robocopy
Copies file data from one location to another. Windows commands reference
On Windows 4 Sigma rules name it File robocopy.exe
Windows
robocopy <source> <destination> [<file>[ ...]] [<options>]robocopy c:\reports "\\marketing\videos" yearly-report.mov /mt /zTo copy all files and subdirectories, including empty directories, from the "Records" folder to the "Backup" folder on drive "D", type
robocopy C:\Users\Admin\Records D:\Backup /E /ZB /LOG:C:\Logs\Backup.logIdentify/ECopies subdirectories. Windows commands reference/ZBCopies files in restartable mode. Windows commands reference/LOGWrites the status output to the log file (overwrites the existing log file). Windows commands referenceTo mirror the contents of the "Records" folder to the "Backup" folder on drive "D", delete any files in the destination that don't exist in the source with 2 retries and waiting 5 seconds between each retry, type
robocopy C:\Users\Admin\Records D:\Backup /MIR /R:2 /W:5 /LOG:C:\Logs\Backup.logIdentify/MIRMirrors a directory tree (equivalent to /e plus /purge). Windows commands reference/RSpecifies the number of retries on failed copies. Windows commands reference/WSpecifies the wait time between retries, in seconds. Windows commands reference/LOGWrites the status output to the log file (overwrites the existing log file). Windows commands referenceTo copy all files and subdirectories that aren't empty from the "Records" folder to the "Backup" folder on drive "D", retaining the file data, attributes, and timestamps with 16 multi-threaded copy operation, type
robocopy C:\Users\Admin\Records D:\Backup /S /E /COPY:DAT /MT:16 /LOG:C:\Logs\Backup.logIdentify/SCopies subdirectories. Windows commands reference/ECopies subdirectories. Windows commands reference/COPYSpecifies which file properties to copy. Windows commands reference/MTCreates multi-threaded copies with *n* threads. Windows commands reference/LOGWrites the status output to the log file (overwrites the existing log file). Windows commands referenceTo move files and subdirectories, excluding empty directories, from the "Records" folder to the "Backup" folder on drive "D", and exclude files older than 7 days, type
robocopy C:\Users\Admin\Records D:\Backup /S /MAXAGE:7 /MOV /LOG:C:\Logs\Backup.logIdentify/SCopies subdirectories. Windows commands reference/MAXAGESpecifies the maximum file age to exclude files older than *n* days or a date based on when the files were last _modified_. Windows commands reference/MOVMoves files, and deletes them from the source after they're copied. Windows commands reference/LOGWrites the status output to the log file (overwrites the existing log file). Windows commands referenceTo copy all files and subdirectories, including empty directories, from the "Records" folder to the "Backup" folder on drive "D" showing the estimated time for each file and delete any files and directories in the destination that don't exist from the source, type
robocopy C:\Users\Admin\Records D:\Backup /ETA /PURGE /LOG:C:\Logs\Backup.logIdentify/ETAShows the estimated time of arrival (ETA) of the copied files. Windows commands reference/PURGEDeletes destination files and directories that no longer exist in the source. Windows commands reference/LOGWrites the status output to the log file (overwrites the existing log file). Windows commands referenceTo copy all files and subdirectories from the folder named "Records" on the "C" drive to a folder named "Backup" on the "D" drive while limiting the I/O rate to 1 megabyte per second during the copy operation, type
robocopy C:\Records D:\Backup /iorate:1mIdentify/iorateThe requested i/o rate in *n* kilobytes megabytes, or gigabytes per second. Windows commands referenceTo skip copying files from a source folder to a destination folder when the files already exist in the destination folder, regardless of whether they're newer, older, or modified, type
robocopy C:\Source C:\Destination /XC /XN /XOIdentify/XCExcludes existing files with the same timestamp, but different file sizes. Windows commands reference/XNSource directory files newer than the destination are excluded from the copy. Windows commands reference/XOSource directory files older than the destination are excluded from the copy. Windows commands referenceShow 109 options
<source>Specifies the path to the source directory.<destination>Specifies the path to the destination directory.<file>Specifies the file or files to be copied. Wildcard characters (* or ?) are supported. If you don't specify this parameter, *.* is used as the default value.<options>Specifies the options to use with the robocopy command, including copy, file, retry, logging, and job options./sCopies subdirectories. This option automatically excludes empty directories./eCopies subdirectories. This option automatically includes empty directories./lev:<n>Copies only the top n levels of the source directory tree./zCopies files in restartable mode. In restartable mode, should a file copy be interrupted, robocopy can pick up where it left off rather than recopying the entire file./bCopies files in backup mode. In backup mode, robocopy overrides file and folder permission settings (ACLs), which might otherwise block access./zbCopies files in restartable mode. If file access is denied, switches to backup mode./jCopies using unbuffered I/O (recommended for large files)./efsrawCopies all encrypted files in EFS RAW mode./copy:<copyflags>Specifies which file properties to copy. The valid values for this option are:
- D - Data
- A - Attributes
- T - Time stamps
- X - Skip alt data streams
- S - NTFS access control list (ACL)
- O - Owner information
- U - Auditing informationThe default value for the /COPY option is DAT (data, attributes, and time stamps). The X flag is ignored if either /B or /ZB is used./dcopy:<copyflags>Specifies what to copy in directories. The valid values for this option are:
- D - Data
- A - Attributes
- T - Time stamps
- E - Extended attribute
- X - Skip alt data streamsThe default value for this option is DA (data and attributes)./secCopies files with security (equivalent to /copy:DATS)./copyallCopies all file information (equivalent to /copy:DATSOU)./nocopyCopies no file information (useful with /purge)./secfixFixes file security on all files, even skipped ones./timfixFixes file times on all files, even skipped ones./purgeDeletes destination files and directories that no longer exist in the source. Using this option with the /e option and a destination directory, allows the destination directory security settings to not be overwritten./mirMirrors a directory tree (equivalent to /e plus /purge). Using this option with the /e option and a destination directory, overwrites the destination directory security settings./movMoves files, and deletes them from the source after they're copied./moveMoves files and directories, and deletes them from the source after they're copied./a+:[RASHCNET]Adds the specified attributes to copied files. The valid values for this option are:
- R - Read only
- A - Archive
- S - System
- H - Hidden
- C - Compressed
- N - Not content indexed
- E - Encrypted
- T - Temporary/a-:[RASHCNETO]Removes the specified attributes from copied files. The valid values for this option are:
- R - Read only
- A - Archive
- S - System
- H - Hidden
- C - Compressed
- N - Not content indexed
- E - Encrypted
- T - Temporary
- O - Offline/createCreates a directory tree and zero-length files only./fatCreates destination files by using 8.3 character-length FAT file names only./256Turns off support for paths longer than 256 characters./mon:<n>Monitors the source and runs again when more than n changes are detected./mot:<m>Monitors the source and runs again in m minutes if changes are detected./rh:hhmm-hhmmSpecifies run times when new copies can be started./pfChecks run times on a per file (not per-pass) basis./ipg:<n>Specifies the inter-packet gap to free bandwidth on slow lines./sjCopies junctions (soft-links) to the destination path instead of link targets./slDon't follow symbolic links and instead create a copy of the link./mt:<n>Creates multi-threaded copies with n threads. n must be an integer between 1 and 128. The default value for n is 8. For better performance, redirect your output using /log option.
The /mt parameter can't be used with the /ipg and /efsraw parameters./nodcopyCopies no directory info (the default /dcopy:DA is done)./nooffloadCopies files without using the Windows Copy Offload mechanism./compressRequests network compression during file transfer, if applicable./sparse:<yn> Enables or disables retaining the sparse state of files during copy process. If no option is selected, it defaults to yes (enabled)./nocloneDoesn't attempt block cloning as an optimization./iomaxsize:<n>[kmg]The requested max i/o size per read/write cycle in n kilobytes, megabytes, or gigabytes./iorate:<n>[kmg]The requested i/o rate in n kilobytes megabytes, or gigabytes per second./threshold:<n>[kmg]The file size threshold for throttling in n kilobytes, megabytes, or gigabytes (see Remarks)./aCopies only files for which the Archive attribute is set./mCopies only files for which the Archive attribute is set, and resets the Archive attribute./ia:[RASHCNETO]Includes only files for which any of the specified attributes are set. The valid values for this option are:
- R - Read only
- A - Archive
- S - System
- H - Hidden
- C - Compressed
- N - Not content indexed
- E - Encrypted
- T - Temporary
- O - Offline/xa:[RASHCNETO]Excludes files for which any of the specified attributes are set. The valid values for this option are:
- R - Read only
- A - Archive
- S - System
- H - Hidden
- C - Compressed
- N - Not content indexed
- E - Encrypted
- T - Temporary
- O - Offline/xf <filename>[ ...]Excludes files that match the specified names or paths. Wildcard characters (* and ?) are supported./xd <directory>[ ...]Excludes directories that match the specified names and paths./xcExcludes existing files with the same timestamp, but different file sizes./xnSource directory files newer than the destination are excluded from the copy./xoSource directory files older than the destination are excluded from the copy./xxExcludes extra files and directories present in the destination but not the source. Excluding extra files doesn't delete files from the destination./xlExcludes "lonely" files and directories present in the source but not the destination. Excluding lonely files prevents any new files from being added to the destination./imInclude modified files (differing change times)./isIncludes the same files. Same files are identical in name, size, times, and all attributes./itIncludes "tweaked" files. Tweaked files have the same name, size, and times, but different attributes./max:<n>Specifies the maximum file size (to exclude files bigger than n bytes)./min:<n>Specifies the minimum file size (to exclude files smaller than n bytes)./maxage:<n>Specifies the maximum file age to exclude files older than n days or a date based on when the files were last _modified_./minage:<n>Specifies the minimum file age to exclude files newer than n days or a date based on when the files were last _modified_./maxlad:<n>Specifies the maximum last access date (excludes files unused since n)./minlad:<n>Specifies the minimum last access date (excludes files used since n) If n is less than 1900, n specifies the number of days. Otherwise, n specifies a date in the format YYYYMMDD./xjExcludes junction points, which are normally included by default./fftAssumes FAT file times (two-second precision)./dstCompensates for one-hour DST time differences./xjdExcludes junction points for directories./xjfExcludes junction points for files./r:<n>Specifies the number of retries on failed copies. The default value of n is 1,000,000 (one million retries)./w:<n>Specifies the wait time between retries, in seconds. The default value of n is 30 (wait time 30 seconds)./regSaves the values specified in the /r and /w options as default settings in the registry./tbdSpecifies that the system waits for share names to be defined (retry error 67)./lfsmOperate in low free space mode that enables copy, pause, and resume (see Remarks)./lfsm:<n>[kmg]Specifies the floor size in n kilobytes, megabytes, or gigabytes./lSpecifies that files are to be listed only (and not copied, deleted, or time stamped)./xReports all extra files, not just the ones that are selected./vProduces verbose output, and shows all skipped files./tsIncludes source file time stamps in the output./fpIncludes the full path names of the files in the output./bytesPrints sizes as bytes./nsSpecifies that file sizes aren't to be logged./ncSpecifies that file classes aren't to be logged./nflSpecifies that file names aren't to be logged./ndlSpecifies that directory names aren't to be logged./npSpecifies to not display the progress of the copying operation (the number of files or directories copied so far)./etaShows the estimated time of arrival (ETA) of the copied files./log:<logfile>Writes the status output to the log file (overwrites the existing log file)./log+:<logfile>Writes the status output to the log file (appends the output to the existing log file)./unilog:<logfile>Writes the status output to the log file as unicode text (overwrites the existing log file)./unilog+:<logfile>Writes the status output to the log file as Unicode text (appends the output to the existing log file)./teeWrites the status output to the console window, and to the log file./njhSpecifies that there's no job header./njsSpecifies that there's no job summary./unicodeDisplays the status output as unicode text./job:<jobname>Specifies that parameters are to be derived from the named job file. To run /job:jobname, you must first run the /save:jobname parameter to create the job file./save:<jobname>Specifies that parameters are to be saved to the named job file. This must be ran before running /job:jobname. All copy, retry, and logging options must be specified before this parameter./quitQuits after processing command line (to view parameters)./nosdIndicates that no source directory is specified./noddIndicates that no destination directory is specified./ifIncludes the specified files.0No files were copied. No failure was encountered. No files were mismatched. The files already exist in the destination directory; therefore, the copy operation was skipped.1All files were copied successfully.2There are some additional files in the destination directory that aren't present in the source directory. No files were copied.3Some files were copied. Additional files were present. No failure was encountered.5Some files were copied. Some files were mismatched. No failure was encountered.6Additional files and mismatched files exist. No files were copied and no failures were encountered meaning that the files already exist in the destination directory.7Files were copied, a file mismatch was present, and additional files were present.8Several files didn't copy.Windows
Robust File and Folder Copy. By default files will only be copied if the source and destination have different time stamps or different file sizes.
Copy all .jpg and .bmp files from one directory to another
robocopy path\to\source_directory path\to\destination_directory *.jpg *.bmpIdentifyCopy all files and subdirectories, including empty ones
robocopy path\to\source_directory path\to\destination_directory /EIdentify/ECopies subdirectories. Windows commands referenceMirror/Sync a directory, deleting anything not in source, and include all attributes and permissions
robocopy path\to\source_directory path\to\destination_directory /MIR /COPYALLIdentify/MIRMirrors a directory tree (equivalent to /e plus /purge). Windows commands reference/COPYALLCopies all file information (equivalent to /copy:DATSOU). Windows commands referenceCopy all files and subdirectories, excluding source files that are older than destination files
robocopy path\to\source_directory path\to\destination_directory /E /XOIdentify/ECopies subdirectories. Windows commands reference/XOSource directory files older than the destination are excluded from the copy. Windows commands referenceList all files 50 MB or larger instead of copying them
robocopy path\to\source_directory path\to\destination_directory /MIN:52428800 /LIdentify/MINSpecifies the minimum file size (to exclude files smaller than *n* bytes). Windows commands reference/LSpecifies that files are to be listed only (and not copied, deleted, or time stamped). Windows commands referenceAllow resuming if network connection is lost and limit retries to 5 and wait time to 15 sec
robocopy path\to\source_directory path\to\destination_directory /Z /R:5 /W:15Identify/ZCopies files in restartable mode. Windows commands reference/RSpecifies the number of retries on failed copies. Windows commands reference/WSpecifies the wait time between retries, in seconds. Windows commands referenceDisplay help
robocopy /?IdentifyWhat detects it
mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
mediumSuspicious Copy From or To System DirectoryFlorian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)