{
	"id": "ba35788d-470d-49af-b211-7515edc51ff1",
	"created_at": "2026-04-06T00:10:52.279604Z",
	"updated_at": "2026-04-10T03:21:08.26507Z",
	"deleted_at": null,
	"sha1_hash": "c0f030a2638f337d4cbf35e6ce9f47cdd896adbf",
	"title": "Forfiles",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 62036,
	"plain_text": "Forfiles\r\nBy Archiveddocs\r\nArchived: 2026-04-05 17:41:33 UTC\r\nApplies To: Windows Vista, Windows Server 2008, Windows Server 2012, Windows 8\r\nSelects and executes a command on a file or set of files. This command is useful for batch processing.\r\nFor examples of how to use this command, see Examples.\r\nSyntax\r\nforfiles [/p \u003cPath\u003e] [/m \u003cSearchMask\u003e] [/s] [/c \"\u003cCommand\u003e\"] [/d [{+|-}][{\u003cDate\u003e|\u003cDays\u003e}]]\r\nParameters\r\nParameter Description\r\n/p \u003cPath\u003e\r\nSpecifies the path from which to start the search. By default, searching starts in the\r\ncurrent working directory.\r\n/m \u003cSearchMask\u003e Searches files according to the specified search mask. The default search mask is *.*.\r\n/s Instructs the forfiles command to search into subdirectories recursively.\r\n/c \"\u003cCommand\u003e\"\r\nRuns the specified command on each file. Command strings should be enclosed in\r\nquotation marks. The default command is \"cmd /c echo @file\".\r\n/d [{+|-}][{\u003cDate\u003e|\r\n\u003cDays\u003e}]\r\nSelects files with a last modified date within the specified time frame.\r\nSelects files with a last modified date later than or equal to (+) or earlier than or\r\nequal to (-) the specified date, where Date is in the format MM/DD/YYYY.\r\nhttps://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)\r\nPage 1 of 4\n\nParameter Description\r\nSelects files with a last modified date later than or equal to (+) the current date\r\nplus the number of days specified, or earlier than or equal to (-) the current date\r\nminus the number of days specified.\r\nValid values for Days include any number in the range 0–32,768. If no sign is\r\nspecified, + is used by default.\r\n/? Displays help at the command prompt.\r\nForfiles is most commonly used in batch files.\r\nForfiles /s is similar to dir /s.\r\nYou can use the following variables in the command string as specified by the /c command-line option.\r\nVariable Description\r\n@FILE File name.\r\n@FNAME File name without extension.\r\n@EXT File name extension.\r\n@PATH Full path of the file.\r\n@RELPATH Relative path of the file.\r\n@ISDIR\r\nEvaluates to TRUE if a file type is a directory. Otherwise, this variable evaluates to\r\nFALSE.\r\n@FSIZE File size, in bytes.\r\nhttps://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)\r\nPage 2 of 4\n\nVariable Description\r\n@FDATE Last modified date stamp on the file.\r\n@FTIME Last modified time stamp on the file.\r\nWith forfiles, you can run a command on or pass arguments to multiple files. For example, you could run\r\nthe type command on all files in a tree with the .txt file name extension. Or you could execute every batch\r\nfile (*.bat) on drive C, with the file name \"Myinput.txt\" as the first argument.\r\nWith forfiles, you can do any of the following:\r\nSelect files by an absolute date or a relative date by using the /d parameter.\r\nBuild an archive tree of files by using variables such as @FSIZE** **and @FDATE.\r\nDifferentiate files from directories by using the @ISDIR** **variable.\r\nInclude special characters in the command line by using the hexadecimal code for the character, in\r\n0xHH format (for example, 0x09 for a tab).\r\nForfiles works by implementing the recurse subdirectories flag on tools that are designed to process only\r\na single file.\r\nExamples\r\nTo list all of the batch files on drive C, type:\r\nforfiles /p c:\\ /s /m *.bat /c \"cmd /c echo @file is a batch file\"\r\nTo list all of the directories on drive C, type:\r\nforfiles /p c:\\ /s /m *.* /c \"cmd /c if @isdir==true echo @file is a directory\"\r\nTo list all of the files in the current directory that are at least one year old, type:\r\nforfiles /s /m *.* /d -365 /c \"cmd /c echo @file is at least one year old.\"\r\nTo display the text \"File is outdated\" for each of the files in the current directory that are older than January 1,\r\n2007, type:\r\nhttps://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)\r\nPage 3 of 4\n\nforfiles /s /m *.* /d -01/01/2007 /c \"cmd /c echo @file is outdated.\"\r\nTo list the file name extensions of all the files in the current directory in column format, and add a tab before the\r\nextension, type:\r\nforfiles /s /m *.* /c \"cmd /c echo The extension of @file is 0x09@ext\"\r\nAdditional references\r\nCommand-Line Syntax Key\r\nSource: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)\r\nhttps://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)"
	],
	"report_names": [
		"cc753551(v=ws.11)"
	],
	"threat_actors": [],
	"ts_created_at": 1775434252,
	"ts_updated_at": 1775791268,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c0f030a2638f337d4cbf35e6ce9f47cdd896adbf.pdf",
		"text": "https://archive.orkl.eu/c0f030a2638f337d4cbf35e6ce9f47cdd896adbf.txt",
		"img": "https://archive.orkl.eu/c0f030a2638f337d4cbf35e6ce9f47cdd896adbf.jpg"
	}
}