Computer Forensics and Data Analysis
Software Training Services  

Maresware Programs P through S

Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |

All programs are command line programs.
MUST be run within a command window as administrator.

Reminder, The software is now free, and (generally) UNSUPPORTED.

Take a data file and produce a formatted output file

Be sure to check the help file for additional information about this program.

This program is designed specifically to take a file of fixed length records and produce a formatted file (on disk) containing page breaks and heading information suitable for copying to a printer.

Pagefmt is extremely fast when reformatting files. A 26,000 record file can be reformatted in under 30 seconds on a 386.

The input records must be of a fixed length.

 |  View the html help file.  | 

Take a variable length delimeted file and advise max length of each field

This program is designed specifically to take a file of variable length (delimeted) records and produce a listing of the maximum length found for each field.

The output can then be used to create a parameter file for the pipefix program.

 |  Download
 |  View the html help file.  | 


Be sure to check the help file for additional information about this program.

Make delimited records into fixed length records

Pipefix is designed to work with files that contain variable length records containing pipes as field delimiters. This type of file most often results from an unload of a database. Most notably, INFORMIX, ORACLE, and DBASE create this type of output.

If you know what the record schema(record layout) is, you can use Pipefix to make the records a fixed length, with each field also being a fixed length. Then the output file can be processed just like any other fixed length record. It also works on variable length records with carriage returns.

If you have processed an NT Event file with Maresware's Eventlog, then the output of the eventlog.exe can be passed to Pipefix to create a fixed length record ready for importing into a database.

 |  Get the 32 bit .exe  | 
 |  View the html help file.  | 


Insert branding information in the master boot record of hard drive

This program is designed take user input, and put information in the master boot record of a drive which can then be tested for. If the test is successful, the user knows the drive is his. The information also shows up in the Volume Serial Number of the drive.

|   Get the .exe  |
|  View the html help file.   |

Generate random numbers

Be sure to check the help file for additional information about this program.

A random number generator that produces outputs that auditors and others find useful for defining samples. The output can then be passed to Maresware's Filsplit to select out the sample records of a data file.

Random will generate random numbers based on the input requirements of the user. It will generate a list of random numbers with upper and lower limits. You can also specify how many numbers you want.

 |  Get the .exe  | 
 |  View the html help file.  | 

Rm and Rmd
Remove file and directories

Be sure to check the help file for additional information about this program.

To remove and overwrite files. (Is more efficient than the del command).

The Rmd command is also useful when removing a file with object re-use in mind. This means it will overwrite the file to DOD standards and write as many passes as you specify. Rmd will also:

  • Erase and overwrite a file and its slack space--any number of times.
  • Clean the slack space found at the end of each file.
  • Clean free space on the drive. (up to 3 GIG/minute) The free space contains all the remnants of deleted files. Cleaning free space will clean all residual file data.

The default operation is only a single pass which does not meet Department of Defense minimum criteria, but it erases the disk/file sufficiently so that the average user cannot recover data. To pass DOD specs, you must ask it to overwrite at least 7 times.

The program available for download is Rmd. To obtain an rm operation that doesn't overwrite: simply rename the program to rm.exe.

 |  Get the rmd.exe  |  Get the 32 bit rmd.exe  |  Get the Linux version unzip the ""
 |  View the html help file.  | 


ROT13 conversion program

A simple command line program that will convert a file that is ROT-13 encoded/encrypted to a conventional (readable) file. The program makes no assessments, judgements, or analysis as to what needs to be converted and what doesn't. It converts the entire file. So if a section is not ROT-13 encoded, it will convert it to ROT-13, and vise-versa.

From a line extracted out of FTK Registry Viewer report on the USERASSIST key, it converted the top line to the correct text.

HRZR_EHACNGU:P:\Cebtenz Svyrf\UC ErpbeqAbj\zlpq.rkr
UEME_RUNPATH:C:\Program Files\HP RecordNow\mycd.exe 

The command line is simple: rot13 inputfile outputfile

 |  Get the .exe  | 
 |  No help file available  | 

Create a file of know content

Be sure to check the help file for additional information about this program.

Sample creates a single "sample" file. The file is of known content designed by the user, and of known size. The file can also contain periodic checkpoints which will allow users to confirm locations within the file.

Since this is a 32 bit program, if run on an NTFS drive, it can create files greater than 2 GIG in size. This is a free program.

 |  Get the exe  | 
 |  View the html help file.  | 

Search files for keys

As with most Maresware file processing software, the input file MUST be fixed length.

Be sure to check the help file for additional information about this program.

Search allows you to search fields in a record for the occurrence of specified search keys. There are a number of different modes which can be used to search a file.

If your input file is sorted on the key field, use Maresware's Bsearch instead. It will increase speed dramatically. (Bsearch can only be used with fixed length records.)

Search is a real workhorse when dealing with fixed length or mainframe data files. It has a tremendous amount of operational capability. For instance: On a 2GHZ computer with a 5200 RPM drive, this program can search a 10.8 million record file (approx 640 megabytes) for a key in under 30 seconds.

 |  GET the 32 bit version  |  GET sample files and batch demo  | 
 |  View the html help file.  | 


Search files for keys

Reprocesses the setupapi.log file to make it easier to load to a spreadsheet. It also reforms some of the dates within the file.

 |  GET the 32 bit version  | 
 |  View the html help file.  | 


This program: seadate.exe is designed to decode the manufacture date code that is found on some Seagate hard drives.
The code us usually in a form of a single digit like: 06212, or 0051
To decode this value you need to do the following

Split the value up to 3 parts.
The value is of the form: YYWDD or YYWWD
YY == fiscal year beginning the first saturday of july of the YY-1, 05 becomes 2004
WW == the number of weeks after that saturday. The saturday week is counted
D == the number of days into the next week.
So 05062 would be 2004, the 6th week after 1st saturday in July, + 2 days.
By my calculations, 05062 is 8 / 15 / 2004.
I have made no effort to adjust for leap years so the final day may be 1 off

 |  Get the .exe  | 

NIST code for SHA,MD5, MD4, CRC-32

This is a program that was generated by compiling the NIST source code for the SHA, MD5, MD4, and CRC-32 data base. The source code is available at: NSRL   documents. However, in order to compile it cleanly under Microsoft Ver 6.0C++ a few minor changes were made(although none to the algorithm). Our version of the source code is available upon request.

 |  Get the .exe  | 

Sha V
Validated program to calculate SHA1 values

This contains a validated SHA1 FIPS 180-3 algorithm which can be used to calculate the SHA1 (or MD5, SHA256, 384, 512) values of files.

For testing or evaluation of the usefulness, use the sample hash program. It will provide all the functionality needed to see if the calculations and formats suit your needs. No evaluation version of the actual SHA_V is available.


 |  Get the hash.exe file  |  View the html help file  | 

Sha verify
Emulate/verify SHA/MD5 calculation of data (disk)

Use to perform a hash of a file, and/or to emulate that calculation on a number of sectors or file of X bytes in size. Also performs an MD5 and SHA1 calculation on a file (this function is incidental to the primary purpose).

Often in validation procedures you have either a file or a physical drive which contains one hex value (i.e., hex 00). You need to perform a hash of the file/disk. Your software may take a long time, and you have no way to know if it actually worked.

By using Sha_verify you can emulate doing a MD5 and SHA1 of a disk or file of a specific size, and provide the correct value. Then compare this value with the one your software produced on the actual device. Because the disk or file doesn't need to be available, the program runs fast.

This program is available for free download.

 |  Get the .exe file  |  View the html help file  | 

Check sort integrity of a file

Be sure to check the help file for additional information about this program.

Use Sortchek to check the integrity of the sort sequence of a sorted file. The file must be of a fixed length record format.

The program can only check primary sort sequence.

 |  View the html help file.  | 

Split a large file to smaller pieces

Be sure to check the help file for additional information about this program.

This program splits a file into equal parts for copying to floppy disks. It can either split the file into pieces on the hard drive which can then be copied to floppies, or it can split the file directly to floppies.

Split takes a large file and splits it so that it can be placed onto floppy disks for transmittal. The program does not compress the data, so each piece is a subset of the original.

Maresware's Unsplit reverses the action of Split. It takes the pieces off the floppies and places them back into a single file on the hard drive.

The zip file contains both Split and Unsplit along with the Windows help file.

 |  Get the 3bit .exe  | 
 |  View the html help file.  | 

Search physical drive for strings

Be sure to check the help file for additional information about this program and also the nt_ss help file

Ss  is designed to search a disk to determine if specific strings are located anywhere on it.

Ss  searches the entire disk. As it finds strings on the disk, it then writes information to an output file (default is called "hits"). It identifies the head, track, sector and cluster where the strings were found and also displays on the screen information concerning the location of the strings.

Output is similar to Maresware's Strsrch program, which allows output records from these two programs to be combined for database analysis.

Because it can search an entire track at one time it can somewhat faster than many other software programs. Of course, more hits, and/or more strings to search add to the search time.

Ss can also perform a reverse search. This can be used to confirm the full overwrite of a physical disk.

 |  Get the .exe  | 
 |  View the html help file.  | 

Check an SSN to see if is a valid issue

Be sure to check the help file for additional information about this program

Ssn_valid  is designed to allow a user to input an SSN and verify if it is a legitimately issued number.

Ssn_valid can take interactive input from a user, to check one SSN at a time, or can take a text file of SSN's and the program will check each one in turn, and show the results on the screen, which can be redirected.

The version of the program that is available on this site, will only process 10 SSN's until it is fully registered.

Check for the latest group issued values. The user should generally prepare a current file from this list. (see the -g option).

 |  Get the .exe  | 
 |  View the html help file.  | 

Stip unprintable characters from a file

Strip will "strip" unprintable characters from a file. The user can choose to eliminate the unprintable characters completely, or replace them with blanks.

Strip can also insert checkpoints at whatever periods the user chooses.

 |  Get the .exe  | 
View the help file  | 

Search file system for strings

Be sure to check the help file for additional information about this program.

The program is designed to do multiple string searches of files contained on a disk (hard or floppy).

Strsrch is extremely fast (regardless of the number of keys used) and versatile. It can almost be "programmed" to produce virtually any output configuration.

Strsrch searches for any number of strings in:

  • every file on a drive (default)
  • specific files (*.exe *.txt *.dll etc)
  • specific directories ( c:\program files, c:\program files(86) )
  • determine if an exe is a self extracting zip, winzip, 7-zip file

Regarding Iinternet activities: Strsrch and Ss can:

  • perform searches for occurences of Internet e-mail by allowing the user to search for strings contained in standard e-mail headers. Search for From:, or To:, or mailto, or Return To:.
  • search for Internet activity by performing searches on the strings normally associated with Internet activity such as http://www and ftp://ftp.
 |  GET the 32 bit .exe  | 
 |  View the html help file.  | 

Determine operating systems on a hard drive

This is a 16 bit program, no longer available or practical.


Home  |  Whats New  |  How to Order  |  Training  |  Services  |
About Us  |  FAQs  |  Articles  |  Resources  |  Legal Notices  |  Contact Us  |
Files A-C  |  Files D-F  |  Files G-K  |  Files L-O  |  Files P-S  |  Files T-Z  |
 |  SoftwareData Analysis Software  |  Forensic Processing Software  |  Linux Processing Software  |
Complete  | Complete  | Complete 16 bit  | Complete 32 bit  |
copyright 1998-2016 by Mares and Company, LLC