Take the 2-minute tour ×

I need to generate lists of all files that has been created, modified and accessed respectively on a windows system.

I have found the command forfiles here http://technet.microsoft.com/sv-se/library/cc753551(v=ws.10).aspx but apparently this does not use the created and accessed timestamps, I need those also (in separate lists).

I have also looked into using the dir command but I have only found references to sorting and not filtering in the help sections.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Your question have some unclear details, so I made some assumptions.

The Batch file below create three separated text files: created.txt, modified.txt and accessed.txt, with the lists of the files in current folder; each list have the respective date in YYYYMMDDHHMMSS format followed by the file name, so it may be easily processed.

@echo off
setlocal DisableDelayedExpansion
for %%f in (created modified accessed) do if exist %%f.txt del %%f.txt
set "folder=%CD:~2%"
for /F "skip=1 tokens=1-3*" %%a in (
    '"wmic datafile where (path='%folder:\=\\%\\') get InstallDate, LastModified, 

LastAccessed, Name"'
                                   ) do (
   for /F "delims=." %%A in ("%%a") do echo %%A %%d>> created.txt
   for /F "delims=." %%B in ("%%b") do echo %%B %%d>> modified.txt
   for /F "delims=." %%C in ("%%c") do echo %%C %%d>> accessed.txt

rem Process each list this way:
for /F "tokens=1*" %%a in (created.txt) do echo %%a - %%b
share|improve this answer
Works like a charm! Thank you very much! –  AlexCaelus Apr 27 '12 at 14:27

In the subject there was also "between dates" :) How about that?

forfiles doesn't allow to put 2 date conditions ('+' and '-').

I also have a problem with a date condition with unequalness in wmic.

for example:

wmic datafile where (path='%folder:\=\\\\%\\\\' and lastmodified ^> "20120713" and lastmodified ^< "20120714") get Name

returns nothing (I needed an escape ('^') before '<' and '>' to run the command).


returns only files modified after 20120714000000 (in the wmic notation).

share|improve this answer

Your Answer


