Background
We recently received a request from SecOps to search for the presence of dozens of specific filenames on multiple users' hard drives.
The following script leverages mdfind to search for a file by name; use mdfind -interpret to search for the contents of a file.
Add to declare -a files=( … ) as needed; generous amounts of testing / validation will be required.
(Note: "UBF8T346G9.OneDriveSyncClientSuite" was included to validate the script is actually working.)
Script
#!/bin/bash
####################################################################################################
#
# ABOUT
#
# Filename Search
#
####################################################################################################
#
# HISTORY
#
# Version 1.0, 14-Nov-2018, Dan K. Snelson
# Original version
#
####################################################################################################
echo " "
echo "***********************"
echo "*** Filename Search ***"
echo "***********************"
echo " "
authorizationKey="${4}"
# Check for a specified value in Parameter 4
if [[ "${authorizationKey}" != "]Iy9;;A)nV{KDl[WHj[VE*-Cs{" ]]; then
echo "Error: Incorrect Authorization Key; exiting."
exit 1
else
echo "Correct Authorization Key; proceeding …"
fi
declare -a files=("UBF8T346G9.OneDriveSyncClientSuite"
"File I don't want to Security to find.rtf"
"Nothing to worry about.txt"
"Filename-goes-here.pdf"
"Add as many as needed.docx"
"Spaces are OK.ppt"
)
#set -x
for file in "${files[@]}"
do
printf "
Searching for: "$file" ...
"
IFS='%'
testFile=( `/usr/bin/mdfind -name "${file}"` )
# testFile=( `/usr/bin/mdfind -interpret "${file}"` ) # Search for contents of file; see man mdfind
if [[ -z "${testFile}" ]]; then
echo ""$file" NOT found"
else
printf "Found: "$file"; printing metadata for "${testFile}" ...
"
/usr/bin/mdls "${testFile}"
fi
printf "
============================================================
"
unset IFS
done
#set +x
exit 0
