VULHUB ™

Mac-robber is a forensics and incident response program that collects Modified, Access, and Change (MAC) times from files. Its output can be used as input to the 'mactime' tool in The @stake Sleuth Kit (TASK) to make a time line of file activity. mac-robber is similar to running the 'grave-robber' tool from The Coroner's Toolkit with the '-m' flag, except this is written in C and not Perl.

Mac-robber is a forensics and incident response program that collects Modified, Access, and Change (MAC) times from files. Its output can be used as input to the 'mactime' tool in The @stake Sleuth Kit (TASK) to make a time line of file activity. mac-robber is similar to running the 'grave-robber' tool from The Coroner's Toolkit with the '-m' flag, except this is written in C and not Perl.