Reading the Linux Process Tree During Triage A flat process list tells you what is running. The tree tells you what started it. This guide covers reading Linux process lineage, exposing renamed processes and recovering a deleted binary through /proc. https://www.halkynconsulting.co.uk/a/2026/09/linux-process-tree/