Get Hidden Files and Folders Using PowerShell

To get hidden files and folders using PowerShell, we need to use the Get-ChildItem command with the - Hidden or -Force parameter.

The difference between the two mentioned parameters is Hidden parameter only retrieves the hidden files and folders while the Force parameter retrieves all the files and folders including Hidden, read-only and normal files and folder.

For example, We have one folder named Data inside folder C:\temp and we need to retrieve it.

PS C:\> Get-ChildItem C:\Temp\ -Hidden
Directory: C:\Temp
Mode        LastWriteTime      Length Name
----        -------------     ------ ----
d--h-       9/28/2020 7:57 AM        Data

You can check the mode of the above folder in the output where ‘d’ indicates the directory and the ‘h’ attribute indicates the Hidden.

If we use the Force parameter, PowerShell will retrieve all attributed files and folders.

PS C:\> Get-ChildItem C:\Temp\ -Force
Directory: C:\Temp
Mode     LastWriteTime      Length     Name
----     -------------      ------     ----
d--h-    9/28/2020          7:57  AM   Data
d----    8/11/2020          10:58 AM   Help Files
d----    7/29/2020          6:01  PM   iisadministration

You can also use cmd command Dir to retrieve hidden files and folder with switch -h.

PS C:\> dir -h
Directory: C:\
Mode         LastWriteTime      Length      Name
----         -------------      ------      ----
d--hs        6/4/2020           2:28 PM     $Recycle.Bin
d--hs        9/27/2020         10:07 PM     Config.Msi
d--hs        6/3/2020           1:00 AM     IntelOptaneData
d--h-        6/5/2020          12:18 PM     OneDriveTemp
d--h-        9/25/2020          8:02 AM     ProgramData
d--hs        6/2/2020          12:32 PM     Recovery
-a-hs        9/28/2020          7:54 AM     6768705536 hiberfil.sys
-a-hs        9/16/2020          7:47 AM     12348030976 pagefile.sys
-a-hs        9/18/2020          7:06 PM     285212672 swapfile.sys

The above example retrieves all files and folder which has a hidden attribute.

To check the same settings on the remote computer, use the Invoke-Command method. For example,

Invoke-Command -ComputerName Test1-Win2k16 -ScriptBlock{Get-ChildItem c:\ - Hidden}

Output:

Mode    LastWriteTime   Length      Name            PSComputerName
----    -------------   ------      ----            --------------
d--hs-  7/29/2020      10:21 PM     $Recycle.Bin    Test1-Win2k16
d--hsl  7/21/2020       4:36 PM     Documents and   Settings Test1-Win2k16
d--h--  9/20/2020       3:24 AM     ProgramData     Test1-Win2k16
d--hs-  7/21/2020       4:36 PM     Recovery       Test1 -Win2k16
d--hs-  7/27/2020       6:31 AM     System Volume  Information Test1-Win2k16
-arhs-  7/16/2016       6:18 AM     384322 bootmgr Test1-Win2k16
-a-hs-  7/16/2016       6:18 AM     1 BOOTNXT      Test1-Win2k16
-a-hs-  9/28/2020      10:44 PM     1006632960     pagefile.sys Test1-Win2k16

You can see the hidden files and folders on the remote computer.