Back to Help Documents
mactime is a tool that reads file metadata from a text file and sorts the data to create a time line of file activity can be created. The resulting time line is plain text with several columns. This page describes what each column means. This program was originally created to analyze Unix file systems and therefore some of the columns have little meaning when analyzing a Windows file system.
Columns: Date/Time Size Activity Unix User Group inode File Name (Bytes) Type Permissions Id Id Example: [...] Thu Aug 21 2003 01:20:38 512 m.c -/-rwxrwxrwx 0 0 4 /file1.dat 900 m.c -/-rwxrwxrwx 0 0 8 /file3.dat Thu Aug 21 2003 01:21:36 512 m.c -/-rwxrwxrwx 0 0 12 /_ILE5.DAT (deleted) Thu Aug 21 2003 01:22:56 512 .a. -/-rwxrwxrwx 0 0 4 /file1.dat [...]
The second column is the size of the file (in bytes).
MAC Meaning by File System
|NTFS||File Modified||Accessed||MFT Modified|
Note: Some file systems have additional times that will not be displayed. For example, Ext2/3 has a 'deleted' time that is not displayed and NTFS has a Created time that is not displayed. NTFS also has another set of times that are stored in the $FILE_NAME attribute that are not displayed in the time line. The $FILE_NAME times can be viewed using the istat tool.
User & Group IDs
The seventh column is the "inode" or metadata address of the file.