Get-ChildItem
List files/dirs/registry (PowerShell ls/dir).
Windowspassive
Get-ChildItem enumerates items in a location — filesystem, registry or certificate store — with powerful recursion and filtering.
Syntax
Get-ChildItem [-Path {p}] [-Recurse] [-Filter {f}]
Example
Get-ChildItem C:\Users -Recurse -Filter *.kdbx -ErrorAction SilentlyContinue
Recursively hunts for KeePass databases under user folders.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
get-childitem
Usage examples
Get-ChildItem C:\ -Recurse -Filter *.kdbx -EA SilentlyContinue
Hunt for KeePass databases.
Get-ChildItem -Force
List incl. hidden files.
Advantages
- Works across providers (FS/registry/certs)
- Recursion + rich filters
- Objects pipe to anything
Disadvantages
- Recursion can be slow
- Permission errors are noisy
- Windows-centric paths
Tags
#windows#filesystem#enumeration
Official docs: Get-ChildItem ↗
Related commands
Frequently asked questions
What is Get-ChildItem used for?
Get-ChildItem enumerates items in a location — filesystem, registry or certificate store — with powerful recursion and filtering.
What is an example Get-ChildItem command?
A common example is: Get-ChildItem C:\Users -Recurse -Filter *.kdbx -ErrorAction SilentlyContinue — Recursively hunts for KeePass databases under user folders.
Is Get-ChildItem part of a standard install?
Get-ChildItem runs on Windows. It is typically available by default.
What category of security tool is Get-ChildItem?
Get-ChildItem is a PowerShell tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.