Solved

The Sleuth Kit MACtimes for Windows?

Posted on 2010-11-08
4
679 Views
Last Modified: 2013-12-17
Hi there! I am new to the sleuth kit for forensics purposes. I have recently downloaded the sleuth kit for windows and have read through the wiki page for the kit.

However I could not find the MACtimes.pl script to translate the .fls files to a readable timeline format. Could someone please tell me how to get and run the MACtimes script for windows?

Is the perl script included with the downlaoded package? If so please tell me which program it is. Are there any other ways to generate MACtimes too? Thanks!
0
Comment
Question by:VMthinker
  • 3
4 Comments
 
LVL 8

Expert Comment

by:guvera
ID: 34090962
Hi,
 
  Better to find the below link in the experts exchange

http://www.experts-exchange.com/Programming/Languages/C/Q_26591489.html

It may same as your scenario. I am not sure that this is right. But it may be helpful.Please check it
0
 
LVL 2

Author Comment

by:VMthinker
ID: 34108981
The link you showed me was also created by me....
0
 
LVL 2

Accepted Solution

by:
VMthinker earned 0 total points
ID: 34108989
The solution to the question is simple actually just found out recently...
1) Download Sleuth kit from website (windows)
2) Locate MACtimes.pl from zip file.
3) Install perl on computer.
4) Run the command on cmd "perl mactime.pl......."
0
 
LVL 2

Author Closing Comment

by:VMthinker
ID: 34134757
Mislooked at the Linux and windows version.
0

Featured Post

How Do You Stack Up Against Your Peers?

With today’s modern enterprise so dependent on digital infrastructures, the impact of major incidents has increased dramatically. Grab the report now to gain insight into how your organization ranks against your peers and learn best-in-class strategies to resolve incidents.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The foremost challenge encountered by an investigator at the very beginning of a forensics investigation is, accessing a file/data to read/view its contents. Owing to the fact, a platform is necessary for both; opening as well as examining any file.…
When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

791 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question