diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index fbe0fdad3..65f20d88d 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -169,6 +169,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return "" path_reversed = [] + smeared = False while ( dentry and dentry.is_readable() @@ -190,14 +191,16 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): parent = dentry.d_parent dname = dentry.d_name.name_as_str() - dname_stripped = dname.strip("/") - if dname_stripped: - path_reversed.append(dname_stripped) + # empty dentry names are most likely + # the result of smearing + if not dname: + smeared = True + path_reversed.append(dname.strip("/")) dentry = parent - if path_reversed == []: - return "" path = "/" + "/".join(reversed(path_reversed)) + if smeared: + return f" {path}" return path @classmethod