How can I write this better?

Content Authoring
1

Hello,
I have a name of, and SHA256 of a file that I need to look for in all of my 8000+ Win7/10 systems.
It could reside in a few sub folders of a known folder.
I can hunt for the file and go deeper by using folders of folders etc.
This is what i have, but I think it can be better.
A few questions
Is it better to hunt for the file name, or the known SHA256?
Is folders of folders of folders… the best way?

q:(pathname of it, sha256 of it) of find files “mictray.cab” of folders of folder "C:\Windows\System32\DriverStore\FileRepository"
A: C:\Windows\System32\DriverStore\FileRepository\chdrt.inf_amd64_1697bb235d8e0cc5\MicTray.cab, 60dbcff422309df6785c2dc9186380326106bd597383cbe1b5703853729eeffd
A: C:\Windows\System32\DriverStore\FileRepository\chdrt.inf_amd64_77d80992d2c53db5\MicTray.cab, 54d70c59d46edea2081389cbe39f07e97bf0310c33c039c8740037e36acf2597
A: C:\Windows\System32\DriverStore\FileRepository\cisstrt.inf_amd64_7500d7457e5f0551\MicTray.cab, 54d70c59d46edea2081389cbe39f07e97bf0310c33c039c8740037e36acf2597

I can reverse it by using one of the known SHA256
q:(pathname of it, name of it) of files whose (SHA2_256 of it = “54d70c59d46edea2081389cbe39f07e97bf0310c33c039c8740037e36acf2597”) of folders of folder "C:\Windows\System32\DriverStore\FileRepository"
A: C:\Windows\System32\DriverStore\FileRepository\chdrt.inf_amd64_77d80992d2c53db5\MicTray.cab, MicTray.cab
A: C:\Windows\System32\DriverStore\FileRepository\cisstrt.inf_amd64_7500d7457e5f0551\MicTray.cab, MicTray.cab
T: 85721.989 ms

Thanks

2

Hello westyweekend,

You might try something like this:

q: (pathnames of it, sha256 of it) of descendants whose (name of it = "MicTray.cab") of folder "C:\Windows\System32\DriverStore\FileRepository"

Here is an example from my box:

q: (pathnames of it, sha256 of it) of descendants whose (name of it = "MicTray.cab") of folder "d:\bin"
A: d:\bin\test1\MicTray.cab, 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
A: d:\bin\test1\test2\MicTray.cab, d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
A: d:\bin\test1\test2\test3\MicTray.cab, 4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce

Regards,
Vitaliy

1 Like
3

Thanks Vitaliy.
That works much better than what I was using (folders of folders).