Out there question:
Do you guys have any plans on releasing a tool which could be used for diffing filesystems?
eg. Run the tool, run an arbitrary program which modifies the filesystem, run the tool again and it reports on what has changed?
Using existing diff tools for this right now is clunky. I'm surprised there's not a go-to tool used by security researchers (or perhaps there is and I don't know about it).
I don't think we have any immediate plans for this, but it's an interesting idea. I think you could use graphtage for this (since it performs an IR transformation to do diffs against arbitrary graph-shaped inputs), provided you're able to transform your FS changes/metadata into a graph-shaped object (even just a JSON array of events).
More specifically, assuming you have a journaling FS, I think you could do something like "record the journal for the period you're interested in, and then build a graph of (event, inode) items during that period." But there might be edge cases I'm not thinking of.