- Added linux.ip.Addr and linux.ip.Link examples to the Using plugins section
- Highlighted the importance of network configuration in memory forensics
- Explained key fields such as interface state, MAC, IP, namespace, and flags
- Structured the content consistently alongside other plugin examples (pslist, bash, etc.)
- Updated linux.pslist output to include new fields: OFFSET, UID/GID, creation time, and file output
- Added detailed explanation of each column and its forensic significance
- Revised linux.pstree section to reflect new output format including OFFSET and hierarchical indentation
- Emphasized the utility of both plugins for process analysis and anomaly detection
- Added new section for linux.boottime plugin
- Demonstrated how to extract system boot time from memory
- Explained its relevance for timeline analysis and incident response
- Removed outdated instructions referencing the ISF server
- Updated guidance to reflect current method of manually generating ISF files
- Clarified placement of ISF files under volatility3/symbols for automatic detection
- Replaced outdated and partial plugin list with a concise summary
- Mentioned total number of supported Linux plugins (~40+)
- Highlighted representative plugins such as pslist, bash, lsmod, etc.
- Provided updated command to enumerate all available Linux plugins
- Removed outdated reference to the Linux ISF Server (service no longer available)
- Updated symbol table instructions to reflect current volatility3 behavior
(symbol files now auto-detected from volatility3/symbols directory)
cpuu