Skip to main content

1E SDK

FileSystem.FindFileBySizeAndHash

Method

FindFileBySizeAndHash

Module

FileSystem

Library

Core

Action

Finds a file by its size and hash.

Parameters

Size (int): the size in bytes of the file.

Hash (string): the hash of the file.

Fast (boolean; optional, default true): On Windows chooses between the fast search technology or the previous slower (but fully reliable) technology. Always used for non-Windows.

Algorithm (string, optional, default "SHA256"): Selects the hashing algorithm used by this method. Supported values:

  • SHA1

  • SHA256

  • MD5

This must match the Hash parameter; if you specify an MD5 hash, this parameter must also be set to MD5.

TimeoutSecs (integer; optional, default 600): If the operation has not completed within the specified time period, it will fail with an error.

Exclude (Table, optional): A single column table where each row contains a root relative directory path that you want to exclude from recursive search.

Note

On Windows, excluded paths can contain drive letters on Windows (e.g. C:\\), to skip scanning whole volumes.

Ensure the exclude paths are complete paths starting from root.

Return values

For each file found:

  • FileName (string): The full path.

Example

This will perform a fast search, looking for a file with the specified SHA-256 hash and size:

FileSystem.FindFileBySizeAndHash(Size:402, Hash:"8eda0d394c2370c4ac8562d5ae6b5e7b01f347940bc58a65ca873c33a33475a3");

This will perform a slow search, looking for a file with the specified MD5 hash and size:

FileSystem.FindFileBySizeAndHash(Size:999, Hash:"08ad2e5d7538091fbbfd352bb323e238", Fast:false, Algorithm:"MD5");
@exclude =
SELECT
        column1 AS Path
FROM
        ( VALUES
                ("C:\\"),
                ("E:\\IgnoredFolder")
        );

FileSystem.FindFileBySizeAndHash(Size:402, Hash:"8eda0d394c2370c4ac8562d5ae6b5e7b01f347940bc58a65ca873c33a33475a3",Exclude:@exclude);

Platforms

  • Windows

  • Linux

  • MacOS

Notes

This will search all fixed disks which is an expensive process and may take some time.

Currently files locked by some other process cannot be hashed and therefore cannot be reported as being found. This is not supported.

This will not search for files on remote machines.

This works slightly differently on Windows and Non-Windows platforms when the given file or directory where the file resides does not have any permissions assigned/available. Windows platforms do not report such locked-down files whereas non-Windows do report the files irrespective of which level permission has been denied (file or directory). This happens because the 1E.Client daemon runs as "root" (superuser).

In this section: