Computer Forensics and Data Analysis
Software Training Services  
      Search:

Maresware Programs L through O

Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |

All programs are command line programs.
MUST be run within a command window as administrator.

Reminder, The software is now free, and (generally) UNSUPPORTED.

Lfn_Crc
Find the long filename Checksum of the corresponding 8.3 DOS name

Be sure to check the help file for additional information about this program.

When long filenames are deleted in Windows, there remain remnants of the 8.3 filename in the directory. When undeleting the long filename it must match the original exactly; otherwise, an internal checksum won't match and the file won't be displayed.

To confirm that the 8.3 filename and the internal checksum stored for the long filename are correct, use Lfn-crc to calculate what the checksum should be.

 |  Get lfn_crc.exe  | 
 |  View the html help file.  | 
Top

Mak_html
Make an html index.htm file listing of folders

This program will take a path/tree/folder as a starting location and create an output html file (usually index.htm) with links to all the files it locates within the specified folder.

The output is then generally used to supply to someone with a browser, and they will use this file as a starting point to browse/view the files identified.

Its output of a default index.htm file can be used to include it as a link in a report document, which a user can click on, and then have links to all the files which may be associated as exhibits in a report.

 |  Get mak_html.exe  | 
 |  View the html help file.  | 
Top

Makedir
Make directories

Be sure to check the help file for additional information about this program.

Makedir is a very efficient alternative to the MD program. It will make multiple subdirectories based on command line input. It will make any and all subdirectories up to and including the final subdirectory listed on the command line.

It can also make multiple subdirectories in different locations based on just one command line input.

 |  Get the program  | 
 |  View the html help file.  | 
Top

Md5
Calculate the 128 bit MD5 hash of a file

Be sure to check the help file for additional information about this program.

Md5 is designed to quickly calculate the MD5 hash value of a file. The advantage of Maresware's Md5 is that it adds formatting capability to the standard output produced by MD5sum. It can also calculate a 32 bit CRC or 160 bit SHA value.

A special time limited version (currently expires 5/2006) is available that will allow the user to perform hashes on only a section of a file. This is becomming more and more popular with those verifying video and other multimedia files. If this capability proves useful, it will be incorporated into the full version.

Historically, the MD5 algorithm has been used to "fingerprint" files. No two files will ever produce the same fingerprint unless they are identical. According to R. Rivest in his 1992 article:

The algorithm takes as input a message of arbitrary length and produces as output a 128-bit "fingerprint" or "message digest" of the input. It is conjectured that it is computationally infeasible to produce two messages having the same message digest, or to produce any message having a given prespecified target message digest. [Find Rivest's article on the Internet by searching the World Wide Web for MD5.]

CERT at Carnegie Mellon University uses an MD5 signature to validate sensitive data sent out over the Internet. When information is distributed with the MD5 signature value, the MD5 program can be used to validate the integrity of the data.

NOTE: The MD5 algorithm is also used in Maresware's Hash program. It provides more information and is more flexible, allowing customized output.

 |  GET the 16 bit .exe  |  GET the 32 bit .exe  | 
 |  View the html help file.  | 
GET the (time limited) modified 32 bit version that does partial hashes  | 
Top

Md5_verify
Calculate the 128 bit MD5 of a "set" of dd output files

This program is similar to the Windows verion named sha_verify. It can take a set of files with a sequential extension (.000, .001, .002 etc) and perform MD5 or SHA1 on the files as if they were a single file. In effect it "merges" the content of hte files when performing the calculaton.

This is important when trying to confirm that the outputs from a dd, dcfldd, or ntimage program have produced the correct outputs.

 |  GET the LInux program  | 

 |  View the html help file.  | 
Top

Mdir
An "intelligent" alternative to DIR

Be sure to check the help file for additional information about this program.

Mdir gives the user the look and feel of the DOS DIR program but it is designed to facilitate forensic work. It provides more information and greater flexibility in programming the types of files displayed on the screen.

The 32 bit version can also display the 3 file time types generated by WIN95 and WINNT file systems. Under NTFS it can show instances of Multiple Data Streams.

 |  Get the 16 bit .exe  |  GET the 32 bit .exe  | 
 |  View the html help file.  | 
Top

Mktemp

(this is a free program). Mktemp can be used to create sample test (temporary) files. The files it creates are of known size and content. This is useful when testing software operation on known entities.

The program is capable of creating a number of subdirectories in a tree structure also.

 |  Get the .exe  | 
 |  html help file not available.  | 
TOP

Modify
Change a file's attributes

Be sure to check the help file for additional information about this program.

Modify/change file attributes (takes the place of the DOS attrib command.)

The program can change the attributes of files with a simpler command structure than the DOS attrib command. It allows you to change the following: hidden; read/write; archive; and system attributes.

 |  Get the .exe  |  Get the 32-64bit.exe  | 
 |  View the html help file.  | 
Top

Mouse
Display fixed length records on the screen

Be sure to check the help file for additional information about this program.

Mouse is designed to work on files which have fixed length records and do not have the traditional Carriage Return / Line Feed characters. (CR/LF). It will display the file on the screen based on the length input by the user. It can also be used to add returns to text files and redirect output to a new file with these returns in it.

Mouse was named as an alternative to the *ix cat command which displays a file contents to the screen.

 |  Get the .exe  | 
 |  View the html help file.  | 
Top

Nist_crc

Nist_crc is a program compiled from (slightly modified) source code obtained from the NIST/NSRL web site. The program will compute the CRC, MD4, MD5, and SHA1 of a file. However, the Maresware program Sha_verify is a little more robust than this one.

 |  Get NIST_Crc  | 
Top

No_html

No_html is a program designed to take an input file containing html or xml code (tags) and remove them from the file. Often during forensics or e-discovery file data is carved or identified which contains html or xml code. Review of these files is difficult because of the embedded coding. This program takes those files and creates a new output file with a ttx extension which contains the clear text of the source file with the tags removed.

 |  Get NO_HTML  |  View the help file  | 
Top

Ntimage

This is a 16 bit program, no longer available or practical.

Nt_ss

Be sure to check the help file for additional information about this program.

The Nt_ss program is designed to run under an NT type operating system (XP, W2K, NT) and do one or many simultaneous string searches on a physical drive at the sector level.

Other capabilities are:

  • search for a large number of search strings with or no performance hit.
  • confirm a drive has been wiped with a single character.
  • create an output file that is fixed in length for import into a spreadsheed.
  • search for file headers indicating possible recovery of files in freespace.
Get nt_ss.exe

Top

Ntwipe

This is a 16 bit program, no longer available or practical.

Top

Home  |  Whats New  |  How to Order  |  Training  |  Services  |
About Us  |  FAQs  |  Articles  |  Resources  |  Legal Notices  |  Contact Us  |
Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |
 |  SoftwareData Analysis Software  |  Forensic Processing Software  |  Linux Processing Software  |
Complete helpfile.zip  | Complete pdf_s.zip  | Complete 16 bit software.zip  | Complete 32 bit software.zip  |
 
copyright © 1998-2016 by Mares and Company, LLC