Rekall
This project is no longer maintained. In December 2011, a new branch within the Volatility project was created to explore how to make the code base more modular, improve performance, and increase usability. This branch was later forked to become Rekall. The modularity allowed physical memory analysis functionality to be used in GRR to enable remote live in-memory analysis. Lessons learned: Rekall has introduced many improvements to memory analysis methodology over the years. For more information see: http://blog.rekall-forensic.com/ Rekall framework allowed for limited modularization due to the nature of interdependent in-memory structure and early architectural decisions. Increasing RAM sizes and security measures like memory encryption are making traditional physical memory analysis more cumbersome. Physical memory analysis is fragile and maintenance heavy. Most physical memory analysis tools are basically kernel debuggers, without access to the source and debug symbols. Most memory analysis therefore can be a costly process of debugging / reverse engineering and keeping debug symbols / structure definitions up to date. Active development on Rekall has been
FEATURES
ALTERNATIVES
A library to access and parse OLE 2 Compound File (OLECF) format files.
A command-line utility and Python package for mounting and unmounting various disk image formats with support for different volume systems and filesystems.
Belkasoft offers cybersecurity solutions, training, and tools for businesses, law enforcement, and academia.
A library and tools to access and manipulate VMware Virtual Disk (VMDK) files.
A powerful tool for analyzing and visualizing system activity timelines.
A tool for triaging crash files with various output formats and debugging engine options.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Check Point CloudGuard WAF
A cloud-native web application and API security solution that uses contextual AI to protect against known and zero-day threats without signature-based detection.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.