Computer Forensics and Data Analysis
Software Training Services  

Maresware Programs T through Z

Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |

All programs are command line programs.
MUST be run within a command window as administrator.

Reminder, The software is now free, and (generally) UNSUPPORTED.

Total fields in a file

Be sure to check the help file for additional information about this program.

Total performs several useful functions. Use it to: total fields in succeeding records which have the same sort key; total an entire file on one field; count occurrences of records containing the same sort key; total a common field throughout the entire file.

 |  Get the executable  |  View the html help file.  | 

Provides a way of correctly recording CMOS and real time

Be sure to check the help file for additional information about this program.

This program will ask the operator to input correct date, time and timezone. Then it will obtain the current computer time as recorded in the CMOS setup, and echo the information to the screen.

By redirecting (>) to an output file, the user can capture and record this for future reference.

 |  Get the .exe  | 
 |  View the html help file.  | 

Convert Linux Text to DOS text, or DOS to Linux

Be sure to check the help file for additional information about this program.

This program will take a text file that was created either on a Linux system or on a DOS system, and convert the carriage returns to the other operating system format. Linux carriage returns are 0x0a, and DOS are 0x0d0x0a.

 |  Get the 32bit .exe  | 
 |  View the html help file.  | 

Eliminate duplicate records in a file

Be sure to check the help file for additional information about this program.

This program will take a sorted input file and copy records to the output for which it finds a unique occurrence of the sort key.

The program passes the input file, and when it finds a new/unique sort key in a record it copies that record to the output, and disregards all subsequent records that contain that same sort key. Therefore, only a single record per sort key is copied to the output file.

 |  Get the executable  |  View the html help file.  | 

Reverses operation of split
See the Maresware Split program.

Be sure to check the help file for additional information about this program.

 |  View the html help file.  | 


Performs an "intelligent" file COPY operation and is an excellent forensics and eDiscovery file copy tool.

Be sure to check the help file for additional information about this program.

Upcopy works a lot like ROBOCOPY and XCOPY except that is has many more options. And because it is a command line tool, it allows you to literally program its operation.

Upcopy can copy entire paths (drives) from one location to another while maintaining tree structure and file attributes. You can specify specific file type, file ages, sizes, and files to exclude from the copy process. The 32 bit version also maintains long (>255 characters up to 32000 characters) filenames.

Upcopy can perform hash of the files (source and destination), maintains ALL three source dates and can maintain the dates on destination directories, as well as maintaining (creating) empty directories.

Upcopy (as of January 2009), can also process a mounted Shadow Copy File.

See the FAQ page for some very unusual and unique things you can do with Upcopy.

 |  Get the 16bit .exe  |  Get the 32-bit .exe  |  Get the 64-bit .exe
 |  View the html help file.  | 


Performs a "keyword" search of files (and image files) to find email addresses, IP numbers and domain names.

The URL_SRCH program is designed to search files and produce a fixed length output record which contains the filename, location in the file, surrounding text, and the item itself. It can search for IP addresses (nnn.nnn.nnn.nnn), email addresses (, and domain names (

By default it produces output containing all three format type hits. But with command line options it can look for any one type, two, or all three. Its output is similar to the strsrch program and it can delimit the fields for import to spreadsheets. It cannot be programmed to search for specific values. Although once the output is availalbe, other means such as grep or the search program can eliminate eroneous items.

Use the command: url_srch -? to get a list of all the available options.

 |  Get the 32-bit .exe  |  View the help file  | 


Converts tab delimeted records to multi line records

This program takes tab delimeted records in files like those exported from X-Ways export list and converts each record field to a seperate line by itself. Easier to import into a report rather than a spreasheet type layout.

 |  Get the 32-bit .exe  |  Get sample batch and data  |  View the help file  | 


Mounts Volume Shadow Copies as drive letters.

The VSS program is designed to allow you to mount as a drive letter, the Volume Shadow copy.

By default it mounts a single drive letter. But has capability to mount more than one at the same time.

 |  Get the 32-bit .exe  |  View the help file  | 


X-Ways Metadata
Takes a tab delimited X-Ways export and parses out a specified field from the metadata field.

The "Export List" processing executable name is X-Ways_Meta_Processing.exe
The report html processing executable name is X-Ways_Report_Process.exe

This has two versions.
One version works ONLY on the tab delimited files created by the X-Ways "Export List" operations.
The other version works ONLY on the X-Ways html report to seperate the Metadata items to seperate lines, and select only those fields needed for the output.

The X-Ways exported metadata fields are actually a field which itself contains semi-colon (;) delimited fields. These fields are the individual items extracted from within the various files' metadata. Some important key fields might be the "Last Printed:" date, Exif, Digitized data, or other fields such as Author, Number of edits, etc.

Loading this metadata field into Excel and trying to parse out a specific sub-field (Last Printed, etc), is a time consuming task. This program, will take the X-Ways tab delimited file, and parse the metadata field into its sub-fields, and create a new field containing the "user selected" sub-field. That new field can now easily be imported into Excel.

When dealing with the X-Ways report.html file, the Metadata: item may contain many sub-fields which are either needed, or can be ignored. But viewing the Metadata field within the html report is cumbersome. The report version of this program, allows the user to select which sub-fields will be isolated and printed in the modified html output file.

This program has been tried on Exif, Link, Office and email metadata. It appears to work consistantly along all the metadata items providing the metadata field is consistantly formatted as semi-colon delimited subfields. The one caveat is that X-Ways allows carriage returns to be embedded within this metadata field. Thus when importing the data file into Excel, these embedded carriage returns cause havoc with the Excel parsing process. With the latest version of this program, these embedded carriage returns are converted to spaces, thus eliminating a lot of the Excel parsing problems.

As of April 2013, there is another X-Ways "filter" program called: X-Ways_ID.exe. The program is designed to take the "TAB" delimeted file created by X-ways "export list" operation and rename the files that were exported by X-Ways using the recover option. The renaming of each "recovered" file uses "user selected" fields within the export list to "add" items to the recovered filename. This additional item may be the Internal ID, or Evidence object field within the export list. Thus the renaming by adding a unique field to the filename may make a reviewers job of identifying the source of the file, a little easier.

If you think you would like to test out this files capability to "rename" files, send me a request, and an explanation of what you expect it to accomplish.

As of April 2013, I have created a batch file script which uses the sed.exe program, and the Maresware no_html program to convert the X-Ways copylog.html to a usable pipe (|) delimited file which can be imported into Excel. Once in Excel, you can add another column with a sequential number, or other information for the reviewers needs.

 |  View the html help file.  |  Get the executable  |  |  Get the report executable  |  |  Get the X-Ways_ID executable


Home  |  Whats New  |  How to Order  |  Training  |  Services  |
About Us  |  FAQs  |  Articles  |  Resources  |  Legal Notices  |  Contact Us  |
Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |
copyright 1998-2016 by Mares and Company, LLC