Operator On The Wire
Join
← Back to Knowledge Base
BLUE TEAM / DFI / ARTEFACT / LINUX

Bodyfile Timeline

A body file is a timeline input file that stores file metadata (timestamps, paths, sizes) used by tools like mactime to reconstruct activity timelines.

https://www.sleuthkit.org/sleuthkit/


Generate

Using The Sleuth Kit:

fls -r -m / image.dd > bodyfile.txt

Convert bodyfile into Timeline

mactime -b bodyfile.txt > timeline.txt