How to View Hidden Files and Folders using PowerShell

The Limitation of the GUI

In Windows, users and system administrators can easily hide files or entire folders to prevent them from cluttering the screen or being accidentally deleted by standard users. While you can open the File Explorer GUI, click on the “View” tab, and check the “Hidden items” box to reveal these files, doing so on a headless Windows Server (Server Core) or across a massive directory structure via the command line requires PowerShell.

Using the Get-ChildItem Cmdlet

The standard PowerShell command to list the contents of a directory is Get-ChildItem (often aliased as dir or ls). However, by default, this cmdlet intentionally ignores any file or folder that possesses the Hidden attribute.

To force PowerShell to reveal these files, you must use the -Force parameter.

Get-ChildItem -Path "C:\Users\Administrator\" -Force

The output will now display every file and folder in the directory, including hidden system files like NTUSER.DAT or the hidden AppData folder.

Filtering for Hidden Files Only

If you are exploring a massive directory with thousands of standard files, appending the -Force flag will simply mix the hidden files into a gigantic, unreadable list. If you are specifically hunting for hidden files (perhaps looking for a hidden malicious script or a forgotten configuration file), you want PowerShell to only show you files that possess the hidden attribute.

You can accomplish this using the -Hidden parameter instead.

Get-ChildItem -Path "C:\Users\Administrator\" -Hidden

This command will completely ignore all standard, visible files and will only output the items that have been explicitly hidden.

Recursive Searching for Hidden Files

If you want to scan an entire drive or a deeply nested folder structure for hidden files, you can combine the -Hidden parameter with the -Recurse parameter.

For example, to find every single hidden file on the entire C:\ drive (this will take a while and will generate some access denied errors for protected system directories), you would use:

Get-ChildItem -Path "C:\" -Hidden -Recurse -ErrorAction SilentlyContinue

The -ErrorAction SilentlyContinue flag is crucial here; it suppresses the red error text generated when PowerShell tries to scan a folder it does not have permission to read, keeping your terminal output clean and readable.