Computer Forensics and Data Analysis
Software Training Services  
      Search:
Maresware Programs D through F

Includes: Dateconv / Dater / Decimal2IP / Diskcat / EML_Process / Eventlog / Filbreak / Filsplit / Findrecl

Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |

All programs are command line programs.
MUST be run within a command window as administrator.

Reminder, The software is now free, and (generally) UNSUPPORTED.

Dateconv

Be sure to check the help file for additional information about this program.

Is a simple program used to convert the long value of a date (ie 912345678) to a traditional month day year, date format.

It provides the time in GMT (UTC), and local time. It also displays a timezone, if one is set on the computer.

Current version with the -I option will process iPhone dates.

If you download the test files, remember that the format you see the date in may not be the same format that you find in the forensic data. For instance, a 64 bit value may also be found in its hex or decimal format, and you should check to confirm which format the date you are converting is in. Especially when using the UNIX variants. They come in both little and big endian, and simple decimal. Depending on the source of the date.

 |  Get the 32bit .exe file  |  Get some sample files  |  View the html help file.  | 
Top

Dater
Quickly adds a calendar program to the screen.

Be sure to check the help file for additional information about this program.

A simple program to place the date, time and calendar on the screen. It can also create the date and time in single string format to be sent to programs for use in determining current date.

Can also interpret and printout Julian dates.

Of course, the 32 bit version is more verbose than the 16 bit free version.

 |  Get the 16bit .exe file  |  Get the 32bit .exe file  |  View the html help file.  | 
Top

Decimal2IP
Convert decimal value to IP octet.

A simple program to convert a file containing decimal IP values to the traditional octet IP value. The program takes text file as input.

 |  Get the program  |  View the html help file.  | 
Top

Declasfy
Wipe drives according to DOD specifications

This is a 16 bit low level program which is no longer available or practical.

Disable
Disable the computer keyboard on seized evidence computers

No longer available

Diskcat
Catalogs all files on disks

Be sure to check the help file for additional information about this program.

Diskcat is short for "disk cataloguer.' It creates a listing (catalog) of all files and/or directories on a hard or floppy disk. With its many options, the operation can be customized to your needs. It is especially useful for forensic purposes and for file maintenance. Output is a fixed length record and database compatible(for further analysis/sorting.) Among its many capabilities, it can:

  • Create a MD5 of all files.
  • Check the headers of each file based on 4 logical operators(see the [+-hH] options) for match or mismatch.
  • Find files based on:
    • specific dates (date created, modified, or accessed)
    • size
    • name
    • attributes
  • Search for files meeting specific criteria(can be "programmed").
  • Execute "some" DOS command on each identified file.
    • Run pkzip -v on all zip files thus showing the contents of all zip files.
    • Run any user-designed batch file.
    • Delete specified files (based on user-specified date, size, name and or attribute.)
  • Tag each output record with a label specifying which disk contained that file.
  • Identify NTFS encrypted files.
  • Display all file attributes in the listing.
  • Use the -88 option to add the LongFileName to the end of the record.

 |  GET the 16 bit .exe FILE  |  GET the 32 bit .exe  | GET the 64 bit .exe
GET sample command lines  |  sample header file  |  View the html help file.  | 
Top

Diskimag
Forensic copies of diskettes

This is a 16 bit program, no longer available or practical.

Disk Crc
Calculate the 32 bit CRC, MD5, or SHA of a physical disk

This is a 16 bit program, no longer available or practical.

EML_PROCESS
Process/filter eml files to obtain header items

This program takes eml files, and parses the header information identifying key header fields. Those fields are then used to create a record (for each eml file processed) that is delimeted so you can import the data to spreadsheets.

The output can also be sent to Verticle  to reform the fields to seperate lines.

 |  GET the .exe FILE  |  GET sample files and batch  | 
 |  View the html help file.  | 

Top

Eventlog
Clean up NT eventlog output

Be sure to check the help file for additional information about this program.

The text output from NT eventlogs is not easily manipulated or evaluated and is difficult to import into databases. Eventlog will take the output of an NT security eventlog and reformat it to single lines, so it contains pipes for importing into a database or spreadsheet.

The program also creates a "pipefix" parameter file which will give fixed length output. See the description of pipefix for how to create fixed length records.

 |  GET the 32 bit .exe FILE  |  View the html help file.  | 

Top

Filbreak
Reformats the record structure of a file

Be sure to check the help file for additional information about this program.

Filbreak will allow you to select sections of an input record and put them into an output record of a different format. You select fields of the input record, rearrange them, then write them to a new output record formatted to your specifications. Filbreak can also process ebcdic, packed decimal, and signed fields which may show up in files obtained from mainframe COBOL generated data files.

You can use this program to create a data record formatted as if it were a final report. Then use a word processor, or copy the output directly to a printer. Used in conjunction with Maresware's Pagefmt you can create on-the-fly text reports easily, without the use of a data base.

(Many of the Filbreak operations are also available in Maresware's Search program.)

 |  Get the .exe  |  View the html help file.  | 
Top

Filsplit
Split/break a file into pieces

Be sure to check the help file for additional information about this program.

Filsplit allows you to copy a section of records from an input file and place them to an output file. You can select: a chunk of records from within the file; a random sample of every nth record; or a specific number of characters.

The sections thus split can then be used as a sample of the original file to test your processing procedures.

Records are split according to command line options input by the user.

If needed, you can "trick" the program into using a false record size in order to copy the desired number of characters to the output. So, you do not have to use the actual record size, but can specify any number of characters as a record.

 |  Get the .exe  |  Get the 32 bit .exe  |  View the html help file.  | 
Top

Findrecl
Find the record length of fixed length files

Be sure to check the help file for additional information about this program.

Anyone who works with mainframe data knows that there is usually no record delimeter (i.e., carriage return/line feed). That makes working with these files on a PC difficult. Findrecl simplifies the transition by finding the record length of fixed length data files.

This program assumes that the files do not have line/record delimiters. Also, files must not have any padding at the end of the file.

If the files are carriage return delimited, the carriage return will dictate the file size.

 |  GET the .exe  |  View the html help file.  | 

Top

Home  |  Whats New  |  How to Order  |  Training  |  Services  |
About Us  |  FAQs  |  Articles  |  Resources  |  Legal Notices  |  Contact Us  |
Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |
 |  SoftwareData Analysis Software  |  Forensic Processing Software  |  Linux Processing Software  |
 
copyright 1998-2014 by Mares and Company, LLC