Volatility Commands Related to Processes

Question 1

pslist

Answer 1

Finds and walks the doubly linked list of processes and prints a summary of the data. This method typically cannot show you terminated or hidden processes.

Question 2

pstree

Answer 2

Takes the output from pslist and formats it in a tree view, so you can easily see parent and child relationships.

Question 3

Scans for _EPROCESS objects instead of relying on the linked list. This plugin can also find terminated and unlinked (hidden) processes.

Answer 3

psscan

Question 4

psxview

Answer 4

Locates processes using alternate process listings, so you can then cross-reference different sources of information and reveal malicious discrepancies.