Sleuthkit fls

fls -r -m / image.dd > body.txt

Lists files from an image with fls in body format (for timelines), the file system inventory with its metadata.

Run it when you need the file inventory of the image in body file format (the timeline standard): fls -r walks the tree and -m / generates the lines with the path, inode, timestamps, and type — the raw material to build the system timeline with mactime or plaso. It's the basis of temporal reconstruction: each file with its MACB (modification, access, change, birth). In IR, the timeline answers 'what files appeared or were modified in the incident window?' — the payload, scripts, and attacker tools.

Don't use it as the final timeline: fls generates the body file, but the readable timeline is built with mactime (or plaso on the body) — fls only lists. On large images, the output is huge (hundreds of thousands of lines): subsequent filtering (by path, by time) is part of the flow. And watch out: fls reads the file system — on corrupted images or with a damaged FS, the list comes out incomplete; deleted files appear (with the inode) but without a name if the directory was overwritten. For the question of a specific file, icat or the Autopsy browser are more direct.