NAME
mactime - an mtime, atime, and ctime reporter
SYNOPSIS
mactime [ -DfhlnRsty [ -d directory ] [ -g group ] [ -p passwd ] [ -u
user ] [ -b bodyfile ] time1 [ -time2 ]
DESCRIPTION
mactime is a program that attempts to determine what files were
accessed or modified within a given time frame. The information is
either calculated on the fly (with the -d flag) or taken from an
already calculated database; see the program grave-robber)
Format of the time is typically month/date/year - e.g. 4/5/2009. It
requires a full four digit year, and the date must be after 1/1/1970.
Time2 is a date that should be after time1; it makes the program look
for dates in this range.
OPTIONS
-b file use this file as an alternate "body" file (the file that has
all the information about the file system), instead of what is
configured in coroner.cf.
-d directory. Scans and reports on this directory instead of
using the existing database; e.g. does NOT use the existing
body database file.
-D debugging flag. Lots and lots of output. You don’t want this!
-f filename
flag files listed in file as a different color (HTML only).
-g group
uses an alternate group file for printing groups.
-h emit some simple HTML stuff rather than plain ASCII text.
-l takes "last" output, sort of, as a time. Last looks like:
zen ttyp2 random.trouble.o Sat Mar 21 16:24 -
11:43 (19:19)
This program wants everything from the date on; in this
case, the: "Sat Mar 21 16:24 - 11:43 (19:19)" bit. Note
that it calculates the time the user was on from the
parenthesized time, not the time after the "-", which
doesn’t do multiple days, etc. very well. It doesn’t
understand certain things like "still logged in":
zen ftp 208.197.253.142 Sun Mar 22 13:49
still logged in
And other valid last entries from last(1).
-n takes normal "date" output, which looks something like:
"Tue Apr 7 17:20:43 PDT 1998"
-p passwd
uses an alternate password file for printing uids.
-R recursively go through subdirectories (only useful with the -d
flag)
-s flag SUID/SGID files as a different color (HTML only).
-t output in time machine format
-y Print year first to avoid euro/US data ambiguity - normally
stuff is MM/DD/YYYY, this does YYYY/MM/DD.
-u user flag files owned by user as a different color (HTML only).
FILES
coroner.cf - some global TCT defaults and configuration details (is
perl executable code).
SEE ALSO
grave-robber(1), stat(2V)
LICENSE
Distributed under the details found in the COPYRIGHT file found in the
root directory of The Coroner’s Toolkit.
AUTHOR(S)
dan farmer
zen@fish.com
EarthLink