Considering Volatility, why would psscan return more results than pslist?

Occasional false positives or stale EPROCESS artifacts can appear in psscan output, but duplicate results are not the primary reason psscan returns more processes than pslist.

Both psscan and pslist operate on the same static memory image and have no concept of different timelines; neither plugin searches a broader time window than the other.

It is pslist, not psscan, that reads directly from the kernel's active process doubly-linked list; psscan bypasses that list entirely by scanning raw memory pool allocations.

The psscan plugin scans the entire memory image for EPROCESS structure pool tag signatures rather than traversing the kernel's doubly-linked active process list. Malware using Direct Kernel Object Manipulation (DKOM) can hide processes by unlinking their EPROCESS entries from this list, making them invisible to pslist. Because psscan does not depend on the linked list, it surfaces these unlinked hidden and terminated processes, producing more results than pslist.