How To Install mac-robber on Kali Linux

Introduction

In this tutorial we learn how to install mac-robber on Kali Linux.

What is mac-robber

mac-robber is:

mac-robber is a digital investigation tool (digital forensics) that collects metadata from allocated files in a mounted filesystem. This is useful during incident response when analyzing a live system or when analyzing a dead system in a lab. The data can be used by the mactime tool in The Sleuth Kit (TSK or SleuthKit only) to make a timeline of file activity. The mac-robber tool is based on the grave-robber tool from TCT (The Coroners Toolkit).

mac-robber requires that the filesystem be mounted by the operating system, unlike the tools in The Sleuth Kit that process the filesystem themselves. Therefore, mac-robber will not collect data from deleted files or files that have been hidden by rootkits. mac-robber will also modify the Access times on directories that are mounted with write permissions.

mac-robber is useful when dealing with a filesystem that is not supported by The Sleuth Kit or other filesystem analysis tools. You can run mac-robber on an obscure, suspect UNIX filesystem that has been mounted read-only on a trusted system.

There are three methods to install mac-robber on Kali Linux. We can use apt-get, apt and aptitude. In the following sections we will describe each method. You can choose one of them.

Install mac-robber Using apt-get

Update apt database with apt-get using the following command.

sudo apt-get update

After updating apt database, We can install mac-robber using apt-get by running the following command:

sudo apt-get -y install mac-robber

Install mac-robber Using apt

Update apt database with apt using the following command.

sudo apt update

After updating apt database, We can install mac-robber using apt by running the following command:

sudo apt -y install mac-robber

Install mac-robber Using aptitude

If you want to follow this method, you might need to install aptitude on Kali Linux first since aptitude is usually not installed by default on Kali Linux. Update apt database with aptitude using the following command.

sudo aptitude update

After updating apt database, We can install mac-robber using aptitude by running the following command:

sudo aptitude -y install mac-robber

How To Uninstall mac-robber on Kali Linux

To uninstall only the mac-robber package we can use the following command:

sudo apt-get remove mac-robber

Uninstall mac-robber And Its Dependencies

To uninstall mac-robber and its dependencies that are no longer needed by Kali Linux, we can use the command below:

sudo apt-get -y autoremove mac-robber

Remove mac-robber Configurations and Data

To remove mac-robber configuration and data from Kali Linux we can use the following command:

sudo apt-get -y purge mac-robber

Remove mac-robber configuration, data, and all of its dependencies

We can use the following command to remove mac-robber configurations, data and all of its dependencies, we can use the following command:

sudo apt-get -y autoremove --purge mac-robber

Dependencies

mac-robber have the following dependencies:

• libc6

References

• mac-robber website

Summary

In this tutorial we learn how to install mac-robber package on Kali Linux using different package management tools: apt, apt-get and aptitude.