Digital Forensics and Incident Response - Second Edition

Process scan

psscan is a useful plugin that allows the analyst to examine processes that have been terminated. As was previously discussed, pslist only shows active processes. psscan can provide data about the possibility of a rootkit through the examination of those processes that have been unlinked or hidden. The following command will execute the plugin:

dfir@Desktop-SFARF6G~$ volatility -f cridex_laptop.mem -profile=WinXPSP2x86 psscan

The command produces the following output:

From the output of this plugin, it does not appear that any additional processes have exited. The responder can then start to look at the existing processes for ...