Step 2. Working with Files — Create, Copy, Move, Delete

Level 0 — Understanding How to Operate a Computer and How It’s Structured | Difficulty ★☆☆☆☆ | Estimated time: 2–3 hours

Prerequisites: Step 1 complete (opening PowerShell, pwd/ls/cd). We’ll continue in Windows PowerShell today.

• What you need: a Windows PC, PowerShell.
• Safety: every experiment today happens only inside a dedicated practice folder we’ll create at the start. It’s a safe zone where mistakes cause no damage.
• Caution: there’s exactly one thing to be careful about today — Remove-Item. Deletion in PowerShell does not go through the Recycle Bin. The moment you delete something, it’s permanently gone. So today we’ll work even harder on "how to delete safely" than on "how to delete."

You can copy files with a mouse. But "pick out only the 300 .txt files in this folder and copy them" takes 300 clicks with a mouse — and one line with a command. "Move the logs to the backup folder every night" needs automation, and a remote server has no mouse at all. In security work, file manipulation isn’t "tidying documents" — it’s handling evidence: isolating a suspicious file (move), preserving the original (copy), and cleaning up after analysis (delete). Those fundamentals are today’s material.

---

1. Learning Objectives

By the end of this chapter, you can:

• Create files and folders with New-Item
• Write to and read from files with Set-Content / Get-Content
• Distinguish and use Copy-Item (copy) vs Move-Item (move)
• Select only matching files with wildcards (*) and work on them
• Use the safety habit of previewing targets with -WhatIf before deleting

---

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	PowerShell 5.1, the Windows file system
Today’s commands	New-Item (create), Set-Content/Add-Content/Get-Content (write/append/read), Copy-Item (copy), Move-Item (move), Remove-Item (delete)
Today’s options	-WhatIf (preview), -Recurse (including children), -Exclude (exclude)
Concepts you need	file extensions, wildcards (*, ?), "copy vs move," what permanent deletion means

2-1. Extensions — A File’s Name Tag

The part after the last . in a filename is the extension — like .txt in report.txt or .exe in setup.exe. It’s a tag that says "what kind of file this is."

Extension	Type
.txt	text document
.exe	executable program
.ps1	PowerShell script
.zip	compressed archive
.log	log (record) file

One security note: by default, Windows hides extensions. So a file that looks like invoice.pdf may actually be invoice.pdf.exe (an executable!) — a classic malware trap. Turning on "File name extensions" in Explorer settings is the easiest security upgrade a beginner can make. In the CLI, ls always shows extensions, so the habit forms naturally.

2-2. Wildcards — Symbols for "Any Characters"

* (asterisk) is a special symbol meaning "any number of any characters can go here." Think of it as the joker in a deck of cards.

Pattern	Meaning	Matches
*.txt	everything ending in .txt	a.txt, diary.txt
log*	everything starting with log	log1.txt, logfile.zip
report?.txt	report + one character + .txt	report1.txt, reportA.txt

This symbol is today’s key weapon. Conditional selection like "only the txts out of 300" is what it does.

---

3. Follow Along

3-1. Creating a Practice Ground

Every experiment today happens inside a dedicated folder. Open PowerShell:

cd $HOME
New-Item -ItemType Directory practice

A line of info about the new folder is printed. Check:

ls

d-----        2026-09-08   오후 2:31                practice

The first character is d — a folder has been created. Let’s dissect the command:

• New-Item — "create a new item" (New + Item)
• -ItemType Directory — "the kind to make is a folder" (omit it and the default is a file)

Let’s go in:

cd practice

pwd      →  C:UsersLeepractice

Check that the prompt path ends in practice. Don’t type any command unless this is your path today — every experiment happens only here.

3-2. Creating a File and Writing to It — New-Item, Set-Content

Create an empty file:

New-Item test.txt

    디렉터리: C:UsersLeepractice

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        2026-09-08   오후 2:32              0 test.txt

Mode is -a---- — the first character isn’t d, so it’s a file. And Length is 0 — meaning an empty file with no content.

Now let’s put some content in:

Set-Content test.txt "hello security"

• Set-Content — "set the content" (Set + Content)
• The text inside the quotes gets written to the file

Let’s read it back to make sure it went in:

Get-Content test.txt

hello security

Get-Content means "get the content" — it prints the file’s content to the screen. The flow so far:

New-Item (create) → Set-Content (write) → Get-Content (read)

These three form the basic cycle of "record something in a file and verify it." Later, when you save script results to a file and check them, this exact cycle comes back.

Predict first: if you run Set-Content test.txt "second post", what happens to the content of test.txt? Will it be appended after the existing "hello security," or replaced? Predict, then verify with Get-Content.
(Answer: it’s replaced. Set-Content overwrites. If you want to append, there’s a separate command, Add-Content — give it a try.)

3-3. Copying — Copy-Item

Copy-Item test.txt backup.txt
ls

-a----        2026-09-08   오후 2:35             20 backup.txt
-a----        2026-09-08   오후 2:35             20 test.txt

Two files of the same size. How to read the command: Copy-Item source copy — "copy test.txt under the name backup.txt."

Why does copying matter in security? One principle: "analyze the copy; never touch the original." When you find a suspicious file, opening or modifying the original destroys evidence. Always make a copy and experiment on that. The first principle of forensics (digital evidence analysis) starts at Copy-Item.

⚠️ Caution: if a file with the same name already exists at the destination, Copy-Item silently overwrites it without asking (verified by testing). Overwriting destroys the existing content — before choosing a copy name, check with ls whether "the same name is already there."

3-4. Copying into a Folder

The copy destination can be a "folder" instead of a "filename." First, create a backup folder:

New-Item -ItemType Directory backup
Copy-Item test.txt backup
ls backup

-a----        2026-09-08   오후 2:36             20 test.txt

A copy of test.txt went into the backup folder. Copy-Item test.txt backup means "copy test.txt into the backup folder (keeping its name)."

3-5. Moving — Move-Item (and Renaming)

Move-Item test.txt backupmoved.txt

• Move-Item — "move it" (Move + Item)
• backupmoved.txt — "under the name moved.txt inside the backup folder"

Check:

ls

d-----        2026-09-08   오후 2:37                backup
-a----        2026-09-08   오후 2:35             20 backup.txt

test.txt is gone — unlike copying, moving leaves no original behind. Where did it go?

ls backup

-a----   ...   20 moved.txt
-a----   ...   20 test.txt

The two faces of Move-Item: used within the same folder, it becomes "rename."

Move-Item backup.txt renamed.txt

ls       →  backup.txt changed to renamed.txt

From this perspective, "Rename (F2)" in Windows Explorer is actually "a move to the same location."

3-6. All at Once with Wildcards — Real-World Feel

Now let’s use today’s real weapon. Create several test files (list them with commas to make many at once):

New-Item a.txt, b.txt, c.txt, a.log, b.log
ls

-a----   ...   0 a.log
-a----   ...   0 a.txt
-a----   ...   0 b.log
-a----   ...   0 b.txt
-a----   ...   0 c.txt
...

Your task: pick out only the .txt files and copy them into the backup folder.

Copy-Item *.txt backup
ls backup

-a----   ...   0 a.txt
-a----   ...   0 b.txt
-a----   ...   0 c.txt
...

The .log files were skipped, and only the .txt files were picked. Even with 300 files, this one line does it — this is the moment the command line beats the mouse.

Predict first: what would Copy-Item a* backup2 copy? (Answer: both a.txt and a.log, since they start with a. But if the backup2 folder doesn’t exist, PowerShell misreads it as "copy to a file named backup2" and produces a weird result — before copying into a folder, create it first with New-Item -ItemType Directory backup2.)

3-7. Deleting — Remove-Item, and the Safety Catch -WhatIf

Now, today’s most dangerous command.

Remove-Item renamed.txt

ls       →  renamed.txt is gone

It does not go through the Recycle Bin. Deleting in Explorer puts files in the Recycle Bin where you can restore them, but Remove-Item deletes permanently on the spot. That’s why you need a habit:

Before deleting, look at what you’re about to delete.

The safety catch that provides that "preview" is the -WhatIf option. Attach -WhatIf to any Remove-Item, and instead of actually deleting, it shows you "this is what would have been deleted."

New-Item victim1.txt, victim2.txt
Remove-Item victim*.txt -WhatIf

Result (actual output, Korean Windows):

WhatIf: 대상 "C:UsersLeepracticevictim1.txt"에서 "파일 제거" 작업을 수행합니다.
WhatIf: 대상 "C:UsersLeepracticevictim2.txt"에서 "파일 제거" 작업을 수행합니다.

(On English Windows: What if: Performing the operation "Remove File" on target "...".)

"If you had run it, these two files would have been deleted" — confirm the list matches your intent, and if it does, remove -WhatIf and run it for real:

Remove-Item victim*.txt

ls       →  both files are gone

Deleting a whole folder: a folder won’t delete outright if it’s not empty — it asks for confirmation. To delete it in one go, add -Recurse (everything inside, too):

Remove-Item backup2 -Recurse

⚠️ -Recurse is as dangerous as it is powerful. First check with ls whether "this folder really contains only disposables," and if possible, try -WhatIf here first too.

---

4. Missions & Exercises

Mission — File Manager Exam

Inside the practice folder, using only what you learned today, do the following:

1. Create a folder called project and enter it.
2. Inside, create four files: plan.txt, memo.txt, data.csv, run.log.
3. Write "This is the plan" into plan.txt, then read it back to confirm.
4. Create an archive folder and copy only the .txt files into it. (The original plan.txt must remain.)
5. Move run.log into the archive folder. (It must no longer be in the original location.)
6. Simulate deleting data.csv with -WhatIf, then really delete it.
7. Finally, verify that ls and ls archive look like this:
   • Current folder: plan.txt, memo.txt, archive
   • Inside archive: plan.txt, memo.txt, run.log

Exercises

Exercise 1. Explain the difference between Copy-Item and Move-Item in one sentence.

Exercise 2. The current folder contains a.txt, b.txt, and c.log. Instead of Copy-Item *.* backup, you want to copy everything except the .log files. Write two ways to do it.

Exercise 3. You ran Remove-Item *.txt -WhatIf, and besides the files you meant to delete, notes.txt appeared in the list. What should you do?

Exercise 4. You ran Set-Content a.txt "first" and then Set-Content a.txt "second". What does a.txt contain now? If you wanted to append instead, which command would you use?

---

5. Model Answers & Completion Criteria

Mission Walkthrough

New-Item -ItemType Directory project
cd project
New-Item plan.txt, memo.txt, data.csv, run.log
Set-Content plan.txt "This is the plan"
Get-Content plan.txt
New-Item -ItemType Directory archive
Copy-Item *.txt archive
Move-Item run.log archive
Remove-Item data.csv -WhatIf
Remove-Item data.csv
ls
ls archive

How to verify: the last two ls results must exactly match the expected state in mission step 7. The point is that plan.txt exists in both places (copying keeps the original). run.log must be only in archive, and data.csv must be nowhere.

Exercise Answers

Answer 1. Copy (Copy-Item) leaves the original in place; move (Move-Item) removes the original and carries it to the destination. (A Move-Item within the same folder becomes a "rename.")

Answer 2.

• Method 1 (wildcard): Copy-Item *.txt backup
• Method 2 (exclude option): Copy-Item * backup -Exclude *.log

Answer 3. Don’t remove -WhatIf — stop. The WhatIf list = the actual deletion list, so narrow the pattern (e.g., use only the common part of the filenames, like victim*.txt), check again with -WhatIf, and only run it for real when the list is exactly right. This is precisely why WhatIf exists.

Answer 4. The content is only second — Set-Content overwrites. To append, use Add-Content a.txt "second".

Completion Checklist

• [ ] I can create both files and folders with New-Item
• [ ] I can do the write-with-Set-Content, verify-with-Get-Content cycle
• [ ] I can explain the difference between copy (Copy) and move (Move)
• [ ] I can select and act on files with wildcards like *.txt
• [ ] I’ve experienced the habit of previewing with -WhatIf before deleting
• [ ] I produced the exact final state of mission steps 1–7

---

6. Common Pitfalls & Fixes

Wall 1. "I deleted an important file with Remove-Item!"

Prevention is the only answer. Recovery isn’t entirely impossible (recovery tools, backups), but success rates are low. So starting today, the iron rules:

1. Check the targets with ls before deleting
2. When deleting with wildcards, always -WhatIf first
3. For anything important, don’t delete — build a habit of moving it to a "trash folder" with Move-Item

Wall 2. I ran Copy-Item and got something unintended instead of a copy of the original

If you run Copy-Item a.txt backup when the destination folder doesn’t exist, PowerShell may interpret backup as a new filename rather than a folder. When copying into a folder, create the destination folder first (New-Item -ItemType Directory backup), and make it a set: copy, then verify with ls backup.

Wall 3. Spaces in the path break the command

Same rule as Step 1: wrap it in quotes, like Copy-Item "my file.txt" backup. Starting today, the habit of naming files/folders with - or _ instead of spaces also makes CLI life easier. (That’s why developers’ filenames are full of underscores.)

Wall 4. The wildcard selects more (or fewer) files than I expected

When you can’t be certain of the range * will catch, select first before deleting or overwriting: ls *.txt. That list is exactly what will be acted on. Drill the order "verify selection → act" into your body.

Wall 5. I moved something with Move-Item and panicked because the original was gone

It’s normal for a move to remove the original. If you wanted the original kept, that was a job for copy (Copy-Item). If you forgot where you moved it, don’t run ls all over the place — press ↑ to see the command you just typed. The destination is written right there.

---

7. Summary

Commands You Learned Today

Command	What it does	Example
New-Item	Create a file/folder	New-Item a.txt, New-Item -ItemType Directory dir
Set-Content	Write content (overwrites)	Set-Content a.txt "text"
Add-Content	Append content	Add-Content a.txt "text"
Get-Content	Read content	Get-Content a.txt
Copy-Item	Copy (original stays, overwrites same names)	Copy-Item *.txt backup
Move-Item	Move/rename (original disappears)	Move-Item a.txt backupb.txt
Remove-Item	Delete (no Recycle Bin)	Remove-Item *.log -WhatIf

Key Concepts

Concept	One-line summary
Extension	A tag for the file type. Always keep it visible
Wildcard *	"Any characters" — the weapon of conditional selection
-WhatIf	Pre-run simulation. The seatbelt of deletion
-Recurse	The whole folder at once (including children)

Instincts That Matter More Than Commands

"Look before you delete, then delete after looking." And "analyze the copy; preserve the original." These two sentences go beyond file manipulation — they’re iron rules of incident response.

One nice-to-know: even files deleted with Remove-Item leave traces on the disk that recovery tools can resurrect. That’s why forensic investigators count "recovering deleted files" as a key skill — and conversely, when you truly need a sensitive file gone, you use a wiping tool that overwrites it multiple times. "What is deletion, really?" gets a deep dive in Level 3 forensics.

---

Once every box is checked, Step 2 is complete.