How To Install mac-robber on Ubuntu 18.04
Introduction
In this tutorial we learn how to install mac-robber on Ubuntu 18.04.
What is mac-robber
mac-robber is:
mac-robber is a digital investigation tool (digital forensics) that collects metadata from allocated files in a mounted filesystem. This is useful during incident response when analyzing a live system or when analyzing a dead system in a lab. The data can be used by the mactime tool in The Sleuth Kit (TSK or SleuthKit only) to make a timeline of file activity. The mac-robber tool is based on the grave-robber tool from TCT (The Coroners Toolkit).
mac-robber requires that the filesystem be mounted by the operating system, unlike the tools in The Sleuth Kit that process the filesystem themselves. Therefore, mac-robber will not collect data from deleted files or files that have been hidden by rootkits. mac-robber will also modify the Access times on directories that are mounted with write permissions.
mac-robber is useful when dealing with a filesystem that is not supported by The Sleuth Kit or other filesystem analysis tools. You can run mac-robber on an obscure, suspect UNIX filesystem that has been mounted read-only on a trusted system.
There are three methods to install mac-robber on Ubuntu 18.04. We can use apt-get, apt and aptitude. In the following sections we will describe each method. You can choose one of them.
Install mac-robber Using apt-get
Update apt database with apt-get using the following command.
sudo apt-get update
After updating apt database, We can install mac-robber using apt-get by running the following command:
sudo apt-get -y install mac-robber
Install mac-robber Using apt
Update apt database with apt using the following command.
sudo apt update
After updating apt database, We can install mac-robber using apt by running the following command:
sudo apt -y install mac-robber
Install mac-robber Using aptitude
If you want to follow this method, you might need to install aptitude first since aptitude is usually not installed by default on Ubuntu. Update apt database with aptitude using the following command.
sudo aptitude update
After updating apt database, We can install mac-robber using aptitude by running the following command:
sudo aptitude -y install mac-robber
How To Uninstall mac-robber on Ubuntu 18.04
To uninstall only the mac-robber package we can use the following command:
sudo apt-get remove mac-robber
Uninstall mac-robber And Its Dependencies
To uninstall mac-robber and its dependencies that are no longer needed by Ubuntu 18.04, we can use the command below:
sudo apt-get -y autoremove mac-robber
Remove mac-robber Configurations and Data
To remove mac-robber configuration and data from Ubuntu 18.04 we can use the following command:
sudo apt-get -y purge mac-robber
Remove mac-robber configuration, data, and all of its dependencies
We can use the following command to remove mac-robber configurations, data and all of its dependencies, we can use the following command:
sudo apt-get -y autoremove --purge mac-robber
References
Summary
In this tutorial we learn how to install mac-robber package on Ubuntu 18.04 using different package management tools: apt, apt-get and aptitude.
