MAC-ROBBER(1)

👑 mac-robber — the manual page, but make it slay

okay bestie, so this is mac-robber, manual section 1, and the whole vibe is "collects data about allocated files in mounted filesystems" ✨ like that's literally the tagline, no cap.

---

🌸 NAME

mac-robber — collects data about allocated files in mounted filesystems 💖

---

🎀 SYNOPSIS

mac-robber [OPTION]
mac-robber <DIRECTORY>

---

🦋 DESCRIPTION

So mac-robber is a digital investigation tool (aka digital forensics, iykyk) and what it does is collect metadata from allocated files in a mounted filesystem. Obsessed honestly. 💅

This is super useful during incident response when you're analyzing a live system, or when you're analyzing a dead system in a lab. And then — plot twist — that data can be used by the mactime tool in The Sleuth Kit (TSK or SleuthKit only, bestie, only those) to make a timeline of file activity. And fun fact: mac-robber is based on the grave-robber tool from TCT (The Coroners Toolkit). Iconic lineage. 👑

Now here's the thing that matters: mac-robber requires that the filesystem be mounted by the operating system, unlike the tools in The Sleuth Kit that process the filesystem themselves. So because of that:

• mac-robber will not collect data from deleted files 😭
• and it will not collect data from files that have been hidden by rootkits 🙈

⚠️ Also important: mac-robber will modify the Access times on directories that are mounted with write permissions. So when you're doing forensics analysis you should mount the target partition as read-only. Periodt.

When is it the main character though? When you're dealing with a filesystem that isn't supported by The Sleuth Kit or other filesystem analysis tools. You can run mac-robber on an obscure, suspect UNIX filesystem that has been mounted read-only on a trusted system. Chef's kiss. 🧚

---

✨ OPTIONS ✨

• -h — Print help. (bestie said "help me" and it did 💖)
• -V — Show the version. (vibe check the build 🌈)

---

🔥 EXAMPLE

To see metadata from all files in a directory (recursively):

$ mac-robber /home/user/directory

To make a timeline using mactime command from The Sleuth Kit (TSK) and setting Brazilian timezone:

$ mac-robber /home/user/directory | mactime -z BRT

An alternative is write the results into a file and read it using mactime:

$ mac-robber /home/user/directory > /tmp/files.mr
$ mactime -b /tmp/files.mr -z BRT

---

💜 AUTHOR

The Sleuth Kit was written by Brian Carrier <carrier@sleuthkit.org>.

This manual page was written by Joao Eriberto Mota Filho <eriberto@debian.org> for the Debian project (but may be used by others).

---

🫶 SEE ALSO

...okay technically the original doesn't have a SEE ALSO section, so there's nothing to list here, don't come for me 😭 the mactime tool in The Sleuth Kit is mentioned up in DESCRIPTION and in the EXAMPLE section, that's the reference bestie, that's the whole thing 💀

---

that's the page, you're welcome, go collect some metadata and be the main character of incident response 🎀

mac-robber-1.02 — 16 Mai 2013 ⭐

mwah 💅