使用PowerShell脚本模拟windows通配符搜索

需要查找文档中是否有ip地址。 我们是否有任何PowerShell脚本/命令可用于任何文件类型。

---

我发现很少有脚本只适用于.txt文件。

为了在任何文件类型中搜索IP地址，您需要解决两个基本问题

首先，PowerShell需要对任何文件类型的内容执行搜索

第二，搜索需要定义一个IP地址

---

对于第一个问题，可以使用Windows search搜索常见文件类型的内容。但是，Windows Search没有搜索IP地址的实用方法。它擅长搜索人类可读的文本，如“苹果派”。它没有适用于IP地址的有用或语法。就Windows搜索而言，您最好搜索“IP地址”

---

对于第二个问题，有许多字符串可以用作IP地址：

• 172.16.0.1
• 192.0.2.0/24
• 10.x.x.x
• 2001:0db8:0000:0000:0000:8a2e:0370:7334
• 2001:db8:：8a2e:370:7334

通常，开发解决方案将从定义适当的正则表达式开始。你可以在网上找到一些帮助。但要覆盖所有符合“任何ip地址”条件的内容还需要努力

---

您描述的场景通常称为eDiscovery。你可能会搜索一个能满足你要求的产品

---

为了让其他人能从我的研究中受益，下面是一个在PowerShell中使用Windows Search的工作示例。在这里，我在

C:/Users/Michael/Stack Overflow

目录中搜索

PowerShell

。请注意，搜索词相对简单，这是全文搜索的一个限制

确保向下滚动并复制整个脚本

# Adapted from 
# https://docs.microsoft.com/en-us/windows/win32/search/-search-sample-wsfromscript
# and 
# https://github.com/microsoft/Windows-classic-samples/blob/master/Samples/Win7Samples/winui/WindowsSearch/WSFromScript/QueryEverything.vbs

# See 
# https://docs.microsoft.com/en-us/windows/win32/search/-search-sql-folderdepth
# for information on searching specific directories. 

# See
# https://docs.microsoft.com/en-us/windows/win32/search/-search-sql-contains
# for information on searching the body of a document. 

# See 
# https://docs.microsoft.com/en-us/windows/win32/properties/core-bumper
# for potential properties to return. 


# Create the ADO objects. 
$objConnection = New-Object -ComObject ADODB.Connection 
$objRecordSet  = New-Object -ComObject ADODB.Recordset 

# Windows Search connection string. 
$objConnection.Open("Provider=Search.CollatorDSO;Extended Properties='Application=Windows';") 

# SQL SELECT statement specifies what properties to return, you can add more if you want
#     FROM - use SystemIndex for a local query or MACHINENAME.SystemIndex for remote
#     WHERE - specify restrictions including SCOPE and other conditions that must be true

# To add scope restriction append "WHERE SCOPE='file:c:/users'" to the query string.

# SQL Query
$objRecordSet.Open("SELECT System.ItemName, System.ItemTypeText, System.Size, System.ItemPathDisplay FROM SystemIndex WHERE SCOPE='file:C:/Users/Michael/Stack Overflow' AND CONTAINS('PowerShell')", $objConnection) 

try 
{
    $objRecordSet.MoveFirst()
    do {
        # Access the column values that were specified in the SELECT statement here
        Write-Host $objRecordset.Fields.Item("System.ItemName").Value
        Write-Host $objRecordset.Fields.Item("System.ItemTypeText").Value
        Write-Host $objRecordset.Fields.Item("System.Size").Value
        Write-Host $objRecordset.Fields.Item("System.ItemPathDisplay").Value
        Write-Host 
        $objRecordset.MoveNext()
    } until ($objRecordset.EOF) 
}
finally 
{
    $objRecordset.Close()
    Remove-Variable -Name objRecordset
    $objConnection.Close()
    Remove-Variable -Name objConnection 
}
# Script End 

样本运行

PS > & '.\QueryEverything 03.ps1'

...

Stack Overflow Notes.txt
Text Document
3606
C:\Users\Michael\Stack Overflow\in-powershell-can-you-write-host-the-invocation-and-arguments-for-an-external-co\Stack Overflow Notes.txt

Stack Overflow Answer.txt
Text Document
1720
C:\Users\Michael\Stack Overflow\mimic-windows-wildcard-search-using-powershell-script\Stack Overflow Answer.txt

Stack Overflow Notes.txt
Text Document
23310
C:\Users\Michael\Stack Overflow\mimic-windows-wildcard-search-using-powershell-script\Stack Overflow Notes.txt

---

请注意，“模拟windows通配符搜索”实际上指的是文件名。我不知道有什么方法可以对文档正文使用通配符，除了像这样的尾随星号：

CONTAINS('PowerSh*')

---

IPv4还是IPv6？仅十进制八进制表示法？这个文件还包含什么？它有多大？