usr/Show-PendingMoves.ps1
|
Set-Alias -Name pendmoves -Value Show-PendingMoves function Show-PendingMoves { <# .SYNOPSIS Dumps the contents of the pending rename/delete value. .DESCRIPTION The function completely repeats the pendmoves.exe utility from SysInternals kit. .INPUTS None .OUTPUTS System.Array .NOTES The function has no parameters other than common. #> [CmdletBinding()]param() end { $rk = Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' $(for ($i, $arr = 0, $rk.GetValue('PendingFileRenameOperations' ).Trim('\??\'); $i -lt $arr.Length; $i++) { [PSCustomObject]@{ Source = $arr[$i++] Target = !($$ = $arr[$i]) ? 'DELETE' : $$ } }) | Format-List $ft = [Int32[]]::new(2) if (!($res = [AppDomain]::CurrentDomain.GetAssemblies().Where{ $_.ManifestModule.ScopeName.Equals('Microsoft.Win32.Registry.dll') }[0].GetType('Interop+Advapi32').GetMethod( 'RegQueryInfoKey', [Reflection.BindingFlags]'NonPublic, Static' ).Invoke($null, @($rk.Handle, $null, $null, [IntPtr]::Zero, $null, $null, $null, $null, $null, $null, $null, $ft)))) { "Time of last update to pending moves key: $( [DateTime]::FromFileTime( ([Int64]$ft[1] -shl 32) -bor [BitConverter]::ToUInt32( [BitConverter]::GetBytes($ft[0]), 0 ) ))" } else { Write-Verbose $([ComponentModel.Win32Exception]::new($res).Message) } $rk.Dispose() } } Export-ModuleMember -Alias pendmoves -Function Show-PendingMoves |