Can't extract 4 digits from a file that never is the same or at the same place

  • Sopor

    Sopor - 2013-09-12


    I have a file called myfile.dat and i’m trying to find “ps_startup\????” inside this file.
    “ps_startup\” is always the same so i use “????” on the last for chars. The last 4 is a date so it’s always numbers. Now i try to find this date that is never the same so i use this:

    “sfk.exe strings "%USERPROFILE%\AppData\Roaming\Program\myfile.dat" -nocol +filter "-+ps_startup\????" +tofile %temp%\sfk_output.txt”

    I’m getting a complete line of chars that looks like this:


    I only need the 4 digits 0905 and nothing more and use the “ps_startup\” to locate and to find the next 4 digits. This line “ps_startup\0905” can be anywhere on the line so sometimes it’s at the end of the line so i can’t count from the beginning or from the end to find it.

    I'm running this inside a batch file and only need to get the date out to a file.

    I hope you can help me solve this issue i have…


  • stahlworks

    stahlworks - 2013-09-13

    change the single +filter statement into something like

    +filter "-+ps_startup\????" -rep "/*ps_startup\//" -form "$-4.4col1"

    and it should work.

    Last edit: stahlworks 2013-09-13
  • Sopor

    Sopor - 2013-09-13

    Thank you so much! It works perfect :)


Log in to post a comment.