问题
After modifying an existing file I would like to find out if the software used to modify the file created and saved the new file (discarding the old one) or changed the original file.
Currently I'm using powershell with Get-ChildItem:
Get-ChildItem D: -Force | Select-Object Name, CreationTime, LastWriteTime, Length
This only works if the software in question didn't reapply the orginal CreationTime
in the new file. If it did (like e.g. Excel does when editing existing files) the result would look the same regardless if the original file was modified or a new file created. I figured I could use the object identifier to do that, but I didn't manage to implement it with power shell show it shows the object ID of the file, did I overlook something in properties or do I have to use a different command altogether?
Using -Property *
to show all properties, kind of tells me that I'm on the wrong track altogether (it doesn't give me any usable property at least not for my use case):
Get-ChildItem D: -Force | Select-Object -Property *
I event tried the ID property which, of course, didn't work for file objects. Theoretically I could get a file ID from NTFS's USN journal, but in my use case unfortunately the journal is deactivated on the drive containing the file.
来源:https://stackoverflow.com/questions/58364051/find-unique-file-id-through-powershell