Content-type: text/html
Manpage of MACTIME
MACTIME
Section: User Commands (1)
Index
Return to Main Contents
NAME
mactime - an mtime, atime, and ctime reporter
SYNOPSIS
mactime
[
-DfhlnRsty
[
-d directory
]
[
-g group
]
[
-p passwd
]
[
-u user
]
[
-b bodyfile
]
time1
[
-time2
]
DESCRIPTION
mactime
is a program that attempts to determine what files
were accessed or modified within a given time frame.
The information is either calculated on the fly (with the
-d flag) or taken from an already calculated database; see
the program
grave-robber)
Format of the time is typically month/date/year - e.g. 4/5/2009.
It requires a full four digit year, and the date must be after 1/1/1970.
Time2
is a date that should be after
time1;
it makes the program look for dates in this range.
OPTIONS
- -b file
-
use this file as an alternate "body" file (the file that
has all the information about the file system), instead of what
is configured in coroner.cf.
- -d
-
directory. Scans and reports on this directory instead of using the
existing database; e.g. does NOT use the existing body database file.
- -D
-
debugging flag. Lots and lots of output. You don't want this!
- -f filename
-
flag files listed in file as a different color (HTML only).
- -g group
-
uses an alternate group file for printing groups.
- -h
-
emit some simple HTML stuff rather than plain ASCII text.
- -l
-
takes "last" output, sort of, as a time. Last looks like:
zen ttyp2 random.trouble.o Sat Mar 21 16:24 - 11:43 (19:19)
This program wants everything from the date on; in this case, the:
"Sat Mar 21 16:24 - 11:43 (19:19)" bit. Note that it calculates
the time the user was on from the parenthesized time, not the time
after the "-", which doesn't do multiple days, etc. very well.
It doesn't understand certain things like "still logged in":
zen ftp 208.197.253.142 Sun Mar 22 13:49 still logged in
And other valid last entries from last(1).
- -n
-
takes normal "date" output, which looks something like:
"Tue Apr 7 17:20:43 PDT 1998"
- -p passwd
-
uses an alternate password file for printing uids.
- -R
-
recursively go through subdirectories (only useful with the -d flag)
- -s
-
flag SUID/SGID files as a different color (HTML only).
- -t
-
output in time machine format
- -y
-
Print year first to avoid euro/US data ambiguity - normally stuff
is MM/DD/YYYY, this does YYYY/MM/DD.
- -u user
-
flag files owned by user as a different color (HTML only).
FILES
coroner.cf
- some global TCT defaults and configuration details
(is perl executable code).
SEE ALSO
grave-robber(1),
stat(2V)
LICENSE
Distributed under the details found in the
COPYRIGHT
file found in the root directory of The Coroner's Toolkit.
AUTHOR(S)
dan farmer
zen@fish.com
EarthLink
Index
- NAME
-
- SYNOPSIS
-
- DESCRIPTION
-
- OPTIONS
-
- FILES
-
- SEE ALSO
-
- LICENSE
-
- AUTHOR(S)
-
This document was created by
man2html,
using the manual pages.
Time: 01:01:08 GMT, August 19, 2000