Files searches on enrolled devices

[ahopkins]

I need to find a file that was download to a MacBook,. We have students (Or staff ) downloading movies. Is there a way I can check to see if a file or what files or one a machine? Or would I need Apple remote desktop for that?

[rderewianko]

we do it a dirty way:
du -h -d 4 -c /Users/<username>

[ahopkins]

I don't know what that means... I was trying to look for Torrent application names, or users history or something like that.

[zanb]

Try the "find" command. FYI I entered in popular names for torrents and movie files. Feel free to add other "-o -name" options. Don't forget the wildcard!

#!/bin/bash
# You can change the maxdepth to whatever you like. I think 8 folders deep is good enough. 
find /Users ( -name "*.torrent" -o -name "*.mp4" -o -name "*.mpg" -o -name "*.mov" -o -name "*.wmv" -o -name "*.flv" ) -maxdepth 8 -mindepth 2
exit

If you want to wrap this in an Extension Attribute you can format it like this:

#!/bin/bash
echo "<result>$(find /Users ( -name "*.torrent" -o -name "*.mp4" -o -name "*.mpg" -o -name "*.mov" -o -name "*.wmv" -o -name "*.flv" ) -maxdepth 8 -mindepth 2)</result"
exit

[ahopkins]

So I'm writing this up as a script and applying a policy..? this wasn't covered in my training classes in Chicago!

[mm2270]

Although policies have an advanced find file function, it doesn't work all that well in my opinion. Generally speaking you would need to know the proper name to search for, which may not always be possible.

Instead, I would look at building an EA to locate all files of a certain type with either spotlight (mdfind) or just using standard find. Keep in mind that "find" is much much slower because it has to literally search the disk in the locations you specify. mdfind, Spotlight's command line interface is much faster, but also requires a valid Spotlight index to work, and also won't search certain locations, especially if they've been excluded in Spotlight's preferences. That last item is important to keep in mind, because it means that if students catch wind that you can use Spotlight to locate files on their Mac, they can always move them into a Spotlight excluded folder and it won't see them.

Anyway, here's an example command to locate all .avi files in any home folder located in /Users/

mdfind -onlyin /Users/ 'kMDItemKind == "AVI container"'

To get the kMDItemKind string to use, use the following syntax on a file of the type you want to learn more about-

mdls /path/to/file.extension

In the output from the above, you'll see a lot of info that gets captured in Spotlight. One of them should be the kMDItemKind. There may be others you can try using as well, such as "kMDItemContentType" Do the same for any other movie file types you want to track.
You can also combine two or more file types or extension types in your syntax. Example:

mdfind -onlyin /Users/ 'kMDItemKind == "AVI container" || kMDItemKind == "QuickTime movie"'

The above would list any AVI or .MOV files in any user home folder. The output lists the full path to each file.

Bear in mind that any of the above, if used in an EA, may result in some pretty large amounts of information getting reported., so just plan for that.

[tlarkin]

You could try using a script to check file extensions of a user's home folder. Although, a user could easily just change the file name.

Example code:

find -E /Users/* -iregex '.*.(mov|avi|mpeg)'

You could add in every file extension it could possibly be. You are going to be in a game of whack-a-mole though, with users being able to edit file names and extensions. You might want to look at this from the network perspective, and look at clients who are using more bandwidth. Plus, what if they are putting files on an external HD, or USB flash drive? Too many variables to calculate with a script solution.

Hope this helps,

-Tom

[pittman]

@zanb Wouldn't one want a boolean result for use with Extention attributes?
- just curious as to how you're using this. ;D