Ubuntu
mac-robber package

mac-robber 1.02-2 source package in Ubuntu

Changelog

mac-robber (1.02-2) unstable; urgency=low


  * debian/control: fixed the Vcs-Browser field.
  * debian/rules: disabled the DH_VERBOSE option.

 -- Joao Eriberto Mota Filho <email address hidden>  Thu, 17 Oct 2013 15:34:27 +0000

Upload details

Uploaded by:
Debian Forensics
Uploaded to:
Sid
Original maintainer:
Debian Forensics
Architectures:
any
Section:
misc
Urgency:
Low Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Trusty release universe misc

Downloads

File Size SHA-256 Checksum
mac-robber_1.02-2.dsc 1.5 KiB 0b12866bf948229f967430cba18c40d386e9d4cf6b71b064b973326176e6fb8b
mac-robber_1.02.orig.tar.gz 11.4 KiB 5895d332ec8d87e15f21441c61545b7f68830a2ee2c967d381773bd08504806d
mac-robber_1.02-2.debian.tar.gz 3.1 KiB 9ecebf24d96fbf8504f4d23699917cd31ebe018f872d9809d6e60840f472823a

No changes file available.

Binary packages built by this source

mac-robber: collects data about allocated files in mounted filesystems

 mac-robber is a digital investigation tool (digital forensics) that collects
 metadata from allocated files in a mounted filesystem. This is useful during
 incident response when analyzing a live system or when analyzing a dead
 system in a lab. The data can be used by the mactime tool in The Sleuth Kit
 (TSK or SleuthKit only) to make a timeline of file activity. The mac-robber
 tool is based on the grave-robber tool from TCT (The Coroners Toolkit).
 .
 mac-robber requires that the filesystem be mounted by the operating system,
 unlike the tools in The Sleuth Kit that process the filesystem themselves.
 Therefore, mac-robber will not collect data from deleted files or files that
 have been hidden by rootkits. mac-robber will also modify the Access times
 on directories that are mounted with write permissions.
 .
 mac-robber is useful when dealing with a filesystem that is not supported
 by The Sleuth Kit or other filesystem analysis tools. You can run mac-robber
 on an obscure, suspect UNIX filesystem that has been mounted read-only on a
 trusted system.