A suspicious Linux process is running from a binary that was deleted from disk — is the evidence gone?
Short answer
No. On Linux, /proc/<pid>/exe is a symbolic link that shows ' (deleted)' after the path when the file was unlinked, but it can still be dereferenced: opening it opens the running executable. Copy it out (for example with cp) before you kill the process or reboot, then hash and analyze the copy.
Malware often deletes its own file right after launching, hoping responders will look at the disk, find nothing, and move on. The interviewer wants to hear that you know the running process still holds a handle to the deleted file.
What /proc/<pid>/exe gives you
Per the Linux man-pages, /proc/<pid>/exe is a symbolic link to the process's executable. If the path has been unlinked, the link's target shows the original pathname with (deleted) appended. Yet the manual states the link can still be dereferenced normally: opening it opens the executable. So cp /proc/<pid>/exe /evidence/sample.bin recovers the binary while the process is alive.
Response order
- Identify the process (
ls -l /proc/<pid>/exeshowing(deleted)is itself a strong indicator). - Copy the executable out and hash it before doing anything destructive.
- Capture other volatile state (memory, open files, connections), then contain the host.
- Analyze the copy in an isolated lab.
Why the wrong answers fail
Killing the process or rebooting first discards the only remaining copy. Assuming deletion also wipes the image from memory is the myth this gotcha targets.
What interviewers want
"Not gone — copy it from /proc before terminating," plus the volatile-evidence-first mindset.
Likely follow-ups
- Besides /proc/<pid>/exe, what other /proc entries help you triage a suspicious process?
- Why does deleting its own binary after launch help an attacker, and what does it tell you about intent?
- What is the risk of simply killing the process before preserving evidence?