Filename

Local

Filenames

where /R C:\Users\ "keyword*"	Recursive search for a keyword (CMD only).
dir /s /b <filename>	Recursive search for a filename with full path.
dir <filename>*	Lists files in the current directory with a name starting with <filename>.
dir <path>\<filename>*	Lists files in the specified path with a name starting with <filename>.
Get-ChildItem C:\Users *readme* -Recurse	Recursive search with PowerShell.
Get-ChildItem -Path <path> -Filter <filename>*	Lists files in the specified path matching the filter <filename>*. More efficient than -Include.
Get-ChildItem -Path <path> -Include <filename>*	Lists files in the specified path including files matching the pattern <filename>*. Allows more complex patterns than -Filter.
Get-ChildItem -Path <path> -Exclude <filename>*	Lists files in the specified path excluding files matching the pattern <filename>*.
findstr /s /i /m "search_string"	Recursive search for a string (CMD only), case-insensitive.
for /R %f in (<filename>*) do @echo %f	Recursive for-loop in CMD.
Where-Object { $_.Name -like "<filename>*" }	Filters objects by name match in PowerShell.

Find files by name/partial name (WMI).

Get-CimInstance -ClassName CIM_DataFile -Filter "Name LIKE '%<filename>%'"

Find file names and paths by name/partial name (WMI).

wmic datafile where Name like '%<filename>%' get Name, FileName

Find all files with a particular name:

Get-ChildItem "C:\\Users\\" recurse -include \*passwords\*.txt

Searches only non-system files recursively:

Get-ChildItem -Path <path> -Recurse | Where-Object { $_.Attributes -match 'Archive' } | Select-String -Pattern <string>

File Extensions

Multiple extensions:

Get-ChildItem -Path C:\Documents -Recurse -Include "*.txt", "*.docx"

Remote

Find applications that begin with Google:

Get-WmiObject Win32_Product -computername win7 -credential fred -filter "Name like '%Google%'"

Uninstall applications that begin with Google:

(Get-WmiObject Win32_Product -computername win7 -credential fred -filter "Name like '%Google%'").Uninstall()

Content

Go-to Command:

findstr /s /i /n /p "keyword" *.* 

/s Recursive

/i Case-insensitive

/n Displays line numbers with output

/p Skips files with non-printable characters

*.* Searches all files

Recursive:

gci -Recurse | sls "keyword"

Recursive, case-insensitive:

findstr /s /i "keyword" *.*

Searches for entire lines matching the string:

findstr /s /m <string> <path>

Searches only text files recursively:

Get-ChildItem -Path <path> -Recurse -Include *.txt | Select-String -Pattern <string>

Searches all files for a keyword across the entire C: drive, returning only files that contain the keyword:

Get-ChildItem -Path C:\ -Recurse | Where-Object { $_ | Select-String -Pattern "keyword" -Quiet }

Searches for a keyword in files under a specified directory and lists each file only once if the keyword is found:

Get-ChildItem -Path C:\path\to\directory -Recurse | Select-String -Pattern "keyword" -List

Additional Tips:

Use regular expressions with findstr for advanced pattern matching.

Users (Owners)

Lists files owned by a specific username, recursively:

dir <path> /q /s /o:n | findstr /i "Owner: <username>"

Get-ChildItem -Path <path> -Recurse -Owner <username>

Get-ChildItem <Path> -Recurse | ForEach-Object { Get-Acl $_.FullName } | Select-Object Path, Owner

Lists files owned by a specific username on the local system:

wmic datafile where owner='<username>' get Name, FileName

Lists files where the owner's SID (Security Identifier) matches the specified username:

Get-ChildItem -Path <path> -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.GetAccessControl().Owner.Owner -eq "<username>" }

Lists files created by a specific username within a specified date range:

wmic datafile where (owner='<username>' and CreationDate >= <start_date> and CreationDate <= <end_date>) get Name, FileName

Lists files with specific permissions for a user, recursively:

Get-ChildItem -Path <path> -Recurse -File | Where-Object { $_.GetAccessControl().Access.IdentityReference -like "<username>*" } | Select-Object FullName

Windows Search (GUI)

Open File Explorer, navigate to the desired directory.

In the search bar, type created:<username> (replace with the actual username).

Optionally, filter by date range using created:<start_date>..<end_date>.

Additional Tips:

Replace with the actual username you're searching for.

Use wildcards (*) in the username to match partial names.

For a case-insensitive search in PowerShell, use -imatch or -ilike instead of =.