# davehull/body-ugid-dist

> A Python script that parses the contents of an fls bodyfile (see The Sleuth Kit) and outputs the distribution of u/gids per directory. This has been useful for finding malicious code that an attacker has placed on a Linux host while neglecting to change u/gids to match "normal" values for the given directory.

- **Canonical URL**: https://githubrepo.cloud/repo/davehull/body-ugid-dist
- **GitHub Repository**: https://github.com/davehull/body-ugid-dist
- **Maintainer / Creator**: https://github.com/davehull
- **Discovered On**: Sep 25, 2026

---
*Indexed by GitHubRepo (https://githubrepo.cloud). Real-time open-source discovery & telemetry.*