From Newsgroup: alt.comp.os.windows-11

PSA: salonb.bat snapshots a list of files on a PC (e.g., additions/removals & when)
intended for further post processing (perhaps using MS CoreUtils)

A file's timestamp tells us something useful about the file.
A historical inventory tells us something useful about the computer.

Using the MS CoreUtils, to find what files disappeared between two dates:

diff --old-line-format='%L' --new-line-format='' --unchanged-line-format='' salonb_20260901.txt salonb_20260904.txt

Likewise, to easily find what files appeared between two dates.

diff --old-line-format='' --new-line-format='%L' --unchanged-line-format='' salonb_20260901.txt salonb_20260904.txt

Even simpler, the files are sorted already, to make using comm easier!

comm -23 salonb_20260901.txt salonb_20260904.txt
comm -13 salonb_20260901.txt salonb_20260904.txt

For example, to report all *.jpg files added between two snapshots:

comm -23 salonb_20260901.txt salonb_20260904.txt | grep -i '\.jpg$'

The salonb.bat script below allows you to easily maintain a historical
record of all the visible files on all drives that are normally mounted
(and ready) on the PC. It automatically discovers the mounted drives before scanning them, so there's no need to specify C:, D:, etc. manually.

I realize most people would simply run a real-time Windows search to find current files, but that's not the intended purpose of this script.

Also, I realize there are utilities out there which do before/after installation snapshots, but this accomplishes that task, differently.

This salonb.bat script creates a grep'able historical inventory of all
files that existed at the time of each scan (placed in a dated archive).

By comparing inventories from different dates, we can determine which files disappeared or were moved during any particular time frame in the survey.

The problem I needed to solve which caused me to write this script was:
Q: When did a particular set of files disappear from my system?
A: (I needed a simple diff'able archive to know that information)

The solution is deliberately simple.
Manually create a periodic filesystem snapshot of all files found.

While we can automate this script, the resulting size is a quarter of a GB.
For my purposes, I can run it roughly once a week (or once a month or so).

This should provides me with enough temporal resolution to identify when something that I knew had existed, no longer exists on the file system.

It's easy to change to run daily if that's something which you may need.
As always, if you find errors or omissions, please let us all know.

The goal of Usenet is to communicate useful value in every thread.
:: -------------------------------------------------------------------------
:: salonb.bat
:: Creates a dated list of all files found on all normally-mounted drives.
:: -------------------------------------------------------------------------
:: v1p7 20260904 Added an error log file using an ERRFILE variable
:: v1p6 20260904 Added gvim edit of the output file (which can be huge)
:: v1p5 20260904 Added ready-drive filter to prevent empty-drive errors
:: v1p4 20260904 Added visual-progress indicators as "/on" slows output
:: v1p3 20260904 Put back "dir /s/a/l/on/b" that PowerShell can't replicate
:: v1p2 20260904 Added a more robust powershell Get-ChildItem as dir hangs
:: v1p1 20260904 Automatically finds and scans normally-mounted drives
:: v1p0 20260904 Scans the C drive only (used only when seeking an inventory)
:: -------------------------------------------------------------------------
:: This script creates an easily maintained historical record of all visible
:: files on all drives that are normally mounted (and ready) on a given PC.
::
:: It automatically discovers the mounted drives before scanning them,
:: so there's no need to manually specify the drive name (C:, D:, etc.).
::
:: On purpose, the inventory is sorted, which makes each dated snapshot
:: directly usable with the Microsoft CoreUtils grep, diff and comm.
::
:: Two snapshots can therefore be easily compared as sets to identify files
:: (or file types) that appeared or disappeared between the archived scans.
::
:: The intent is to create a salonb archive (which can be used years later).
:: Win+R > salonb {Enter} <=== that instantly opens up the salonb archive
:: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\salonb.exe
:: @Default=C:\data\sys\apppath\link\salonb.lnk
:: TARGET=C:\data\sys\apppath\link\salonb.lnk
:: -------------------------------------------------------------------------
:: Comparing contents of two sorted files is easy when using MS CoreUtils
:: NB: Normaly comm is better when we need to get a complete set, while
:: diff is often better when we need to see everything that changed.
::
:: Show a conventional line-by-line difference between two snapshots:
:: C:\> diff salonb_20260901.txt salonb_20260904.txt
::
:: Report all files that were removed between two snapshots:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt
::
:: Report all files that were added between two snapshots:
:: C:\> comm -13 salonb_20260901.txt salonb_20260904.txt
::
:: Report all *.jpg files that were removed:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt | grep -i '\.jpg$'
::
:: Report all *.jpg files that were added:
:: C:\> comm -13 salonb_20260901.txt salonb_20260904.txt | grep -i '\.jpg$'
::
:: Report all files removed from a particular directory:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt | grep -i 'thedir'
::
:: Report all files added under a particular directory:
:: C:\> comm -13 salonb_20260901.txt salonb_20260904.txt | grep -i 'thedir'
::
:: Report all removed files matching a particular filename:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt | grep -i 'my\.docx$'
::
:: Report all files that disappeared from a particular drive:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt | grep -i '^E:\\'
::
:: Save the list of removed files for further investigation:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt > removed.txt
::
:: Report all executable files that disappeared:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt | grep -Ei '\.(exe|dll|sys)$'
::
:: Report all media files that disappeared:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt | grep -Ei '\.(jpg|jpeg|png|gif|mp4|mov)$'
::
:: Report all document files that disappeared:
:: C:\> comm -23 salonb_20260901.txt salonb_20260904.txt | grep -Ei '\.(doc|docx|xls|xlsx|pdf)$'
:: -------------------------------------------------------------------------
:: Note these are four separate switches: dir /s/a/l/on/b c:\*.*
:: /s recurse through subdirectories
:: /a include files with all attributes, including hidden/system
:: /l use lowercase names (this has nothing to do with symbolic links)
:: /on sort by name (this causes the dir to output late in execution)
:: /b bare format
:: -------------------------------------------------------------------------

@echo off
setlocal

:: Get current date
for /f %%a in ('powershell -NoProfile -Command "Get-Date -Format yyyyMMdd"') do (
set date_formatted=%%a
)

:: Configuration (Define editor, output location, and error log)
set "VIEWER=gvim -R"
set "OUTFILE=salonb_%date_formatted%.txt"
set "ERRFILE=salonb_%date_formatted%_errors.txt"

:: salonb scan loop
for /f %%D in ('powershell -NoProfile -Command "[System.IO.DriveInfo]::GetDrives() | Where-Object { $_.IsReady } | ForEach-Object { $_.Name }"') do (
echo [1/2] Scanning and sorting drive %%D... Please wait
dir /s/a/l/on/b "%%D*.*" >> "%OUTFILE%" 2>> "%ERRFILE%"
echo [2/2] Drive %%D complete.
echo --------------------------------------------------
)

echo.
echo Scan complete.
echo Results: %OUTFILE%
echo Errors: %ERRFILE%
echo.
pause

%VIEWER% "%OUTFILE%"

endlocal
:: end of salonb.bat
--
Helping others & learning from them is what this Usenet ng is all about.
--- Synchronet 3.21d-Linux NewsLink 1.2

From Newsgroup: alt.comp.os.windows-11

On Thu, 9/3/2026 10:47 PM, Maria Sophia wrote:

PSA: salonb.bat snapshots a list of files on a PC (e.g., additions/removals & when)
intended for further post processing (perhaps using MS CoreUtils)

A file's timestamp tells us something useful about the file.
A historical inventory tells us something useful about the computer.

When you do this, you should preface your remarks, with
what part of the C: drive can be reliably processed this way.
Is it your Downloads folder ? Is it your Profile tree ?
Is it the entire C: drive ?

Well, we know it isn't the entire C: drive.

You stand a better chance of listing the D: "Data" drive, as it
has fewer curve balls inside it.

The USN Journal broadcasts, are how the Search Indexer keeps track
of ongoing changes. The Search Indexer is not "watching" that
/bin/rm -Rf script you just started executing, it does not "watch"
the primary sources of damage. It watches the Journal, and the Journal
reports 3000 events for the 3000 files you just deleted. The
Search Indexer then removes those 3000 items, from the inverted index.

The Voidtools Everything.exe utility, after having made an initial
list of the C: drive, it listens to the USN Journal broadcasts for
updates to its list. If a new file is Created, then Everything.exe
adds that file to its list. That's how Everything.exe remains <cough> "accurate" for NTFS, all day long. If you were monitoring a FAT32
volume, then the "quality" of the file list is considerably
poorer for it.

When comparing various tools that list the contents of C: ,
the number of files in the difference has been as high as 100,000 files.
That is how many files one of the listing methods, missed.
And that's one of the challenges of "just diffing stuff".

Paul

--- Synchronet 3.21d-Linux NewsLink 1.2