MACTIME(1)

NAME
mactime - an mtime, atime, and ctime reporter

SYNOPSIS
mactime [ -dl ] [ -g group ] [ -p passwd ] [ -b bodyfile ] time1 [ time2 ]

DESCRIPTION
mactime is a program that attempts to determine what files (taken from an already calculated database; see the file body and the program grave-rob) were accessed or modified within a given time frame.

Format of the time is typically date/month/year - e.g. 4/5/1982. It requires a full four digit year (for Y2K ;-))

Time2 is a date that should be after time1; it makes the program look for dates in this range. This defaults to the current time if not specified.

OPTIONS

-b file
    use this file as an alternate "body" file (the file that has all the information about the file system), instead of what is configured in coroner.cf.

-d  debugging flag. Lots and lots of output. You don't want this!

-f filename
    flag files listed in file as a different color (HTML only).

-g  uses an alternate group file for printing groups.

-h  emit some simple HTML stuff rather than plain ASCII text.

-l  takes "last" output, sort of, as a time. Last looks like:
        zen ttyp2 random.trouble.o Sat Mar 21 16:24 - 11:43 (19:19)
        This program wants everything from the date on; in this case, the:
        "Sat Mar 21 16:24 - 11:43 (19:19)" bit. Note that it calculates
        the time the user was on from the parenthesized time, not the time
        after the "-", which doesn't do multiple days, etc. very well.
        It doesn't handle certain things well, like "still logged in":
        zen ftp 208.197.253.142 Sun Mar 22 13:49 still logged in
        And other valid last entries.

-n  takes normal "date" output, which looks something like:
        "Tue Apr 7 17:20:43 PDT 1998"

-p  uses an alternate password file for printing uids.

-s  flag SUID/SGID files as a different color (HTML only).

-u user
    flag files owned by user as a different color (HTML only).

SEE ALSO
grave-robber(1), stat(2V)

LICENSE
Distributed under the details found in the COPYRIGHT file found in the root directory of The Coroner's Toolkit.

AUTHOR(S)
dan farmer
zen@fish.com
EarthLink Network, Inc.