Last active
November 21, 2021 15:45
-
-
Save OutOfThisPlanet/c19e2138b386f023ed0d2d56b2a76f14 to your computer and use it in GitHub Desktop.
Get the Creation Date information from office files, Sent / Received Date from outlook emails. UK Date format.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Function Get-FileInformation # This function will gather date information and other properties about a file | |
{ | |
param([string]$LiteralFilePath) # Target is the full path to a file | |
$Target = $LiteralFilePath | |
$Directory = ($Target -replace '[^\\]*$') | |
#region Filetypes | |
#region Outlook | |
if ( | |
$Target -like "*.msg" # Handle Outlook Files (Has to open OutLook to get sent and received dates) | |
) | |
{ | |
$application = New-Object -ComObject "Outlook.Application" | |
$NameSpace = $application.GetNamespace('MAPI') | |
$document = $NameSpace.OpenSharedItem($Target.replace("\\?\UNC","\")) | |
$MessageReceived = $document.ReceivedTime | |
$MessageSent = $document.SentOn | |
$document.Close($false) | |
$application.Quit() | |
$CreationDate = $null | |
} | |
#endregion | |
#region Old Office Files | |
elseif ( # Handle old Office Files (This was a complete pain to get working!) | |
$Target -like "*.doc" -or | |
$Target -like "*.dot" -or | |
$Target -like "*.wbk" -or | |
$Target -like "*.xls" -or | |
$Target -like "*.vsd" -or | |
$Target -like "*.xlt" -or | |
$Target -like "*.xlm" | |
) | |
{ | |
$Folder = ($Target -replace '[^\\]*$').replace("\\?\UNC\","\\") | |
#$File = Split-Path $Target -leaf | |
try | |
{ | |
Function OldCreatedDate() | |
{ | |
foreach($sFolder in $Folder) | |
{ | |
$a = 0 | |
$objShell = New-Object -ComObject Shell.Application | |
$objFolder = $objShell.namespace($sFolder) | |
foreach ($strFileName in $objFolder.items()) | |
{ | |
if ($strFileName.Path -eq ($Target).replace("\\?\UNC\","\\")) | |
{ | |
for ($a ; $a -le 266; $a++) | |
{ | |
if($objFolder.getDetailsOf($strFileName, $a)) | |
{ | |
$hash += ` | |
@{ | |
$($objFolder.getDetailsOf($objFolder.items, $a)) = $($objFolder.getDetailsOf($strFileName, $a)) | |
} | |
$hash | |
$hash.clear() | |
} | |
} | |
} | |
} | |
} | |
} | |
function ConvertHashtableTo-Object ` # credit where credit is due, this is taken from (https://gordon.byers.me/powershell/convert-a-powershell-hashtable-to-object/) | |
{ | |
[CmdletBinding()] | |
Param([Parameter(Mandatory=$True,ValueFromPipeline=$True,ValueFromPipelinebyPropertyName=$True)] | |
[hashtable]$ht | |
) | |
PROCESS { | |
$results = @() | |
$ht | %{ | |
$result = New-Object psobject; | |
foreach ($key in $_.keys) { | |
$result | Add-Member -MemberType NoteProperty -Name $key -Value $_[$key] | |
} | |
$results += $result; | |
} | |
return $results | |
} | |
} | |
$ContentreatedObject = (OldCreatedDate | where {$_.Keys -eq "Content created"} | ConvertHashtableTo-Object)."Content created" | |
$CreationDate = Get-Date ([Datetime]::ParseExact(($ContentreatedObject -replace '[^\p{L}\p{Nd}]', ''), 'ddMMyyyyHHmm', $null)) -Format "dd/MM/yyyy HH:mm:ss" -ErrorAction Stop | |
} | |
catch | |
{ | |
$CreationDate = $null | |
} | |
} | |
#endregion | |
#region New Office Files | |
#Handle Newer Formats | |
elseif ( #Handles New Office Files (Opens them like a Zip and reads the date from an XML file inside) | |
$Target -like "*.xlsx" -or | |
$Target -like "*.xlsm" -or | |
$Target -like "*.xltx" -or | |
$Target -like "*.xltm" -or | |
$Target -like "*.vsdx" -or | |
$Target -like "*.docm" -or | |
$Target -like "*.dotx" -or | |
$Target -like "*.docb" -or | |
$Target -like "*.docx" -or | |
$Target -like "*.pptx" -or | |
$Target -like "*.pptm" -or | |
$Target -like "*.potx" -or | |
$Target -like "*.ppam" -or | |
$Target -like "*.ppsx" -or | |
$Target -like "*.ppsm" -or | |
$Target -like "*.sldx" -or | |
$Target -like "*.sldm" | |
) | |
{ | |
Add-Type -assembly "system.io.compression.filesystem" | |
$zip = [io.compression.zipfile]::OpenRead($Target) | |
$file = $zip.Entries | where-object {$_.Name -eq "core.xml"} | |
$stream = $file.Open() | |
$reader = New-Object IO.StreamReader($stream) | |
$text = $reader.ReadToEnd() | |
$XMLText = [XML]$text | |
$UnFormattedDate = $XMLText.coreProperties.created.'#text' | |
$FormattedDate = Get-Date $UnFormattedDate -Format "dd/MM/yyyy HH:mm:ss" | |
$CreationDate = $FormattedDate | |
$reader.Close() | |
$stream.Close() | |
$zip.Dispose() | |
} | |
#endregion | |
#Everything else | |
else | |
{ | |
$CreationDate = $null | |
} | |
#endregion | |
#region Variables | |
$ItemProperties = Get-ItemProperty $Target | select CreationTime, LastAccessTime, LastWriteTime, Name, Length | |
$CreationTime = $ItemProperties.CreationTime | |
$LastAccessTime = $ItemProperties.LastAccessTime | |
$LastWriteTime = $ItemProperties.LastWriteTime | |
$FileName = $ItemProperties.Name | |
$FileSize = $ItemProperties.Length | |
$FileType = [System.IO.Path]::GetExtension($Target) | |
$PathLength = $LiteralFilePath.Length | |
$FolderPath = Split-Path -Path $LiteralFilePath | |
$ParentFolder = Split-Path (Split-Path $LiteralFilePath -Parent) -Leaf | |
#endregion | |
#region Earliest Date | |
$Dates = @($CreationDate, $CreationTime, $LastAccessTime, $LastWriteTime, $MessageReceived, $MessageSent) | |
$EarliestDate = $Dates | Sort-Object | Select-Object -First 1 | |
#endregion | |
#region Build Object And Get Earliest Date | |
New-Object -TypeName psobject -Property ` | |
@{ | |
Filename = $FileName; | |
FileSize = $FileSize; | |
FileType = $FileType; | |
PathLength = ($Directory.replace("\\?\UNC\","\\")).Length; | |
ParentFolder = Split-Path $Directory -Leaf; | |
LiteralFilePath = $LiteralFilePath; | |
LiteralFolderPath = $FolderPath; | |
EarliestDate = $EarliestDate; | |
CreationDateOffice = $CreationDate; | |
CreationTimeWindows = $CreationTime; | |
LastAccessTimeWindows = $LastAccessTime; | |
LastWriteTimeWindows = $LastWriteTime; | |
MessageReceived = $MessageReceived; | |
MessageSent = $MessageSent; | |
} | |
#endregion | |
} | |
Get-FileInformation -LiteralFilePath "\\?\UNC\STUPIDLY\LONG\PATH\TO\FILE.docx" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Added a comment to credit Gordon Byers for a small function used inside my function.
https://gordon.byers.me/powershell/convert-a-powershell-hashtable-to-object/
I wish I could remember all the sources that helped me make this script