant Oct 16 '12 at 4:28
  • 1
    I was looking for something that identifies only files modified in the last hour (no matter when typed in), but date:today type:file seems to be the best it could offer. – Marcos Apr 24 '15 at 12:13
  • @Marcos: Yes, but if you specify the exact time range it does work. – Karan Apr 24 '15 at 20:04
  • @Karan can you tell me why neither of these work? System.DateModified:>2016-01-04T05:00 and System.DateModified:<2016-01-04T05:00. It is supposed to be January 4, 2016 at 5 AM. I added a > because I thoughts how you after the date and time listed. – cokedude Jan 4 '16 at 10:16
  • @Karan I looked at this guide and it said you could do : YYYY-MM-DDThh:mm:ss. msdn.microsoft.com/en-us/library/bb266512%28VS.85%29.aspx – cokedude Jan 4 '16 at 10:30
1

The sugested method did not work for me for some reason in Windows 8.1 SL but after trying for 2 or 3 hours I found something out that worked for me. I'm from Brazil and "datemodified" equals "datademodificação" in my language but if you want to use English you can always use system.datemodified instead the equivalent in your language.

This worked in Windows 8.1 SL for me:

system.datemodified:(>YYYY-MM-DD HH:MM .. <YYYY-MM-DD HH:MM)

Ex: To find files modified in 02/28/2017 form 10:50 AM to 10:59 AM (The clock is set to show 24 h):

system.datemodified:(>2017-02-28 10:00 .. <2017-02-28 10:59)

If your clock is set to 12 h you may have to use AM or PM behind the time

Here are some other examples that worked (In Brazil we use DD/MM/YYYY date format):

Datademodificação:>28/02/2017 10:50 .. Datademodificação:<28/02/2017 10:59

Datademodificação:>28/02/2017 10:50 AND Datademodificação:<28/02/2017 10:59

system.datemodified:>28/02/2017 10:50 .. system.datemodified:<28/02/2017 10:59

system.datemodified:>2017-02-28 10:50 .. system.datemodified:<2017-02-28 10:59

It seems to make no differance is you use the date as YYYY-MM-DD or DD/MM/YYYY both worked, what looked like to do the trick for me was using > (bigger than) and < (smaller than) signs.

If you want the "creation date" instead of "modified date" just use: datecreated instead of datemodified.

Greetings, Ricardo Bohner

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.