Mactime

Back to Help Documents

mactime

Version 2.09

Purpose

Creates an ASCII time line of file activity based on the body file specified by ’-b’ or from STDIN. The time line is written to STDOUT. The body file must be in the time machine format that is created by unknown missing text.

Usage

mactime  [-b body ] [-g group file ] [-p password file ] [-i (day|hour) index file ] [-dhmVy] [-z TIME_ZONE ] [DATE_RANGE]

Options

Switch	Purpose
-b body	Specify the location of a body file. This file must be generated by a tool such as ’fls -m’ or ’ils -m’. The ’mac-robber’ and ’grave-robber’ tools can also be used to generate the file.
-g group file	Specify the location of the group file. mactime will display the group name instead of the GID if this is given.
-p password file	Specify the location of the passwd file. mactime will display the user name instead of the UID of this is given.
hour index file	Specify the location of an index file to write to. The first argument specifies the granularity, either an hourly summary or daily. If the import into a spread sheet.
-d	Display timeline and index files in comma delimited format. This is used to import the data into a spread sheet for presentations or graphs.
-h	Display header info about the session including time range, input source, and passwd or group files.
-V	Display version to STDOUT.
-m	The month is given as a number instead of name.
-y	The date range is given with the year first.
-z TIME_ZONE	The timezone from where the data was collected. The name of this argument is system dependent (examples include EST5EDT, GMT+1).
DATE_RANGE	The range of dates to make the time line for. The standard format is 01/01/2002 for a starting date and no ending date. For an ending date, use 01/01/2002-02/01/2002.

Example

No example provided.

License

The changes from mactime in TCT and mac-daddy are distributed under the Common Public License, found on the Licenses page.

History

A version of mactime first appeared in The Coroner’s Toolkit (TCT) (Dan Farmer) and later mac-daddy (Rob Lee).

Author

Brian Carrier <carrier@sleuthkit.org>