diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 2410d2627..1aceade24 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -206,7 +206,14 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): pre_name = "pipe" elif sym == "simple_dname": - pre_name = cls._get_path_file(task, filp) + name = dentry.d_name.name + if name: + pre_name = name.dereference().cast( + "string", max_length=255, errors="replace" + ) + return "/" + pre_name + " (deleted)" + else: + pre_name = "" elif sym == "ns_dname": # From Kernels 3.19