Your chief problem seems to be that you're trusting ps ax. That is to say, you enter the two owrds, and assume that they are executed as you intended. With malware running this assumption is flawed.

Practically the answer is, don't run anything off that HDD then. Put it in a USB enclosure, and connect it to a known-good system that doesn't automatically start executing content from USB storage. For even more secutiry, on Linux you can mount the dsk as noexec.

You can now inspect all the bits accessible to ordinary malware. There's still the risk of state-level actors who have replaced the very firmware of the disk itself, though. But if you're dealing with that level of threats, you shouldn't be asking this sort of questions.

Your chief problem seems to be that you're trusting ps ax. That is to say, you enter the two words, and assume that they are executed as you intended. With malware running this assumption is flawed.

Practically the answer is, don't run anything off that HDD then. Put it in a USB enclosure, and connect it to a known-good system that doesn't automatically start executing content from USB storage. For even more security, on Linux you can mount the dsk as noexec.

You can now inspect all the bits accessible to ordinary malware. There's still the risk of state-level actors who have replaced the very firmware of the disk itself, though. But if you're dealing with that level of threats, you shouldn't be asking this sort of questions.