Tools · Forensics tools · 07 / 25
Volatility 3: processes, parents, and command lines
windows.pslist is the live list. windows.psscan is a search for process objects that remain in memory. The command line, when it is still readable, tells you how a process was started.
The live list is a linked list
windows.pslist walks the kernel’s list of active processes and prints a pid, a parent pid, a name, and times the structure still holds. The parent pid is your first link. A powershell.exe whose parent is explorer.exe was started from a logged-on session in the ordinary way. A powershell.exe whose parent is a temp binary you have never seen is a different lead, and you still have to name both processes. Pid numbers are reused by Windows over time. A parent pid only helps if that parent exists in this image, or if you can show the pid was not reused between the two creation times.
Read the times as the structure’s times, then convert them with the same discipline as the disk. Volatility often prints UTC. Your Autopsy case is America/New_York. Add the zone in the note or you will put a 14:18 UTC process next to a 09:18 Brooklyn file and miss that they are hours apart, or wrongly decide they match. The acquisition is 09:22 Brooklyn, which is 13:22 UTC. Keep one zone in the write-up and show the conversion.
A scan sees objects the list has dropped
windows.psscan looks through memory for process objects by their structure, so it can report a process that has exited or that is no longer linked from the live list. A process in both plugins is on the live list and the scan found it too. A process in the scan only is a leftover or an unlink. You say which. “Hidden” is a conclusion about intent. “Present in windows.psscan and absent from windows.pslist” is the observation, and it is enough to justify a closer look at that object’s times and name.
Exited processes matter for a snapshot taken at 09:22 about an event at 09:18. The process that copied the workbook may already have ended. If psscan still has an object named powershell.exe with a create time inside the window and an exit time before the acquisition, that is a strong place to point the command-line plugin. If neither plugin has it, the pages may be gone. You record the negative for these two plugins and you move to the disk and the Sysmon log, which were built to outlive the process.
The command line is a field that can vanish
windows.cmdline reads the command line from the process environment block when those pages are still in the image. You get the text the process was started with, which can include paths and arguments. You run it for the pid you already identified. A blank line means the field was not readable, and you write “command line not available for pid 4812.” You do not reconstruct a command from what you suspect the user meant.
Treat the text as data from the image. It can contain file paths, and it can contain a long encoded argument. An encoded argument is a blob for CyberChef later, under the case rules, because you already have it. In the Volatility note you quote it or you hash the output file and point at the quote. You also record the parent image name from pslist so the command line is not floating free of a process tree.
vol -f NL-FIN-14.raw windows.cmdline --pid 4812 vol -f NL-FIN-14.raw windows.psscan
Write the tree you can actually see
A useful note is a small tree. Parent name, parent pid, child name, child pid, create time with zone, exit time if the scan shows one, and the command line or the fact that it was unreadable. Three or four processes are enough when they are the ones tied to the workbook path. A full dump of every process on a busy laptop belongs in the saved plugin output. The report gets the branch you can connect to an artifact.
Cross-check the image path with Autopsy. If the command line mentions \Temp\p4.xlsx, the disk either has that path, had it, or the string is a leftover from a command that failed. The string alone is the process’s argument. The directory entry is the disk’s record. Both go in the case, and each keeps its source.
Worked case: a powershell object that had already exited
windows.pslist at the 09:22 snapshot shows explorer.exe and the usual desktop processes, and it does not show powershell.exe. windows.psscan shows a powershell.exe object, pid 4812, parent pid 2204, create time 13:17:04 UTC, exit time 13:19:58 UTC. You convert those to 09:17:04 and 09:19:58 America/New_York. Parent pid 2204 is explorer.exe in the live list, and that process’s create time is hours earlier, so the pid link is plausible. windows.cmdline for 4812 still returns a short command that includes the Documents path of Payroll-April.xlsx and the Temp path p4.xlsx.
You save all three outputs. The note says the process had exited before acquisition, the argument string names both workbook paths, and the disk hashes of those two files match each other. You do not write that the encoded tail of the command, if any, has been decoded yet. That blob, if it is in the output, goes to the CyberChef notes as data you already extracted.
Diagram
Live list and scan, side by side
How the two process plugins differ
Walk. Follows the kernel’s list of active processes.
Sees. Processes on that list at acquisition.
Misses. Objects that exited or were unlinked, if their pages still exist for a scan.
Walk. Scans memory for process object structures.
Sees. Live objects and leftovers the list no longer points at.
Misses. Anything whose memory was reused so the structure is gone.
Check yourself
1. powershell.exe appears in windows.psscan with an exit time, and windows.pslist does not list it. The exit time is before the memory acquisition. What do you report?