0

I have the following code working - based on the great help here on stackoverflow - to parse a CSV file. I would like to replace the $_.File - matches with data from a second CSV file that contains a list of files.

Import-csv "D:\NTFSInfo_C_.csv" -header("File","ParentName","Extension","Attributes","SizeInBytes","CreationDate","LastModificationDate","LastAccessDate","LastAttrChangeDate","Status","USN","FRN","ParentFRN","FileNameCreationDate","FileNameLastModificationDate","FileNameLastAccessDate","FileNameLastAttrModificationDate")|
  Where-Object{($_.File -match "null.sys") -or ($_.File -match "explorer.exe")} |
  Select-Object File, CreationDate, FileNameCreationDate, ParentName |
  Export-CSV -Path c:\NTFS_KNOW_IOC.csv -NoTypeInformation

Question. How do I read a list of file names from a TXT or CSV into an array and then use that array in the Where-Object as shown above?

Thank you!

1 Answer 1

2
$files = Get-Content files.txt
...

Where-Object{($files -match "null.sys") -or ($files -match "explorer.exe")} ...
Sign up to request clarification or add additional context in comments.

3 Comments

Thanks Shay. When I test the code... The files from my files.txt file loads. Thanks. It seems that the where-object doesnt loop through the files list. Do I need do add a loop to get this going?
No, the code doesn't loop through the file list, it just checks if there's a match.
cool. If I wanted to check what was in files.txt against the data in NTFSInfo_C_.csv I would just add a loop? Or is there some sneaky cool way to do it in PS? thanks for you time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.