Exercise: The Archive Detective

Solve the case of the archive's missing telescope with PowerShell's searches, a pattern through two weeks of door logs, the staff list, the lockers and the storage room, and let a Pester check tell you which answers are right.

Apprentice · PowerShell · Operating System · Updated

The town archive's brass telescope stood in the observatory room on November 8. On the morning of the 9th, its stand was empty. The archivist has two weeks of door logs, a staff list, a basement of lockers and a storage room full of boxes, and no time to read any of it. You won't read it either: everything you need to search it is in this chapter. You'll answer six questions in PowerShell, and a check tells you which answers are right.

Get the exercise code

Open this lesson's GitHub repository, github.com/ask-codey/exercise-powershell-the-archive-detective, also linked from the Exercise box beside the lesson. Click Code, then Download ZIP, and unzip it into your terminal-practice folder. Or clone it with Git.

The folder holds:

  • notice.txt: the archivist's note about what happened.
  • logs: the door log for every day from November 1 to 14, one file a day, in the same shape as the lessons' logs: a time, a door, a badge and what happened.
  • staff.txt: who carries which badge.
  • lockers: every staff member's locker, in folders by floor and row.
  • storage: the storage room's boxes, on four shelves.
  • answers.txt: one line for each question, for your answers.
  • Check.Tests.ps1: the check. You don't need to change it.

What to do

Open PowerShell 7 and go into the exercise folder with Set-Location. Read notice.txt first. The questions are in the folder's README.md:

  1. Search every log for lines in the small hours with the pattern '^0[0-5]:'. One of them is at the observatory. Which log file is it in?
  2. Which badge number opened the observatory that night?
  3. Whose badge is it, according to staff.txt?
  4. How many lines, in all the logs together, mention that badge number?
  5. Where is that person's locker? Give the folder's path from the exercise folder.
  6. Read what's in the locker. Which file under storage is bigger than 50 KB?

Write each answer after its number in answers.txt, such as 1) 2026-11-01.log, and save the file. Open it with edit answers.txt, or in Notepad.

# Write each answer after its number, on the same line. See README.md for the questions.
1)
2)
3)
4)
5)
6)

Check your work

The check uses Pester, PowerShell's test tool. Install it once, if you haven't already:

Install-PSResource Pester

Then, from the exercise folder:

Invoke-Pester

At first all six tests fail. That's expected: each right answer turns its test green. A failing test says what it's looking for without giving the answer away, for example Expected $true, because the answer is the number after badge= on the observatory line in the small hours, such as 1234, but got $false. The right answers are near the end of Check.Tests.ps1, so solve the case first and look there only to check.

If PowerShell says the check can't be loaded because running scripts is disabled or the file is not digitally signed, Windows has marked the downloaded files as coming from the internet. From the exercise folder, run Get-ChildItem -Recurse | Unblock-File once, then Invoke-Pester again. Why a Script Won't Run: The Execution Policy, in Module 5, explains what that does.

Hints

  • Read the pattern aloud. '^0[0-5]:' is "starts with a zero, then one digit from 0 to 5, then a colon": any time from 00:00 to 05:59. Patterns: Regular Expressions with -match has every piece.
  • Let the computer count. For question 4, send Select-String's results down the pipe to Measure-Object; Counting and Grouping: Measure-Object and Group-Object shows how to read its Count.
  • Search with part of a name. Locker folders are named after people, in small letters with a dash: -Filter with a star on each side of a last name finds one at any depth.
  • Ask about size, not name. Nothing in storage is called "telescope". -Recurse -File and Where-Object Length -gt 50KB find the one box that's heavier than the rest.

When you're done

Every test is green, and Pester's last line says:

Tests Passed: 6, Failed: 0, Skipped: 0, Inconclusive: 0, NotRun: 0

Now look back at question 1. You found one line among more than a hundred without reading any of them. How would you change the pattern to find every visit between 10 PM and midnight instead?

Submit your exercise

The exercise is how you finish this lesson. When your work is done, put it on GitHub in a repo of your own, then submit that repo's address here.

  1. On GitHub, click +, then New repository. Name it (for example exercise-powershell-the-archive-detective), choose Public, and click Create repository. Leave out the README: your folder already has one.

  2. In a terminal in your exercise folder (PowerShell works), send your work to your new repo. If you downloaded the ZIP:

    git init -b main
git add .
git commit -m "My solution"
git remote add origin https://github.com/your-name/exercise-powershell-the-archive-detective.git
git push -u origin main

    If you cloned the starter instead, point your copy at your own repo, then commit and push:

    git remote set-url origin https://github.com/your-name/exercise-powershell-the-archive-detective.git
git add .
git commit -m "My solution"
git push -u origin main

  3. Paste your repo's address, such as https://github.com/your-name/exercise-powershell-the-archive-detective, into Submit your exercise on this page. The site checks that the repo is public and holds your commits, and then the lesson is complete.

Changed something after you submitted? Push it, and submit again: your latest submission is the one that counts.

So what

You solved a case without opening a single log: a pattern found the night, a search found the name, a count backed it up, and a size filter found what no file name would. That's how people work through thousands of lines and files every day.

Key terms

Related