Help Center

Follow

Inventory Files Scanner: Examples & Usage

Purpose:
You wish to use the Files Scanner to locate files on target systems within your network.

Applies to:
PDQ Inventory Version 8+

Resolution:
Obtaining useful and accurate results from the Files Scanner is dependent on the correct usage of the Include Pattern(s) and Exclude Pattern(s). The Usage and Examples below provide important information on how the Files Scanner operates, how to use the correct series of patterns, and some examples to get you searching quickly or to troubleshoot issues with existing searches.

Usage:

  • Environmental variables (e.g. %PROGRAMFILES%, %PUBLIC%, %SYSTEMROOT%) can be used with the files scanner.
  • Patterns are not case sensitive.
  • In all cases involving directory searches, a trailing "\" is necessary. C:\Users\* will return different results than C:\Users\*\.
  • Searches are confined to local disks only. Network/mapped drives are not included in the file scan process.
  • Before scanning your environment, test the scan thoroughly on a few machines. Patterns are designed to increase the efficiency of searches, resulting in better performance for all users. Because of the power inherent in the patterns, it is possible to do the exact opposite of that and create searches that are inefficient, reduce performance, and cause significant performance issues for you and your users.
  • Including the Files Scanner as part of another scan profile may result in inconsistent results. For example, placing one instance of a Files Scanner as part of a Standard Scan that searches in the same location as another Files Scanner where information has changed could result in results that show both new and obsolete information. Scan information is retained for the particular discrete scan until such time as the scan is run again.

Available Wildcards:

* matches zero or more characters, can be used for files and directories:

  • *bar will return results for foobar, fubar, F00bar,  bar, etc.
  • foo* will return results for foo, foobar, foolish, foo42, food, etc.
  • C:\Users\*\Desktop will search the Desktop directory of all user profile directories in C:\Users\
  • C:\Users\*\*\*\*.txt will search for all txt files in:
    C:\Users\<username>\<subdirectories>\<subdirectories>\
    but not:
    C:\Users\<username>\<subdirectories>\

? matches a single character:

  • ?bar will return 1bar, sbar, 2bar, qbar, but not fubar, foobar, crowbar, or 42bar
  • f??bar will return foobar but not fubar.
  • ?:\ will search all drives (excluding network/mapped drives).

\**\ is used to indicate the current and all subdirectories:

  • C:\Windows\**\fubar.exe
    Searches for fubar.exe in Windows and all subdirectories of Windows.
  • %SYSTEMROOT%\System32\**\hosts
    Searches for the hosts file in [drive]:\Windows\System32\ directory and all subdirectories.
  • C:\Users\**\
    Searches the Users directory and all subdirectories .
  • C:\Users\*\**\*.txt
    Searches for any .txt files in C:\Users\<username>\<subdirectories>
    but not: C:\Users
  • C:\Users\*\*\**\*.txt
    Searches for any .txt files starting in C:\Users\<username>\<subdirectories>\<subdirectories>
    but not in C:\Users\<username>\<subdirectories>\
  • C:\Users\**\Mozilla\**\Firefox\**\Profiles\**\*.xpi
    Searches for any xpi files in C:\Users\<subdirectories>\Mozilla\<subdirectories>\Firefox\<subdirectories>\Profiles\<subdirectories>\*.xpi

Exclusions:

Exclusions work the same way as above with the following exception:
Excluding a directory must contain a trailing backslash "\" otherwise, the exclusion will treat the exclusion as a file.

 

For example: I have a directory named notepad.exe located somewhere on the system and want to exclude this directory but want to make sure and include the program in my file search.

C:\**\notepad.exe will exclude the file, notepad.exe

C:\**\notepad.exe\ will exclude the directory, notepad.exe

 

Exclude a file: C:\Path\to\file.exe or C:\Path\to\*.exe

Exclude a directory: C:\Path\to\directory\ or C:\Path\to\alldirectories\**\

 

Note: When performing large searches, it’s important to exclude large directories that are unnecessary in the search. For instance, the Windows\WinSxS and $Recycle.Bin

Examples:

1. Find a file in a known location:

Find all PST and OST files in the expected location.

FS01.png


2. Find a file in an unknown location, and exclude the known location:

Example 1: Find all PST files not in the expected location (general search).


Example 2: Find all PST files not in the expected location (more targeted search).


3. Find a particular file installed in multiple possible locations:

Find all install locations of Microsoft Word. You could also use %PROGRAMFILES%*\ as well.


4. Find files that may or may not exist:

Find all machines with Groove and Skype for Business executables. You could also use %PROGRAMFILES%*\ as well.


5. Find all executable files in %SYSTEMROOT% with certain exceptions:

Find executable files in the Windows directory and all directories under Windows\.


6. Find some adware:

Find known adware programs excluding specific directories.

FS06.png


7. Find ISO Files:

Find space-consuming ISO files left over from OS/Application installs.


8. Find old install files for disk cleanup:

Find old versions of application installation packages not associated with PDQ Deploy.


9. Find files in an unknown/partially known location:

Find Mozilla Firefox profiles that may or may not exist in the default location.

 

10. Find files while excluding certain directories that might increase scan time.
Find all f?bar.log files but exclude all users Temp directory.
FS10.png

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

0 Comments

Article is closed for comments.
Powered by Zendesk