Incident Response: Bring Out the Body File

This post is a practical guide for incident responders on creating Linux body files—file-system listings analogous to the NTFS $MFT—by combining find and stat (and alternatives like xargs/printf) to capture file metadata and timestamps. It includes concrete command examples, notes on platform differences (e.g., macOS), and warnings about performance and mounts when running exhaustive searches.