Which Volatility plug-in is specifically used to reveal processes that may be hidden in a memory image?

Which Volatility plug-in is specifically used to reveal processes that may be hidden in a memory image?

• A. psList
• B. psScan
• C. imageinfo
• D. consoles

Answer: (B)

Volatility reveals hidden processes by using a memory-scanning approach that doesn’t rely on the OS-maintained process list. Some malware or rootkits can unlink or remove a process from the active list, so a standard listing like psList will miss it. psScan overcomes this by scanning memory for process structures and reconstructing processes from raw memory data, which brings those hidden processes to light. In contrast, imageinfo helps determine the memory image’s profile and OS, while consoles focuses on console sessions, neither of which specifically targets uncovering hidden processes.

Volatility reveals hidden processes by using a memory-scanning approach that doesn’t rely on the OS-maintained process list. Some malware or rootkits can unlink or remove a process from the active list, so a standard listing like psList will miss it. psScan overcomes this by scanning memory for process structures and reconstructing processes from raw memory data, which brings those hidden processes to light. In contrast, imageinfo helps determine the memory image’s profile and OS, while consoles focuses on console sessions, neither of which specifically targets uncovering hidden processes.