# Process Enumeration

The most fundamental task in memory forensics is identifying what programs were running when the RAM was captured.

## windows.pslist (The Honest List)
To understand what is running, the Windows Kernel maintains a linked list called the **EPROCESS block list** (specifically the `ActiveProcessLinks`). Whenever you open Task Manager, Windows simply walks down this list and displays the results.

The `windows.pslist` plugin does exactly the same thing. It asks the OS, "What processes do you think are running?"

*   **Syntax:** `python3 vol.py -f image.raw windows.pslist`
*   **Output:** Process Name, Process ID (PID), Parent Process ID (PPID), Threads, Handles, and Creation Time.

**The Problem:** Because `pslist` relies on the linked list maintained by the OS, it is highly susceptible to **Rootkits**. A rootkit can simply digitally unlink its malicious process from the `ActiveProcessLinks` list. To the OS (and Task Manager, and `pslist`), the malware suddenly becomes invisible, even though it is still actively executing in memory.

## windows.psscan (The Skeptical Scanner)
To find hidden processes, we use **Memory Carving**. 

Instead of trusting the linked list, `windows.psscan` ignores the OS entirely. It methodically scans every single byte of the massive RAM file, looking for the specific byte-signature that signifies the start of an `EPROCESS` data structure.

*   **Syntax:** `python3 vol.py -f image.raw windows.psscan`
*   **The Power of Carving:** If a rootkit unlinks itself to hide, `psscan` will still find it, because the actual data structure must still exist in RAM for the malware to run.
*   **Bonus Power:** Because it scans memory raw, `psscan` can even find processes that were recently terminated (closed) but whose data hasn't yet been overwritten by new data.

## The Comparison Technique
How do you find the hidden rootkit?
You run `pslist`. You run `psscan`. Then you compare the outputs. 
If a process shows up in `psscan` but is absent from `pslist`, you have found a process that was deliberately unlinked and hidden. That PID is almost certainly malicious.

## windows.pstree (The Family Tree)
Attackers often name their malware something innocent, like `svchost.exe`. How do you spot the fake?

`windows.pstree` organizes processes by their Parent-Child relationships. 
*   *Normal:* `services.exe` spawns a dozen `svchost.exe` processes.
*   *Malicious:* You see `explorer.exe` (the desktop GUI) spawning a `svchost.exe`. Or a `winword.exe` (Microsoft Word) spawning `cmd.exe` or `powershell.exe`. The parent-child relationship instantly gives away the attacker.