type:EXECVE (("truncate" "\-s") OR (("dd" "if=") (-"of=")))