How to list files with changed names

[Robert2]

Folder with 1500+ PNG pictures.
Some of the pictures I “accessed” using Al+Q.
I changed the name (F2), but not the extension of some of the pictures, —not necessarily the ones I had “accessed”.
The pictures with changed names kept their original “Created” and “Modified” dates/attributes.
I could not find a way to list/select only the files with changed names, using either Ctrl+F or the Sort command.
Any suggestions?

[nikos]

when you change filenames, no other file attributes change, so it's not possible to know what you're looking for

[Kilmatead]

when you change filenames, no other file attributes change, so it's not possible...

Except the NTFS volume's spooky USN Journal does. "Well, yes", I hear you say absently to yourself, "but that's not going to do him any good, now is it?" Oh Nikos, ye of little faith.

Robert2, you wouldn't happen to use Everything Search, do you? (I can see Nikos shaking his head and rolling his eyes at this.)

This is the part where I tell Nikos ahead of time to PLEASE DO NOT THROW HEAVY OBJECTS AT MY HEAD.

Robert, if you don't use ES, and are willing to be a bit adventurous (and your folder is on an NTFS drive), we can have a little fun here. I can't guarantee this is going to work, but I just did a few tests, and it might just tickle your toast. Please download the most recent ES 1.5a (either the installer or the portable, it won't matter which).

As you're probably running as a normal boring user, you'll have to activate the ES service, so (in Everything) go to Tools -> Options -> General -> Everything Service (tick it), and click OK.

Open the ES settings again, and this time go to Tools -> Options -> Indexes -> NTFS and select whatever volume has the folder which you stored your pictures. When you have selected the volume, below it tick both "Enable USN Journal" and "Load USN Journal into the Recent Changes database".

Then go back to Tools -> Options -> Indexes and select "Index Recent Changes". Click OK. (Give it a few seconds to chew on its cud, then...)

In the everything command line at the top of the screen type "rc:5days \myfavouritenudes"

Obviously, "myfavouritenudes" should not only be your favourite nudes but also the name of the folder which holds your pictures (you can use the full path if you want, but it's simpler to just include the leading backslash). You can also change "rc:5days" to rc:1day or rc:8hours or whatever you want to narrow things down. ("rc:" == Recent Changes)

If all went well, the ES results field will fill up with a bunch of filenames. If the results field is empty... then... well... start over? Anyway, Right-click on the "Columns" bar and select "Add Columns..." then in the window that opens type "recent" into the searchbox at the top. A single entry should popup called "Date Recently Changed" - double-click it to add it to the display.

Note that "Date Recently Changed" is NOT the same thing as Modified, etc.

Anyway, if the gods are in a good mood, and the planets are all aligned, you should be able to sort by Recently Changed, and ponder what filenames look familiar to you. Please note that a great many things may have changed in the folder so it could take awhile to figure out what is and is not useful to you.

Like I said, I cannot guarantee this will work, but damn it's fun to mess with.

NIKOS!!! I TOLD YOU TO STOP THROWING THINGS AT ME!!!

STOP IT!

FINE, I'M TELLING MUM!!!

Nikos can be such a brat sometimes.

Anyway, hope this helps.

[Robert2]

Thank you, Kilmatead! But “Date Recently Changed” would not do because changing a file name does not change its original date! That is the crux of the problem!
For example, today I changed a file name to “chapter322.png”. That file had been created on 2020-06-30. The file date was kept AS IS.
Maybe Nikos could add an option to xplorer² so that any change in a file name would automatically mark that file with a specific color tag?
Nikos?

[Kilmatead]

But “Date Recently Changed” would not do because changing a file name does not change its original date!

Did you try it? You might be surprised.

Date Recently Changed is a change journal attribute (Update Sequence Number) not a file or folder attribute, and changing a filename does modify that date, it's just that you can't normally see it and x2 can't show it to you. Like I said, forget the Created/Modified/Accessed dates you're used to, with the USN Journal we're not in Kansas anymore...

[Robert2]

I downloaded and installed the portable version of ES 1.5a.
I followed your instructions to the letter, then I tried a few more settings.
ES would not restrict the search to “*.png”. Instead it listed all picture types (GIF, SVG, etc.)
ES also listed all graphic temp files in the C: temp folder even though I had tried to restrict it to “include only (one specific folder) folder” in D:.
The "Date Recently Changed" column gave me plenty to chew on. I felt like I was in Donald Trump’s Kansas…
However, I could locate the target files through a combination of 2 columns, i.e. “Path” and “Date Recently Changed”.
So I suppose ES is OK. But it is not easy to set up correctly, if I can be set up correctly at all…
I would very much prefer a simple solution in xplorer²…
Nikos?

[Kilmatead]

ES will easily separate filetypes, you just have to add *.png to the original line "rc:2hours *.png D:\Pictures". Do NOT use something like "D:\Pictures\*.png", that's not how it works, separate elements with spaces. Always work with the full line, don't try and "browse to it" like you normally might. It's a different paradigm, and it's not for everyone, but it is very powerful and ridiculously flexible.

But yeah, not easy at first glance. But then neither is x2 at first, you've just had 20 years to become "institutionalised".

Anyway, what you're asking for may sound simple, but it's not. You would think that disabling x2's "Preserve dates" setting would actually work (to at least give you a new modified date on namechange), but it doesn't. That would just be a hack anyway.

Nikos will be overjoyed that you dislike ES, he's actually terrified to use it himself, and if he knew what it can really do when you set it free in a field of grouse with a shotgun, he'd pee his pantaloons.

[Robert2]

Note that ES needs to be run as Administrator, otherwise it finds nothing.

what you're asking for may sound simple

I don’t know what might be the inner workings of this, but xplorer² does “realize” that the file name is being changed, and the file is being registered under a different name. Why not keep track of such an event? It could be a background job for the Sync Wizard…

[Kilmatead]

Note that ES needs to be run as Administrator, otherwise it finds nothing.

That's why the service needs to be used. It does the required elevation for indexing "behind the scenes" so the user can remain neutered. Maybe it needs to be restarted for that to kick in? I don't know, I always run as Admin specifically to avoid such things.

Why not keep track of such an event?

Probably for the same reason as he resists the idea of implementing an "undo" feature - too many edge-cases where the idea is sound but the execution is futile. Not to mention there are millions (literally) of those journaling events happening throughout the system that the user is mostly unaware of. Where would he draw the line? The ocean is deep and foreboding when you can't see the bottom.

Come to think of it, if he did implement such a thing, no doubt someone would eventually pipe-up in a squeaky voice and ask for a "private browsing mode" where nothing is tracked. Exceptions like that seem to be all the rage these days.

You'd have a lot of passive-aggressive wives inquiring quietly of their husbands over suspiciously cold hors d'oeuvres, "why-ever were those filenames changed, dear? And why every week at 3:52 am?"

Cold hors d'oeuvres will make you squirm in more ways than one, every time.

[Robert2]

there are millions (literally) of those journaling events happening throughout the system that the user is mostly unaware of

When I click “File | Rename” or press F2, I am quite aware of what I am doing, and so should xplorer²… this is not a background event.
Why not create a new “Rename and tag” command?

[nikos]

ah yes, the NTFS change journal, which I never bothered with
does it register renames? it has too much detail in it...

Code: Select all

fsutil usn readjournal C:

or better this tool that can do filtering for events https://www.codeproject.com/Articles/11594/Eyes-on-NTFS (must be run elevated)

[Robert2]

I asked Google Gemini and Leo AI the following query:

Is it possible to list all files which have been renamed within 24 hours in a Windows system? How?

Answers:
Gemini

Unfortunately, Windows itself doesn't track file rename history. There isn't a built-in way to see which files were renamed and when.
Here are a few alternative approaches:
Third-party software: Some file management software like XYplorer or Total Commander might offer features that track file system changes, including renames. These programs might show recently modified or renamed files.
File versioning with a version control system (VCS): If you're using a version control system like Git for your files, it will track all changes, including renames. You can use the VCS to see the history of any file and identify when it was renamed.
Monitoring with a script (advanced): You can write a script (PowerShell or batch) that periodically scans a directory and compares the current timestamps with a previously recorded list. This can be complex and requires some scripting knowledge.
Important Note: Running scripts to monitor file changes can have performance implications. Only use this approach if the other methods are not suitable.

Leo AI
Yes, it's possible to list recently renamed files in a Windows system using PowerShell. Here's a simple command that could help:

```powershell
Get-ChildItem -Path "C:\Your\Directory" -Recurse | Where-Object { $_.FullName -like "**" -and $_.CreationTime -gt (Get-Date).AddDays(-1) -and $_.Name -ne $_.OriginalName } | Format-Table Name, FullName, OriginalName, CreationTime```

Replace `"C:\Your\Directory"` with the path of the directory you're interested in. This command will list files in that directory (and its subdirectories) that were renamed within the last 24 hours.
Please note that this command might not work as expected if the files were moved from another location or if the system's file timestamps are not accurate.

[Kilmatead]

USN does detect renames, but I don't think it actually knows the "before & after" details, just that the event occurred, like deletes, creates, etc. This is why it's primarily used by backup programmes to shout out "hey! look! there's blood in the water! something happened here!"

The NTFS equivalent of the doomsday book's births, deaths, and taxes. In hard-to-read scribbles.

Not really suitable for what Robert wants, he just wants a continuous log of what the user does, which you half-do already with searches, robust transfers and kills. Though I don't know how persistent that record is.

I noticed that ES does have the "original filename" property (like that ps script above references), but I couldn't get it populated.

To be fair, Date-Accessed does seem to change on (Right-click) file rename but not on F2 rename... odd... wait: turn off Tools -> Options -> Advanced -> "Preserve Dates" and Date Accessed does the trick.

[Robert2]

Is it possible to list all files which have been renamed within 48 hours in a Windows system? How?

ChatGPT:
Yes, it is possible to list all files that have been renamed within the last 48 hours on a Windows system using PowerShell. However, please note that tracking specifically renamed files (as opposed to created or modified files) directly through PowerShell is not straightforward because the standard file attributes do not differentiate between renames and other types of modifications. For precise tracking of file renames, you would typically need to enable file system auditing and review the security event logs.
Using PowerShell with File System Auditing
Here are the steps to enable file system auditing and then list files that have been renamed in the last 48 hours.
Step 1: Enable File System Auditing
Enable Auditing on the Folder:
Right-click the folder you want to monitor and select Properties.
Go to the Security tab and click Advanced.
Go to the Auditing tab and click Add.
Select a principal (e.g., Everyone), choose Success and Failure, and check Rename under the Access list.
Enable Audit Policy:
Open Local Security Policy (type secpol.msc in the Run dialog).
Go to Advanced Audit Policy Configuration -> Object Access.
Enable Audit File System and Audit Handle Manipulation for both Success and Failure.
Step 2: Use PowerShell to Search Event Logs
Open PowerShell as Administrator:
Press Win + X and select Windows PowerShell (Admin).
Run the PowerShell Script:
Copy and paste the following script into the PowerShell window and press Enter:
powershell
Copy code

# Define the time range (last 48 hours)
$timeLimit = (Get-Date).AddHours(-48)

# Get all security event logs related to file renaming
Get-WinEvent -FilterHashtable @{
LogName = 'Security';
Id = 4663; # Event ID for Object Access
StartTime = $timeLimit
} | Where-Object {
$_.Properties[10].Value -like '*Rename*'
} | Select-Object TimeCreated, @{Name="File"; Expression={$_.Properties[6].Value}}

Explanation of the Script
$timeLimit = (Get-Date).AddHours(-48):
Sets the $timeLimit variable to the current date and time minus 48 hours.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4663; StartTime = $timeLimit }:
Retrieves security event logs with Event ID 4663 (which indicates object access, including renames) from the last 48 hours.
Where-Object { $_.Properties[10].Value -like '*Rename*' }:
Filters the logs to include only those that specifically mention a rename operation.
Select-Object TimeCreated, @{Name="File"; Expression={$_.Properties[6].Value}}:
Selects and displays the time the event was created and the file name associated with the event.
Notes
Administrative Privileges: Running PowerShell as an administrator is necessary to access the security event logs.
File System Auditing Overhead: Enabling auditing can increase the overhead on your system, especially if auditing many file operations.
Security Event Logs: Ensure your system has enough storage and the security logs are not being overwritten too quickly.
By following these steps, you can track and list files that have been renamed within the last 48 hours. The key is enabling file system auditing to capture the specific rename events, which can then be queried using PowerShell.

[nikos]

I wouldn't trust AI answers on highly technical matters... ask basic information about xplorer2 and you'll see what I mean!