mac-robber
Collects data about allocated files in mounted filesystems
Platforms: Linux · Last verified September 6, 2026
mac-robber is a digital investigation tool (digital forensics) that collects metadata from allocated files in a mounted filesystem. This is useful during incident response when analyzing a live system or when analyzing a dead system in a lab. The data can be used by the mactime tool in The Sleuth Kit (TSK or SleuthKit only) to make a timeline of file activity. The mac-robber tool is based on the grave-robber tool from TCT (The Coroners Toolkit).
Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.
Getting started
See the official Kali tool page and upstream homepage linked above for installation and usage details.
