Welcome to /Bubbles/Logs
Heres the latest post!
PowerShell Survival Guide #1 - Interacting with the file system 2026-08-08
Hello fellow nerds! I have discussed PowerShell on this platform before. 2024-03-19 was the last time I posted about PowerShell. A little over 2 years has passed since then and I can say with full confidence that my PowerShell knowledge is vastly deeper than it used to be. Since I have not really been working on any software projects outside of work, I would consider PowerShell to be the language I have been focusing on learning. As I discussed in that post, if you are in IT PowerShell is a tool worth learning, and I ended that post positively. Though there was a quote that stood out to me. I referenced a few commands with parameter references and said "...just clarifying that I am not giving guidance with the code above I'm merely just throwing out the module names and a general usage. For safe usage I recommend reading the docs."
Honestly, this was said because of a lack of confidence in my own ability to properly present the information. I knew I liked PowerShell and that I felt like it was not appreciated as much as it should be. I just didn't have enough experience or working knowledge at the time to accurately express that. However this time is much different. I am not going to tell you why I like PowerShell. I am going to show you.
This is something I have wanted to do for a while now. I want to make the reference guide I needed when I started working with PowerShell. Something I have noticed with other resources for PowerShell is that they immediately start covering PowerShell as a programming language. I don't like that aspect. PowerShell is best learned by just using it. I believe learning by practical examples and putting them to use in your own environment will reinforce the concepts a lot faster. Experienced analysts and developers can cover this part quickly, but I believe that the commands are still worth looking into if you have not seen them before. I want to just take the time in this part to cover the basics of interacting with the file system through PowerShell commands, aliases, how to search for commands, and get documentation for them.
PowerShell is an object oriented programming language developed by Microsoft as a member of the .NET family of languages. PowerShell is also the shell itself. They are two parts of one whole. Because PowerShell is a member of the .NET family it has access to all the classes and features .NET has to offer. On windows make sure you open up the PowerShell window. Opening "The Windows Terminal" should also by default start you in a PowerShell session. If you know any cmd commands you can also use those commands in PowerShell, but not the other way around.
Navigation of the file system
Our file system is made up of files and directories(folders). In order to automate anything we need to be able to navigate and interact with it. Lets figure out where we are using Get-ChildItem.
C:\Test > Get-ChildItem
Directory: C:\Test
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/15/2019 08:29 Logs
-a---- 2/13/2019 08:55 26 config.json
-a---- 2/12/2019 15:40 118014 Command.txt
-ar--- 2/12/2019 14:31 27 ReadOnlyFile.txt
When using Get-ChildItem without parameters it will check which directory you are currently in along with its contents. The "Mode" property will help you identify what type of item it classifies as.
d (directory), l (link), a (archive), r (read-only), h (hidden), s (system). Get-Location is also acceptable for checking your current working directory. I am just showing off Get-ChildItem since it shows you location and its contents. We can identify files from directories, now lets view a sub-directory using the path parameter.
PS C:\Test> Get-ChildItem -Path "Logs"
The parameter Path can return the contents of any path you have permissions to read.
PS C:\Test> Get-ChildItem -Path "C:\Program Files\"
PowerShell can also access remote resources by referencing the UNC path. Both hostnames and IP addresses can be used with UNC paths.
PS C:\Test> Get-ChildItem -Path "\\ComputerHostname\C$\"
PS C:\Test> Get-ChildItem -Path "\\10.240.20.5\C$\"
Sometimes you may have permissions issues, if you want to clarify if you are able to access a file you can reference the access control list.
PS C:\Test> Get-Acl -Path "ReadOnlyFile.txt"
To move to another directory you can use the command Set-Location.
C:\Test> Set-Location -Path "Logs"
Notice -Path has returned in multiple commands. Shared parameters are common and behave the same across each commands, so any of the above examples with Get-ChildItem using -Path will also work with other commands that implement -Path.
There are a lot of ways to interact with the file system from here. Lets go over CRUD commands (Create, Read, Update, Delete). This is also a good time to mention that PowerShell's naming convention for commands uses the "Verb-Noun" pattern. PowerShell has its own list of "approved verbs." Those details can be seen here (https://learn.microsoft.com/en-us/powershell/scripting/developer/cmdlet/approved-verbs-for-windows-powershell-commands?view=powershell-7.6.)
Lets rapid fire some commonly used commands.
Create
# Create an empty file in the current working directory (can be referenced with '.')
C:\Test> New-Item -Path "." -Name "logFile2.log" -ItemType File
# Create an file in the current working directory and write a string to it.
C:\Test> New-Item -Path "." -Name "logFile3.log" -ItemType File -Value "[Info] 8/6/26 - log file 'logFile3.log' created"
# New-Item also can create directories.
C:\Test> New-Item -Path "C:\Scripts" -ItemType Directory
# Copy file to another directory
C:\Test> Copy-Item -Path "C:\Test\config.json" -Destination "C:\Scripts"
# Copy all files in directory Logs to another directory.
C:\Test> Copy-Item -Path "C:\Test\Logs\*" -Destination "C:\Program Files\Application\Logs" -Recurse
# Copy a directory to another directory
C:\Test> Copy-Item -Path "C:\Test" -Destination "C:\Scripts" -Recurse
Before I continue, the second Copy-Item line used the parameter -Recurse and the use of the character * in the -Path string.
When -Recurse is used, Copy-Item will also iterate through the sub-directories within the directory you are pointing it to. So if I have the folder "C:\Scripts" and Scripts contains a directory called Logs, then Copy-Item will iterate through "C:\Scripts\Logs" as well.
The string "C:\Test\Logs\*" was passed to -Path containing a *. This is the wildcard character. It is used to represent any value in a pattern. When you reference "C:\Test\Logs\*" you are telling Copy-Item to look in that directory for any file that matches the pattern. You can add to the pattern by just inserting text before or after the wildcard.
"C:\Test\Logs\*.log" will only copy files that end with .log.
"C:\Test\config*" will only copy files with "config" at the beginning of the name and have any file extension.
Read
# Read the contents of a file
C:\Test> Get-Content -Path "C:\Test\Logs\logFile3.log"
# Read the first 10 lines of a file
C:\Test> Get-Content -Path "C:\Test\Logs\logFile3.log" -TotalCount 10
# Get the last 10 lines of a file
C:\Test> Get-Content -Path "C:\Test\Logs\logFile3.log" -Tail 10
# Will check if the directory or file exists
C:\Test> Test-Path -Path "C:\Program Files" # True
C:\Test> Test-Path -Path "C:\Test\config2.json" # False
Update
# Write content to a file. Set-Content will overwrite any existing data the file contains.
C:\Test> Set-Content -Path "config.json" -Value "{ "ScriptPath": "C:\Scripts" }"
# Append file will add $Value to the end of the file.
C:\Test> Add-Content -Path "C:\Test\Logs\logFile3.log" -Value "[Info] thinkpad-laptop is online"
# Move file to another directory
C:\Test> Move-Item -Path "C:\Test\config.json" -Destination "C:\Scripts"
# Move directory (and its contents) to another directory
C:\Test> Move-Item -Path "C:\Test\Logs" -Destination "C:\Scripts"
# Rename a file
C:\Test> Rename-Item -Path "C:\Scripts\Ping-List.ps1" -NewName "Test-ComputerList.ps1"
Delete
# Clears the screen!!
C:\Scripts> Clear-Host
# Clears the data from the file without deleting the file itself.
C:\Test> Clear-Content -Path "C:\Scripts\Logs\logFile.log"
# Delete a file
C:\Test> Remove-Item -Path "C:\Scripts\Logs\logFile2.log"
# Delete a folder and everything it contains
C:\Test> Remove-Item -Path "C:\Test" -Recurse
Helper Commands
If you come from Linux or OSX you may be thinking that PowerShell commands are much longer than commands commonly found in Unix-based shells or even Window's CMD shell.
# CMD
dir
# Unix-based shells
ls
#PowerShell
Get-ChildItem
typing Get-ChildItem may seem a tad annoying in comparison and I can somewhat agree. Something that helps is that PowerShell is not case sensitive so you don't NEED to Capitalize each word.
#this works
get-childitem -path "c:\windows"
# THIS WORKS
GET-CHILDITEM -PATH "C:\WINDOWS"
# ... sadly this works too
GET-chIldITEM -pAtH "c:\windows"
Luckily Microsoft thought about the inconvenient length of the command names, so they implemented aliases. In-fact, ls AND dir are both valid aliases for Get-ChildItem. if you want to view all of the aliases you can use the command Get-Alias by itself.
I understand I have just thrown a gaggle of commands at you. If you are new I don't expect you to remember everything. This post is meant to educate but the goal is to introduce you to the concepts so you can experiment with them yourself. There are two commands left I would like to show off. These arguably are the commands I use the most.
The first is Get-Command. This command will list every PowerShell command that you have installed.
# Everything
Get-Command
# Filter by verb
Get-Command -Verb "Get"
# Filter by noun
Get-Command -Noun "Alias"
# Filter by noun with "Network" mentioned in the noun
Get-Command -Noun "*Network*"
Now you have the world to explore, but you don't know what they do!! That's where the final command comes into play. Get-Help (its alias is help). For those coming from Unix-based shells, Get-Help is the equivalent to man. It provides documentation within the shell, so you do not need to leave the terminal to look something up.
# Gives an explanation for what the command does and what parameters can be passed to it
Get-Help get-content
# Will show examples on how to use the command
Get-Help get-content -Examples
# The full documentation for the page
Get-Help get-content -Full
# Update the documentation (may need to have elevated priveledges)
Update-Help
That covers everything I wanted to start with! As we get into more in depth commands and concepts the explanations will also be longer. A lot of the commands in this part are straight forward and are the command line equivalent to things people are used to doing within file explorer. Learning these commands build a base that help you do things quickly and build scripts that automate these processes. I will be discussing variables, data types, objects in the next part. Thank you for reading!
PowerShell Survival Guide #1 - Interacting with the file system 2026-08-08
Hello fellow nerds! I have discussed PowerShell on this platform before. 2024-03-19 was the last time I posted about PowerShell. A little over 2 years has passed since then and I can say with full confidence that my PowerShell knowledge is vastly deeper than it used to be. Since I have not really been working on any software projects outside of work, I would consider PowerShell to be the language I have been focusing on learning. As I discussed in that post, if you are in IT PowerShell is a tool worth learning, and I ended that post positively. Though there was a quote that stood out to me. I referenced a few commands with parameter references and said "...just clarifying that I am not giving guidance with the code above I'm merely just throwing out the module names and a general usage. For safe usage I recommend reading the docs."
Honestly, this was said because of a lack of confidence in my own ability to properly present the information. I knew I liked PowerShell and that I felt like it was not appreciated as much as it should be. I just didn't have enough experience or working knowledge at the time to accurately express that. However this time is much different. I am not going to tell you why I like PowerShell. I am going to show you.
This is something I have wanted to do for a while now. I want to make the reference guide I needed when I started working with PowerShell. Something I have noticed with other resources for PowerShell is that they immediately start covering PowerShell as a programming language. I don't like that aspect. PowerShell is best learned by just using it. I believe learning by practical examples and putting them to use in your own environment will reinforce the concepts a lot faster. Experienced analysts and developers can cover this part quickly, but I believe that the commands are still worth looking into if you have not seen them before. I want to just take the time in this part to cover the basics of interacting with the file system through PowerShell commands, aliases, how to search for commands, and get documentation for them.
PowerShell is an object oriented programming language developed by Microsoft as a member of the .NET family of languages. PowerShell is also the shell itself. They are two parts of one whole. Because PowerShell is a member of the .NET family it has access to all the classes and features .NET has to offer. On windows make sure you open up the PowerShell window. Opening "The Windows Terminal" should also by default start you in a PowerShell session. If you know any cmd commands you can also use those commands in PowerShell, but not the other way around.
Navigation of the file system
Our file system is made up of files and directories(folders). In order to automate anything we need to be able to navigate and interact with it. Lets figure out where we are using Get-ChildItem.
C:\Test > Get-ChildItem
Directory: C:\Test
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/15/2019 08:29 Logs
-a---- 2/13/2019 08:55 26 config.json
-a---- 2/12/2019 15:40 118014 Command.txt
-ar--- 2/12/2019 14:31 27 ReadOnlyFile.txt
When using Get-ChildItem without parameters it will check which directory you are currently in along with its contents. The "Mode" property will help you identify what type of item it classifies as.
d (directory), l (link), a (archive), r (read-only), h (hidden), s (system). Get-Location is also acceptable for checking your current working directory. I am just showing off Get-ChildItem since it shows you location and its contents. We can identify files from directories, now lets view a sub-directory using the path parameter.
PS C:\Test> Get-ChildItem -Path "Logs"
The parameter Path can return the contents of any path you have permissions to read.
PS C:\Test> Get-ChildItem -Path "C:\Program Files\"
PowerShell can also access remote resources by referencing the UNC path. Both hostnames and IP addresses can be used with UNC paths.
PS C:\Test> Get-ChildItem -Path "\\ComputerHostname\C$\"
PS C:\Test> Get-ChildItem -Path "\\10.240.20.5\C$\"
Sometimes you may have permissions issues, if you want to clarify if you are able to access a file you can reference the access control list.
PS C:\Test> Get-Acl -Path "ReadOnlyFile.txt"
To move to another directory you can use the command Set-Location.
C:\Test> Set-Location -Path "Logs"
Notice -Path has returned in multiple commands. Shared parameters are common and behave the same across each commands, so any of the above examples with Get-ChildItem using -Path will also work with other commands that implement -Path.
There are a lot of ways to interact with the file system from here. Lets go over CRUD commands (Create, Read, Update, Delete). This is also a good time to mention that PowerShell's naming convention for commands uses the "Verb-Noun" pattern. PowerShell has its own list of "approved verbs." Those details can be seen here (https://learn.microsoft.com/en-us/powershell/scripting/developer/cmdlet/approved-verbs-for-windows-powershell-commands?view=powershell-7.6.)
Lets rapid fire some commonly used commands.
Create
# Create an empty file in the current working directory (can be referenced with '.')
C:\Test> New-Item -Path "." -Name "logFile2.log" -ItemType File
# Create an file in the current working directory and write a string to it.
C:\Test> New-Item -Path "." -Name "logFile3.log" -ItemType File -Value "[Info] 8/6/26 - log file 'logFile3.log' created"
# New-Item also can create directories.
C:\Test> New-Item -Path "C:\Scripts" -ItemType Directory
# Copy file to another directory
C:\Test> Copy-Item -Path "C:\Test\config.json" -Destination "C:\Scripts"
# Copy all files in directory Logs to another directory.
C:\Test> Copy-Item -Path "C:\Test\Logs\*" -Destination "C:\Program Files\Application\Logs" -Recurse
# Copy a directory to another directory
C:\Test> Copy-Item -Path "C:\Test" -Destination "C:\Scripts" -Recurse
Before I continue, the second Copy-Item line used the parameter -Recurse and the use of the character * in the -Path string.
When -Recurse is used, Copy-Item will also iterate through the sub-directories within the directory you are pointing it to. So if I have the folder "C:\Scripts" and Scripts contains a directory called Logs, then Copy-Item will iterate through "C:\Scripts\Logs" as well.
The string "C:\Test\Logs\*" was passed to -Path containing a *. This is the wildcard character. It is used to represent any value in a pattern. When you reference "C:\Test\Logs\*" you are telling Copy-Item to look in that directory for any file that matches the pattern. You can add to the pattern by just inserting text before or after the wildcard.
"C:\Test\Logs\*.log" will only copy files that end with .log.
"C:\Test\config*" will only copy files with "config" at the beginning of the name and have any file extension.
Read
# Read the contents of a file
C:\Test> Get-Content -Path "C:\Test\Logs\logFile3.log"
# Read the first 10 lines of a file
C:\Test> Get-Content -Path "C:\Test\Logs\logFile3.log" -TotalCount 10
# Get the last 10 lines of a file
C:\Test> Get-Content -Path "C:\Test\Logs\logFile3.log" -Tail 10
# Will check if the directory or file exists
C:\Test> Test-Path -Path "C:\Program Files" # True
C:\Test> Test-Path -Path "C:\Test\config2.json" # False
Update
# Write content to a file. Set-Content will overwrite any existing data the file contains.
C:\Test> Set-Content -Path "config.json" -Value "{ "ScriptPath": "C:\Scripts" }"
# Append file will add $Value to the end of the file.
C:\Test> Add-Content -Path "C:\Test\Logs\logFile3.log" -Value "[Info] thinkpad-laptop is online"
# Move file to another directory
C:\Test> Move-Item -Path "C:\Test\config.json" -Destination "C:\Scripts"
# Move directory (and its contents) to another directory
C:\Test> Move-Item -Path "C:\Test\Logs" -Destination "C:\Scripts"
# Rename a file
C:\Test> Rename-Item -Path "C:\Scripts\Ping-List.ps1" -NewName "Test-ComputerList.ps1"
Delete
# Clears the screen!!
C:\Scripts> Clear-Host
# Clears the data from the file without deleting the file itself.
C:\Test> Clear-Content -Path "C:\Scripts\Logs\logFile.log"
# Delete a file
C:\Test> Remove-Item -Path "C:\Scripts\Logs\logFile2.log"
# Delete a folder and everything it contains
C:\Test> Remove-Item -Path "C:\Test" -Recurse
Helper Commands
If you come from Linux or OSX you may be thinking that PowerShell commands are much longer than commands commonly found in Unix-based shells or even Window's CMD shell.
# CMD
dir
# Unix-based shells
ls
#PowerShell
Get-ChildItem
typing Get-ChildItem may seem a tad annoying in comparison and I can somewhat agree. Something that helps is that PowerShell is not case sensitive so you don't NEED to Capitalize each word.
#this works
get-childitem -path "c:\windows"
# THIS WORKS
GET-CHILDITEM -PATH "C:\WINDOWS"
# ... sadly this works too
GET-chIldITEM -pAtH "c:\windows"
Luckily Microsoft thought about the inconvenient length of the command names, so they implemented aliases. In-fact, ls AND dir are both valid aliases for Get-ChildItem. if you want to view all of the aliases you can use the command Get-Alias by itself.
I understand I have just thrown a gaggle of commands at you. If you are new I don't expect you to remember everything. This post is meant to educate but the goal is to introduce you to the concepts so you can experiment with them yourself. There are two commands left I would like to show off. These arguably are the commands I use the most.
The first is Get-Command. This command will list every PowerShell command that you have installed.
# Everything
Get-Command
# Filter by verb
Get-Command -Verb "Get"
# Filter by noun
Get-Command -Noun "Alias"
# Filter by noun with "Network" mentioned in the noun
Get-Command -Noun "*Network*"
Now you have the world to explore, but you don't know what they do!! That's where the final command comes into play. Get-Help (its alias is help). For those coming from Unix-based shells, Get-Help is the equivalent to man. It provides documentation within the shell, so you do not need to leave the terminal to look something up.
# Gives an explanation for what the command does and what parameters can be passed to it
Get-Help get-content
# Will show examples on how to use the command
Get-Help get-content -Examples
# The full documentation for the page
Get-Help get-content -Full
# Update the documentation (may need to have elevated priveledges)
Update-Help
That covers everything I wanted to start with! As we get into more in depth commands and concepts the explanations will also be longer. A lot of the commands in this part are straight forward and are the command line equivalent to things people are used to doing within file explorer. Learning these commands build a base that help you do things quickly and build scripts that automate these processes. I will be discussing variables, data types, objects in the next part. Thank you for reading!