Files by Type¶
Prohibited files are media, documents, and anything else the README's policy says shouldn't be on the machine. Also credential files: password lists, private keys, and exported hashes sitting in plain text.
Search with PowerShell¶
Windows Search works from File Explorer (*.mp3 in the search box), but PowerShell searches everywhere in one command:
Get-ChildItem C:\Users -Recurse -Include *.mp3,*.mp4,*.avi,*.mkv,*.mov,*.flac,*.wav,*.wma,*.m4a -ErrorAction SilentlyContinue -Force | Select FullName, Length
-Force includes hidden files, and files get hidden on purpose. -ErrorAction SilentlyContinue skips folders you can't read.
Whole drive, when time allows:
Get-ChildItem C:\ -Recurse -Include *.mp3,*.mp4 -ErrorAction SilentlyContinue -Force | Select FullName
Extensions worth sweeping¶
| Category | Extensions |
|---|---|
| Audio | mp3 wav flac aac wma m4a ogg |
| Video | mp4 avi mkv mov wmv flv m4v webm |
| Images (if policy prohibits personal photos) | jpg jpeg png gif bmp |
| Archives that can hide anything | zip rar 7z iso tar gz |
| Executables and scripts outside Program Files | exe msi bat cmd ps1 vbs js jar scr |
| Credential files | *pass* *pwd* *.kdbx *.pem *.ppk *.key *.pfx |
| Hash dumps and tool output | *.txt in odd places, *.pot *.hccapx *.pcap |
Search by name pattern too:
Get-ChildItem C:\Users -Recurse -Include *pass*,*pwd*,*secret* -ErrorAction SilentlyContinue -Force | Select FullName
Certificate and key files¶
Software certificate files (.pfx, .p12) contain a private key and, often, the password to unlock it. Once the certificate is imported they should be deleted (STIG WN11-00-000130). Find them:
Get-ChildItem C:\ -Recurse -Include *.pfx,*.p12 -ErrorAction SilentlyContinue -Force | Select FullName
Read the policy carefully¶
"No media files" is different from "no music files." A company training video is not a pirated movie. When the README describes a category, delete that category and only that category.
Delete¶
Remove-Item "C:\Users\bob\Music\track01.mp3"
Or from the search results directly:
Get-ChildItem C:\Users -Recurse -Include *.mp3 -ErrorAction SilentlyContinue -Force | Remove-Item
Look at the list before piping to Remove-Item. There's no undo.
Verify¶
Re-run the search. Empty output.
Example¶
README: "Company policy prohibits music and video files on workstations." The sweep finds 40 .mp3 files in C:\Users\bob\Music and C:\Users\Public\Videos\movie.mkv. Delete all of them. It also finds C:\Users\bob\Desktop\passwords.txt. That's not media, but it's a credential file; open it, note what's inside (the passwords in it are compromised and need changing), then delete it.