← All cheat sheets

FORFILES

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Windows batch file processing command.
Execute commands on files based on criteria (date, extension, etc.).

BASIC SYNTAX#

forfiles [/p path] [/m mask] [/s] [/d date] [/c command]

OPTIONS#

/p path                              # Path to search
/m mask                              # File mask (default *.*)
/s                                   # Recurse subdirectories
/d date                              # Date filter
/c command                           # Command to execute

DATE FORMATS#

/d +n                                # Modified >= n days ago
/d -n                                # Modified <= n days ago
/d 0                                 # Modified today
/d MM/DD/YYYY                        # Modified on/after date

VARIABLES#

@path                                # Full path
@fname                               # Filename without extension
@ext                                 # Extension only
@fsize                               # File size in bytes
@fdate                               # Last modified date
@ftime                               # Last modified time
@isdir                               # TRUE if directory
@relpath                             # Relative path
@file                                # Filename with extension

BASIC EXAMPLES#


    

LIST FILES#

forfiles /m *.txt                    # List txt files
forfiles /m *.log /s                 # Recursive
forfiles /p C:\Logs /m *.log         # In specific path

DISPLAY INFO#

forfiles /m *.* /c "cmd /c echo @file @fsize @fdate"
forfiles /m *.log /c "cmd /c echo @path"

DELETE FILES#

forfiles /m *.tmp /c "cmd /c del @path"
forfiles /p C:\Temp /m *.* /c "cmd /c del @path"

DATE-BASED OPERATIONS#


    

FILES OLDER THAN N DAYS#

forfiles /m *.log /d -30 /c "cmd /c echo @path"
forfiles /m *.bak /d -7 /c "cmd /c del @path"
forfiles /p C:\Logs /m *.log /d -90 /c "cmd /c del @path"

# Delete logs older than 30 days
forfiles /p C:\Logs /s /m *.log /d -30 /c "cmd /c del @path"

FILES NEWER THAN N DAYS#

forfiles /m *.* /d +7 /c "cmd /c echo @path"

FILES FROM SPECIFIC DATE#

forfiles /m *.* /d 01/01/2024 /c "cmd /c echo @path"

LOG CLEANUP EXAMPLES#

# Delete IIS logs older than 30 days
forfiles /p "C:\inetpub\logs\LogFiles" /s /m *.log /d -30 /c "cmd /c del @path"

# Delete Windows temp files older than 7 days
forfiles /p "%TEMP%" /s /m *.tmp /d -7 /c "cmd /c del @path" 2>nul

# Delete old backups
forfiles /p "D:\Backups" /s /m *.bak /d -90 /c "cmd /c del @path"

# Archive old files
forfiles /p "C:\Data" /m *.* /d -365 /c "cmd /c move @path D:\Archive\"

COPY/MOVE FILES#

forfiles /m *.txt /c "cmd /c copy @path C:\backup\"
forfiles /m *.log /d -7 /c "cmd /c move @path C:\archive\"

FILTER BY SIZE#

# Combine with findstr/if for size filtering
forfiles /m *.* /c "cmd /c if @fsize GEQ 1000000 echo @path @fsize"

DIRECTORY OPERATIONS#

# Process only directories
forfiles /m *.* /c "cmd /c if @isdir==TRUE echo @path"

# Delete empty directories older than 30 days
forfiles /p C:\Temp /d -30 /c "cmd /c if @isdir==TRUE rd /q @path" 2>nul

COMPLEX COMMANDS#

# Run script on each file
forfiles /m *.txt /c "cmd /c myscript.bat @path"

# Compress old files
forfiles /m *.log /d -7 /c "cmd /c compact /c @path"

# Echo with quotes (use 0x22 for quote)
forfiles /m *.* /c "cmd /c echo 0x22@file0x22"

SCHEDULED CLEANUP#

# Create scheduled task for log cleanup
schtasks /create /tn "LogCleanup" ^
    /tr "forfiles /p C:\Logs /s /m *.log /d -30 /c \"cmd /c del @path\"" ^
    /sc weekly /d SUN /st 03:00

ESCAPE CHARACTERS#

# In forfiles, special characters need escaping
0x22                                 # Double quote "
0x09                                 # Tab
0x0A                                 # Newline

# Example with quotes
forfiles /m *.* /c "cmd /c echo File: 0x22@file0x22"

PRACTICAL SCRIPTS#


    

CLEANUP TEMP FILES#

@echo off
echo Cleaning temp files older than 7 days...
forfiles /p "%TEMP%" /s /d -7 /c "cmd /c del /q @path" 2>nul
forfiles /p "C:\Windows\Temp" /s /d -7 /c "cmd /c del /q @path" 2>nul
echo Done.

ARCHIVE OLD LOGS#

@echo off
set LOGDIR=C:\Logs
set ARCHDIR=D:\Archive
set DAYS=30

forfiles /p %LOGDIR% /s /m *.log /d -%DAYS% /c "cmd /c move @path %ARCHDIR%\"
echo Archived logs older than %DAYS% days.

DELETE OLD BACKUPS#

@echo off
forfiles /p "D:\Backups" /s /m *.bak /d -90 /c "cmd /c del @path"
forfiles /p "D:\Backups" /s /m *.zip /d -90 /c "cmd /c del @path"

LIST FILES BY AGE#

@echo off
echo Files modified in last 24 hours:
forfiles /s /d 0 /c "cmd /c echo @path"

ERROR HANDLING#

# Redirect errors (common when no files match)
forfiles /m *.old /d -30 /c "cmd /c del @path" 2>nul

# Check if files exist first
forfiles /m *.log /d -30 >nul 2>&1 && (
    forfiles /m *.log /d -30 /c "cmd /c del @path"
) || (
    echo No matching files found.
)

QUICK REFERENCE#

# List files
forfiles /m *.txt /c "cmd /c echo @file"

# Recursive list
forfiles /s /m *.log /c "cmd /c echo @path"

# Files older than N days
forfiles /d -30 /c "cmd /c echo @path @fdate"

# Delete old files
forfiles /p C:\Logs /m *.log /d -30 /c "cmd /c del @path"

# With path
forfiles /p "C:\folder" /s /m *.* /d -7 /c "cmd /c del @path"

# Variables
@path      Full path
@file      Filename with extension
@fname     Filename without extension
@ext       Extension
@fsize     Size in bytes
@fdate     Date modified
@ftime     Time modified
@isdir     TRUE if directory