PowerShell获取文件夹的已删除文件

Question

我尝试使用Get-ChildItem和Trash获取文件夹的已删除文件，但效果不佳。在垃圾桶中，我可以获取文件，但是我不知道如何发现执行脚本的文件夹中的文件。

Get-ChildItem -Recurse -File #Can`t get deleted files

#I get the deleted files, but I dont know what folder they come
$Shell = New-Object -ComObject "Shell.Application"
($Shell.NameSpace(0xa)).items()

Answer 1

该NameSpace方法返回一个Folder对象，该对象提供一种GetDetailsOf方法，可用于检索有关以下每个成员的详细信息Items：

New-Variable -Name 'ssfBITBUCKET'                       -Option Constant -Value 0x0A;
New-Variable -Name 'BitBucketDetails_Name'              -Option Constant -Value 0;
New-Variable -Name 'BitBucketDetails_ParentPath'        -Option Constant -Value 1;
New-Variable -Name 'BitBucketDetails_DeletionTimeText'  -Option Constant -Value 2;
New-Variable -Name 'BitBucketDetails_SizeText'          -Option Constant -Value 3;
New-Variable -Name 'BitBucketDetails_Type'              -Option Constant -Value 4;
New-Variable -Name 'BitBucketDetails_LastWriteTimeText' -Option Constant -Value 5;
New-Variable -Name 'BitBucketDetails_CreationTimeText'  -Option Constant -Value 6;
New-Variable -Name 'BitBucketDetails_LastAccessTimeText'-Option Constant -Value 7;
New-Variable -Name 'BitBucketDetails_AttributesText'    -Option Constant -Value 8;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

foreach ($deletedItem in $bitBucket.Items())
{
    New-Object -TypeName 'PSObject' -Property @{
        # Same as $deletedItem.Name
        Name =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Name);
        ParentPath =         $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_ParentPath);
        DeletionTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_DeletionTimeText);
        Size =               $deletedItem.Size;
        SizeText =           $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_SizeText);
        # Same as $deletedItem.Type
        Type =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Type);
        LastWriteTime =      $deletedItem.ModifyDate;
        LastWriteTimeText =  $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastWriteTimeText);
        CreationTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_CreationTimeText);
        LastAccessTimeText = $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastAccessTimeText);
        AttributesText =     $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_AttributesText);
        IsFolder =           $deletedItem.IsFolder();
        BitBucketPath =      $deletedItem.Path;
    };
}

ssfBITBUCKET来自ShellSpecialFolderConstants枚举。在设置为en-US区域性的Windows 10系统上，当将BitBucketDetails_*TimeText常量传递给GetDetailsOf()它时，它不返回DateTime实例，而是以String年，月，日为单位的时间戳记，其中的年，月，日分别以左至右标记（[Char] 0x200E）开头。时间前面是从右到左的标记（[Char] 0x200F），然后是从左到右的标记。

我BitBucketDetails_*自己确定了常量，因为我没有在任何地方记录它们，但是根据此答案，您可以通过将其$null作为第一个参数传递来查询它们GetDetailsOf()。因此，您可以一直从位存储桶命名空间中查询列名称，直到它开始返回empty Strings 为止。

New-Variable -Name 'ssfBITBUCKET' -Option Constant -Value 0x0A;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

for ($column = 0; -not [String]::IsNullOrEmpty(($details = $bitbucket.GetDetailsOf($null, $column))); $column++)
{
    New-Object -TypeName 'PSObject' -Property @{
        Column = $column;
        Name = $details;
    };
}

...在我的系统上输出...

Column Name
------ ----
     0 Name
     1 Original Location
     2 Date Deleted
     3 Size
     4 Item type
     5 Date modified
     6 Date created
     7 Date accessed
     8 Attributes
     ...