A data capturing tool, most commonly used to gather i-node information for use by mactime. Information available in i-nodes (as shown by Linux stat command) is:
File: "/dev" Size: 35840 Filetype: Directory Mode: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Device: 3,3 Inode: 4097 Links: 6 Access: Fri Jul 14 17:01:00 2000(00000.05:31:03) Modify: Wed Jul 12 21:20:44 2000(00002.01:11:19) Change: Wed Jul 12 21:20:44 2000(00002.01:11:19)
Tools for recovery of deleted file space and for processing this (or other, e.g., RAM or swap space) memory to attempt to identify and recover lost or hidden data:
A program for time-ordering files/directories in the file system based on modification, access, and change ("MAC" for short) i-node time stamps
Feb 13 2000 01:10:50 50148 mca -rwxr-xr-x root root /x/dev/. Feb 13 2000 01:10:52 564 m.c -rw-r--r-- root root /x/etc/profile Feb 13 2000 01:11:00 5 mac -rw-r--r-- root root /x/lib/sp 18110 .a. -rw-r--r-- root root /x/lib/tp Feb 13 2000 01:12:08 0 ..c -rw-r--r-- root root /x/dev/ttyag 25 ..c -rwxr-xr-x root root /x/dev/ttyfg 23 ..c -rwxr-xr-x root root /x/dev/ttypg 373176 ..c -rws--x--x root root /x/lib/... 8268 ..c -rwxr-xr-x root root /x/lib/go 20164 ..c -rwsr-xr-x root root /x/usr/bin/xcat 183780 ..c -rwxr-xr-x root root /x/usr/sbin/find Feb 13 2000 01:30:00 8268 .a. -rwxr-xr-x root root /x/lib/go Feb 14 2000 10:42:03 1166856 .a. -rw-r--r-- root root /x/var/log/boot.log Feb 14 2000 10:45:35 18110 m.c -rw-r--r-- root root /x/lib/tp Feb 14 2000 10:57:42 2998 m.c -rw-r--r-- root root /x/etc/inetd.conf~ Feb 14 2000 11:18:38 160 m.c -rw-r--r-- root root /x/etc/hosts.allow.old Feb 14 2000 11:18:55 347 m.c -rw-r--r-- root root /x/etc/hosts.deny.old Feb 14 2000 11:19:08 8 m.c -rw-r--r-- root root /x/etc/hosts.deny Feb 14 2000 11:30:30 2998 .a. -rw-r--r-- root root /x/etc/inetd.conf~