Digital Forensics with Kali Linux

The pslist command

This tool not only displays a list of all running processes, but also gives useful information such as the Process ID (PID) and the Parent PID (PPID), and also shows the time the processes were started. In the screenshot displayed in this section, we can see the System, winlogon.exe, services.exe, svchost.exe, and explorer.exe services are all started first and then followed by reader_sl.exe, alg.exe, and finally wuauclt.exe.

The PID identifies the process and the PPID identifies the parent of the process. Looking at the pslist output, we can see that the winlogon.exe process has a PID of 608 and a PPID of 368. The PPID’s of the services.exe and the lsass.exe processes (directly after the winlogon.exe process) are both ...