All of the software listed here, over 40 programs, is included in Maresware: The Suite. This Suite contains all the programs in both Maresware: Computer Forensics and Maresware: Data Analysis, plus several additional programs. Our pricing on the Suite provides a very cost-effective way to obtain a wide variety of capabilities. You can also purchase most of the programs individually. Note: Site licenses and volume discounts are available for all our software, both packages and individual programs.

For an overview of the features, functions, and applications of this package, go back to Maresware: The Suite.

Page of links to all the HTML help files for the software.

The (F) or (D), or both (F,D), after each description designates which package the program is included in: (F)orensic or (D)ata Analysis. The programs unique to this suite, which are not contained in any of our other packages, include: Boot, Dater, Eventlog, Modify, and Mxcopy. These programs add several functions to your toolkit in the areas of systems maintenance, administrative tasks, and computer security. An asterisk (*) indicates that a similar program exists for LINUX. For more information, see Maresware: Linux Forensics.

Click on any link for a more detailed description, or to download the demo version.

Bates_no:  Inserts Bates numbers into file names to easily identify them. (F)*
Boot: A small program to reboot the computer.
Brandit:   (16 bit only) Brands hard drive with personal ownership information. Reader portion reads ownership info. in about 10 seconds(download it for free).(F)
Bsearch: Performs binary search of sorted file.(D)
Ch: Allows for more efficient CD commands.(Free)
Chek_env: Used in batch files to check environment variables.(Free)
Chs_conv: Convert CHS values to linear LBA values.(Free)
Chsize: Resizes a file. Truncate or add to its size.(Free)
Collate: Collates two sorted files together.(D)
Compare: Compares two files on common sorted field.(D)
Copy_ads: Identifies and copies NTFS Alternate Data Streams.(F)
Crckit   Calculates a 32 bit checksum (CRC) of a file.(F,D)
Dateconv: Converts a windows date format (912345678) to a traditional MM-DD-YY format.(Free)
Dater Simple date and calendar display. Has Unix style options for setting MDY to environment.
Declasfy  (16 bit only) Wipes hard drive to DOD standards. This wipe program really works.(F)
Dirv     Filters the output of the DIR /S command & converts it to a fixed length record.(F)
Disable   Disables keyboard and displays security banner. Use on your evidence disks.(F)
Disk_crc   (16 bit Only) Calculates 32 bit CRC, MD5 or SHA of physical disk.(F,D)
Diskcat   Catalogs (lists) every file on a disk. Identifies headers also. (F,D)*
Diskimag   Creates an exact image (copy) of a diskette. (Images MAC and Linux also) Excellent for use with disk duplicators because it allows unattended imaging of as many diskettes as your duplicator's capacity.(F)
Eventlog   Converts the output of an NT security event log to fixed length records, for import to data base.(F)
Filbreak: Reforms fields of a record.(D)
Filsplit: Splits off sections of a file. For sampling or other uses.(D)
Findrecl: Confirms published record length of fixed length records.(D)
Hash   Performs MD5, CRC, or SHA hash of every file on a drive. (Linux also avail.)(F,D)*
Hashcmp   Compares outputs of successive hash runs. (32 bit ONLY) (F)*
Hash_dup   Finds duplicate hashes in file created with Maresware's Hash.(32 bit ONLY)(F)
Hexdump: Displays a file in Hexadecimal format.(D)
Hexedit   Performs a crude edit of a file in hexadecimal or ASCII format.(F,D)
Hex_sect   Edits large drives using a sector editor in Hex mode.(F)
Ispgp Scans drive and identifies files that might be associated with PGP encryption.(F)
Kiting: Performs date difference (kiting) calculations on date fields.(D)
Lfn_crc: Validates the long fileanme CRC found in a FAT32 directory entry. (Free)
Makedir: A 16bit efficient make directory command. (Free)
Md5 Calculates CRC, MD5, SHA1&2 of a file. Similar to md5sum on Linux platforms.(F)*
Mdir   Produces a directory listing that displays more file attributes than most do. Can be programmed to specify the output you want displayed. 32-bit version shows NTFS Alternate Data Streams and Encrypted File System files.(F)
Mktemp Makes files for test purposes. Files are of known size and content. (Free)
Mod_com  Modifies system files to make boot disk forensically sound. (Free)
Modify Changes file attributes more easily than attrib.
Mouse Will display fixed length records on the screen based on a record length input by the user. (Free)
Mxcopy Specific Xcopy type program designed to be run with/from Diskcat when cataloging diskettes.
Nist_crc Is a free program compiled from the source code found on the NIST, NSRL project pages. (Free)
Ntwipe   Wipes/overwrites "physical" drives attached to NTFS operating systems. Superceded by NTIMAGE.(F)
Nt_ss   Perform String searches at the physical level under the NT OS.(F)
Ntimage Images/Wipes/hashes "physical" drives attached to NTFS operating systems. Works WITHIN the OS.
Pagefmt: Quick text page report formatter.(Free)
Pipefix: Converts pipe (|) or other delimited files to fixed length records.(D)
Random: Generates "random" numbers for sampling or other purposes.(D)
Rm/Rmd  Wipes file, slack, and free space completely. Operates like *ix RM.(F,D)
Sample will create a single "sample" file of known content and size. It can include checkpoints if the user chooses.(Free)
Search: Performs logical or boolean search criteria on fields in a file.(D)
Sortcheck: Validates sort integrity of a file.(D)
Split: Splits a file into manageable pieces.(D)
Ss   Searches physical disk for strings.(F)
Strsrch   Searches files for strings. (F)*
Systems   Detects which operating systems are on a hard drive.(F)
Total: Total numeric fields for sorted records. (D)
Truetime   Allows user to capture correct date and time and place them on an evidence disk.(F)
Unique: Removes multiple duplicate key records. (D)
Unsplit: Merges back the results of the split program.(D)
U_to_A   Converts *ix text to DOS text.(F)
Upcopy   Copies files from a source to a destination location while maintaining the complete tree structure. (F,D)

Top