How to search and display all files or folders on a Windows drive that might have been hidden by a user?

[drojasmanh]

Hi all,

I'm relatively new to Splunk and its syntax, so pardon if there is an obvious answer... I'm trying to find a way to query and show ALL files/folders on a drive that might have been hidden by the user (not looking for OS related system files/folders).

Possible? Easiest way to do that?

Thanks in advance!

[DalJeanis]

The first question I'd have to ask back is, how are you expecting to have splunk see ANY files?

One way would be to have a script copy the directory to a file, then process the file.

For windows/dos shell commands,here's a page with a list of the switches that show hidden files and directories -
http://www.computerhope.com/issues/ch001039.htm

for unix/linux, it is LS with the -a flag.

See more at wikipedia here - https://en.wikipedia.org/wiki/Hidden_file_and_hidden_directory

[lguinn2]

Splunk can only search data in its own indexes. So first, you need to collect that information and send it to Splunk. If that information has been collected, then you need to know which index has that information.
After that, the search may be very easy - but you have to have the information to search first!

[pgreer_splunk]

As @lguinn stated, you need data in Splunk (indexes) first before you can search on/across it.

For Windows filesystem related data, maybe this will help? https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesystemchangesonWindows