diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 8e1b94a0a..19f8fc800 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -266,7 +266,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): pre_name = name.dereference().cast( "string", max_length=255, errors="replace" ) - return f"{LinuxUtilities.deleted} /{pre_name}" + return "/" + pre_name + " (deleted)" else: pre_name = "" diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 318424d5b..3b9a73e7c 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1253,9 +1253,7 @@ class vm_area_struct(objects.StructType): def _do_get_name(self, context, task) -> str: if self.vm_file != 0: - fname = linux.LinuxUtilities.path_for_file( - context, task, self.vm_file, files_only=False - ) + fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file) elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk: fname = "[heap]" elif self.vm_start <= task.mm.start_stack <= self.vm_end: