From 23e4d35017b7ed3f73458d862c77cdc471e5a1bf Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 11 Jun 2025 19:44:50 +0300
Subject: [PATCH] prepend <deleted> for deleted sock & file instead of
 (deleted)

---
 volatility3/framework/symbols/linux/__init__.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index 6de445c6b..b3a8935c6 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -101,7 +101,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
 
     _version = (2, 3, 1)
     _required_framework_version = (2, 0, 0)
-    deleted = " (deleted)"
+    deleted = "<deleted>"
 
     framework.require_interface_version(*_required_framework_version)
 
@@ -209,7 +209,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
             return f"<potentially smeared> {path}"
 
         if inode and inode.is_readable() and inode.is_valid() and inode.i_nlink == 0:
-            path += LinuxUtilities.deleted
+            path = f"{LinuxUtilities.deleted} {path}"
         return path
 
     @classmethod
@@ -266,7 +266,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
                     pre_name = name.dereference().cast(
                         "string", max_length=255, errors="replace"
                     )
-                    return "/" + pre_name + LinuxUtilities.deleted
+                    return f"{LinuxUtilities.deleted} /{pre_name}"
                 else:
                     pre_name = ""