How to search the entire hard drive for files modified on a particular date?

Open File Explorer from the Desktop. Navigate to the root of your hard drive (C:\ probably). Tap/Click in the search field and type as follows: System.DateModified:YYYY-MM-DDThh:mm:ss where the date and time are the ones you know the virus appeared and are described in ISO-8601, shown here: http://www.w3.org/TR/NOTE-datetime.

The Windows search terms are called the "Advanced Query Syntax" and contains a number of useful terms, most of which are not exposed to end users through the Windows search UI. This is one example, explained in this MSDN document: http://msdn.microsoft.com/en-us/library/bb266512%28VS.85%29.aspx under section "DateTime properties in Windows 8".

Note that you may have to expand the index to search the entire drive and also that the index will not search certain places (C:\Windows\CSC\ for one example).


There is a bunch of ways of doing this. You could try a program like

http://www.mythicsoft.com/page.aspx?type=filelocatorlite&page=home

I don't use 8 or even 7. BUT I would use CMD. There is a couple ways to do it but the simplest way would be do DIR the entire drive with subfolders filtered for created time then search for a string that matches the date and time format. To Paste into a CMD window just right click and choose paste. (again never used win8)

Its not that complicated the code below would search the C: drive for a file created "01/19/2013 06:38 PM" the Output would be C:\FoundFiles.TXT.

@dir c:\*.* /s /t:c | findstr "01/19/2013  06:38 PM">c:\FoundFiles.TXT 

The code below will search for hidden files and output to c:\FoundHiddenFiles.TXT

@dir c:\*.* /s /a:h /t:c | findstr "01/19/2013  06:38 PM">c:\FoundHiddenFiles.TXT

use /t:a for files "last accessed" and /t:w for files last written

To open CMD in windows 8 just search apps for CMD. You may have to adjust the string to match your DIR output put in window 8. Also I have no idea if windows 8 gives you access to the C:. Each search should only take a minute it will only give you the file names not the location and each time you run it it will wipe out the old search result. the "." should be optional just put them in just in case.

hope that helps someone.

ONE last thing. You could just dir the whole darn drive output it to a Text file then search with word or notepad or what ever they give you with windows 8. The codes below will output your entire content of you hard drives sorted for when the files were created.

dir c:\*.* /s /o:d /t:c >C:\AllFiles.TXT

And if you want to search for all Hidden files use

dir c:\*.* /s /o:d /t:c /a:h >C:\AllHiddenFiles.TXT