PowerShell 获取文件夹的已删除文件

Question

我尝试使用 Get-ChildItem 和 Trash 获取文件夹中已删除的文件，但效果不佳。在垃圾桶中我可以得到文件，但我不知道如何发现我执行脚本的文件夹的文件。

Get-ChildItem -Recurse -File #Can`t get deleted files

#I get the deleted files, but I dont know what folder they come
$Shell = New-Object -ComObject "Shell.Application"
($Shell.NameSpace(0xa)).items()

Answer 1

NameSpace method返回 Folder object它提供了一个 GetDetailsOf method您可以使用它来检索有关每个 member 的详细信息的 Items :

New-Variable -Name 'ssfBITBUCKET'                       -Option Constant -Value 0x0A;
New-Variable -Name 'BitBucketDetails_Name'              -Option Constant -Value 0;
New-Variable -Name 'BitBucketDetails_ParentPath'        -Option Constant -Value 1;
New-Variable -Name 'BitBucketDetails_DeletionTimeText'  -Option Constant -Value 2;
New-Variable -Name 'BitBucketDetails_SizeText'          -Option Constant -Value 3;
New-Variable -Name 'BitBucketDetails_Type'              -Option Constant -Value 4;
New-Variable -Name 'BitBucketDetails_LastWriteTimeText' -Option Constant -Value 5;
New-Variable -Name 'BitBucketDetails_CreationTimeText'  -Option Constant -Value 6;
New-Variable -Name 'BitBucketDetails_LastAccessTimeText'-Option Constant -Value 7;
New-Variable -Name 'BitBucketDetails_AttributesText'    -Option Constant -Value 8;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

foreach ($deletedItem in $bitBucket.Items())
{
    New-Object -TypeName 'PSObject' -Property @{
        # Same as $deletedItem.Name
        Name =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Name);
        ParentPath =         $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_ParentPath);
        DeletionTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_DeletionTimeText);
        Size =               $deletedItem.Size;
        SizeText =           $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_SizeText);
        # Same as $deletedItem.Type
        Type =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Type);
        LastWriteTime =      $deletedItem.ModifyDate;
        LastWriteTimeText =  $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastWriteTimeText);
        CreationTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_CreationTimeText);
        LastAccessTimeText = $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastAccessTimeText);
        AttributesText =     $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_AttributesText);
        IsFolder =           $deletedItem.IsFolder();
        BitBucketPath =      $deletedItem.Path;
    };
}

ssfBITBUCKET 来自 ShellSpecialFolderConstants enumeration .在我设置为 en-US 区域性的 Windows 10 系统上，当 BitBucketDetails_*TimeText 常量传递给 GetDetailsOf() 时，它返回的不是DateTime 实例，而是一个 String 形式的时间戳，其中年、月和日均以 left-to-right mark ([Char] 0x200E) 开头并且时间前面有一个 right-to-left mark ([Char] 0x200F)后跟一个从左到右的标记。

我自己确定了 BitBucketDetails_* 常量，因为我没有在任何地方找到它们的文档，但是根据 this answer您可以通过将 $null 作为第一个参数传递给 GetDetailsOf() 来查询它们。因此，您可以继续从位桶命名空间中查询列名，直到它开始像这样返回空的 String...

New-Variable -Name 'ssfBITBUCKET' -Option Constant -Value 0x0A;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

for ($column = 0; -not [String]::IsNullOrEmpty(($details = $bitbucket.GetDetailsOf($null, $column))); $column++)
{
    New-Object -TypeName 'PSObject' -Property @{
        Column = $column;
        Name = $details;
    };
}

...在我的系统上输出这个...

Column Name
------ ----
     0 Name
     1 Original Location
     2 Date Deleted
     3 Size
     4 Item type
     5 Date modified
     6 Date created
     7 Date accessed
     8 Attributes
     ...