Get-ChildItem PowerShell Cmdlet
The PowerShell cmdlet Get-ChildItem obtains objects from one or more specified locations, such as a file system directory, registry hive or certificate store. These locations are exposed by PowerShell providers.
If the location is a container, the cmdlet gets the child items in that container. The -Recurse parameter can be used to get items from all child containers, while the -Depth parameter can be used to limit how many levels to recurse to.
The cmdlet does not display empty folders or empty directories. For empty locations, the command returns to the PowerShell prompt without producing any output.
For instance, the following cmdlet will fetch all files and folders from the current drive:
Get-ChildItem
As you can see, by default, Get-ChildItem shows the following information for each item: Mode, LastWriteTime, file size (Length) and Name. The letters in the Mode column have the following meanings:
- l — link
- d — directory
- a — archive
- r — read-only
- h — hidden
- s — system
Get-ChildItem Examples
Let’s look at some use cases of the Get-ChildItem cmdlet:
- Retrieve Child Items from a Particular File System Directory
- Get the Names of Child Items in a Directory
- Get All Text Files in a Directory and Its Subdirectories
- Limit the Results to Specific Child Items
- Exclude Certain Child Items from the Results
- Get Registry Values from a Registry Node
- Get All Certificates with Code-Signing Authority
- Specify How Many Levels of Subdirectories to Search
- Get Items with Specific Attributes
- Limit a Search using a Filter
- Get a List of Directories
- Limit the Results to Files Only
Retrieve Child Items from a Particular File System Directory
To display the child items in a particular file system directory, use the -Path parameter to specify that directory, as shown here:
Get-ChildItem -Path C:\”Program files”
Get the Names of Child Items in a Directory
To see just the names of the child items in a directory, rather than all the details in the previous screenshot, use the -Name parameter:
Get-ChildItem -Path C:\"Program Files" -Name
Get All Text Files in a Directory and Its Subdirectories
To show all .txt files in a certain directory and its subdirectories, use the cmdlet below.
Get-ChildItem -Path C:\"Test Folder"\*.txt -Recurse -Force
The -Path parameter C:Test Folder\*.txt limits the results to files in the specified folder that have the .txt extension. The -Recurse parameter expands the search to include the specified directory and its subdirectories, which are shown under the Directory: headers. The -Force parameter shows hidden files (which have a mode of h).
Limit the Results to Specific Child Items
To find specific objects in a directory, use the -Include parameter. The cmdlet below finds all files in the directory C:\Test Folder that have the extension .log:
Get-ChildItem -Path C:\”Test Folder”\* -Include *.log
Note that a trailing wildcard character (*) is required in the -Path parameter, as shown above, when the -Include parameter is used. If the Path option does not include a trailing asterisk, the command returns to the PowerShell prompt with no output, as shown here:
Get-ChildItem -Path C:\”Test Folder”\ -Include *.log
However, the trailing asterisk in the -Path parameter is unnecessary if the -Recurse parameter is used to search the specified directory and its subdirectories, as in this example:
Get-ChildItem -Path C:\Test Folder -Recurse -Include *.log
Exclude Certain Child Items from the Results
You can exclude certain items from the results by using the -Exclude parameter. Like the -Include parameter, -Exclude requires an asterisk (*) at the end of the -Path parameter unless the -Recurse parameter is used.
To illustrate how this parameter excludes items from the results, let’s first run the following cmdlet to see all the content in the specified directory and its subdirectories:
Get-ChildItem -Path C:\”Test Folder”\ -Recurse
Note that the results include two files whose names start with the letter S. To exclude them from the results, we can use the following cmdlet:
Get-ChildItem -Path C:\”Test Folder”\* -exclude S*
Get Registry Values from a Registry Node
To get registry values, we can use the -Path parameter to specify a registry node. The following cmdlet will display the top level of registry keys (note that HKLM\SOFTWARE is the shortened form of HKEY_LOCAL_MACHINE\SOFTWARE):
Get-ChildItem -Path HKLM:\SOFTWARE
If we do not need to see all the registry keys, we can use the -Exclude parameter to filter out the ones we don’t want. The following cmdlet will exclude all keys that start with the letters R and C:
Get-ChildItem -Path HKLM:\SOFTWARE -Exclude R*,C*Note that the registries Classes, Clients and RegisteredApplications are no longer shown:
The following cmdlets show how to display the contents of other common registries:
Get-ChildItem -Path Registry::HKEY_LOCAL_MACHINE
Get-ChildItem -Path Registry::HKEY_CLASSES_ROOT
Get-ChildItem -Path Registry::HKEY_CURRENT_CONFIG
Get-ChildItem -Path Registry::HKEY_CURRENT_USER
Get-ChildItem -Path Registry::HKEY_USERS
Get-ChildItem -Path Registry::HKEY_PERFORMANCE_DATA
Get All Certificates with Code-Signing Authority
The cmdlet below retrieves each certificate with code-signing authority from the PowerShell Cert: directory and its subdirectories:
Get-ChildItem -Path Cert:\* -Recurse -CodeSigningCert
Notice that the -Path parameter is used to define the Cert: provider. The -Recurse parameter looks through the -Path directory and its subdirectories to return the certificates with code-signing authority.
Specify How Many Levels of Subdirectories to Search
To control the number of subdirectory levels to include in a search, use the -Depth parameter. Empty folders are not counted.
The following cmdlet lists all items in C:Drivers and two levels of its subdirectories:
Get-ChildItem -Path C:\Drivers -Depth 2
Get Items with Specific Attributes
To get only items with certain attributes, use the -Attributes parameter. For example, to get hidden files (not directories) from the specified directory, use this cmdlet:
Get-ChildItem -Path C:\”Test Folder”\ -Attributes !Directory+ Hidden,!Directory+Hidden
The -Attributes parameters accepts the following values:
- Archive
- Compressed
- Device
- Directory (or D)
- Encrypted
- Hidden (or H)
- IntegrityStream
- Normal
- NoScrubData
- NotContentIndexed
- Offline
- ReadOnly (or R)
- ReparsePoint
- SparseFile
- System (or S)
- Temporary
To combine attributes, use the following operators:
- ! (NOT)
- + (AND)
- , (OR)
There should be no spaces between an operator and its attribute. Spaces are allowed after commas.
Limit a Search using a Filter
To qualify the -Path parameter, specify a filter. Filters are supported only by the file system provider, which is the only PowerShell provider installed by default on the machine that PowerShell is running on. Filters are more efficient that other parameters because the provider applies the filter during retrieval, rather than having PowerShell filter the objects after they’re retrieved.
To enumerate files, the filter string is supplied to the .NET API. Only the wildcards * and ? are supported by the API.
To get all the Word files in a particular directory, use this cmdlet:
Get-ChildItem C:\"Test Folder"\* -filter *.docx
Get a List of Directories
To get a list of directories, use the -Directory parameter. While you could achieve the same goal using the -Attributes parameter with the Directory property, the -Directory parameter can be used with the -Recurse parameter to see the subdirectories.
The following cmdlet will list top-level directories:
Get-ChildItem -Path C:\ -Directory
By adding the -Recurse parameter, we can list the subdirectories as well:
Get-ChildItem -Path C:\GroupID10SR1\ -Directory -Recurse
If you want to see only the hierarchy of directories and subdirectories without all the details, use the -Name parameter:
Get-ChildItem -Path C:\GroupID10SR1\ -Directory -Name -Recurse
Limit the Results to Files Only
To get a list of files, use the -File parameter, as shown here:
Get-ChildItem -Path C:\ -File
If you want to see the files from a specified path and its subdirectories, use the -Recurse parameter:
Get-ChildItem -Path C:\GroupID10SR1\ -File -Recurse
