MACTIME(1)

✨ NAME ✨

mactime — bestie, it creates an ASCII time line of file activity 🕰️💖

So real talk, this is the section 1 page of the General Commands Manual, and it's literally just here to help you build a lil timeline of everything that happened to your files. Obsessed.

---

🦋 SYNOPSIS 🦋

mactime [-b body ] [-g group file ] [-p password file ] [-i (day|hour)
index file ] [-dhmVy] [-z TIME_ZONE ] [DATE_RANGE]

---

🌸 DESCRIPTION 🌸

okay so mactime creates an ASCII time line of file activity. Where does it get the tea? Either from the body file you hand it with -b, or straight from STDIN. And where does the time line go? To STDOUT, obviously. 💅

And the body file has to be in the time machine format, which is the format that gets made by ils -m, fls -m, or the mac-robber tool. No other format, no exceptions, periodt.

---

🎀 ARGUMENTS 🎀

• -b body — tell it where the body file lives. That file has to be generated by a tool like fls -m or ils -m. The mac-robber and grave-robber tools can also be used to generate the file. ✨
• -g group file — point it at the group file. If you give it this, mactime will display the group name instead of the GID. slay.
• -p password file — point it at the passwd file. If you give it this, mactime will display the user name instead of the UID. 🫶
• -i day|hour index file — tell it where to write an index file. The first argument is the granularity — either an hourly summary or a daily one. And heads up: if the -d flag is given, then the summary will be separated by a , so you can import it into a spread sheet. 🍓
• -d — display the timeline and index files in comma delimited format. This is what you use to import the data into a spread sheet for presentations or graphs. it's giving data girlie 📊
• -h — display header info about the session, including time range, input source, and passwd or group files. the receipts, basically. 🧾
• -V — display version to STDOUT. 💫
• -m — the month is given as a number instead of a name. > lowkey important: this does not work with -y. 😭
• -y — the date is displayed in ISO8601 format. iconic format, no notes. ⭐
• -z TIME_ZONE — the timezone from where the data was collected. The name of this argument is system dependent (examples include EST5EDT, GMT+1). > also does not work with -y. 💀
• -z list — list valid timezones. yes pls, give us the menu. 🌈
• DATE_RANGE — the range of dates you want the time line for. The standard format is yyyy-mm-dd for a starting date and no ending date. For an ending date, use yyyy-mm-dd..yyyy-mm-dd. And a date can contain time — use the format yyyy-mm-ddThh:mm:ss for starting and/or ending date. 🗓️✨

---

💜 LICENSE 💜

The changes from mactime in TCT and mac-daddy are distributed under the Common Public License, found in the cpl1.0.txt file in the The Sleuth Kit licenses directory. legal girlies rise 🫡

---

👑 HISTORY 👑

A version of mactime first appeared in The Coroner's Toolkit (TCT) (Dan Farmer) and later mac-daddy (Rob Lee). a true legend with a glow-up arc. 🌟

---

🧚 AUTHOR 🧚

Brian Carrier <carrier at sleuthkit dot org>

Send documentation updates to <doc-updates at sleuthkit dot org>

---

and that's the whole page, bestie 💖 the footer at the very bottom just says MACTIME(1) — no extra sauce, just the manual name holding it down at the end. k bye, go build a timeline 💅🌸