11 lines
519 B
Text
11 lines
519 B
Text
mac-robber is a Forensics & Incident Response tool used to collect
|
|
the Modified, Access, and Change (MAC) times from allocated files.
|
|
It recursively reads MAC times of files and directories and prints
|
|
them in 'time machine' format to STDOUT. This format is the same
|
|
that the mactime tool from The Coroners Toolkit (TCT) reads.
|
|
|
|
mac-robber is based on the grave-robber tool from The Coroners
|
|
Toolkit (TCT) when using the '-m' flag, except it does not require
|
|
Perl!
|
|
|
|
WWW: http://www.atstake.com/research/tools/forensic/
|