Rekall
Rekall is a discontinued project that aimed to improve memory analysis methodology but faced challenges due to the nature of in-memory structure and increasing security measures.
Rekall is a discontinued project that aimed to improve memory analysis methodology but faced challenges due to the nature of in-memory structure and increasing security measures.
Checked October 2026.
This project is no longer maintained. In December 2011, a new branch within the Volatility project was created to explore how to make the code base more modular, improve performance, and increase usability. This branch was later forked to become Rekall.
The modularity allowed physical memory analysis functionality to be used in GRR to enable remote live in-memory analysis. Lessons learned: Rekall has introduced many improvements to memory analysis methodology over the years. For more information see: http://blog.rekall-forensic.com/ Rekall framework allowed for limited modularization due to the nature of interdependent in-memory structure and early architectural decisions.
Increasing RAM sizes and security measures like memory encryption are making traditional physical memory analysis more cumbersome. Physical memory analysis is fragile and maintenance heavy. Most physical memory analysis tools are basically kernel debuggers, without access to the source and debug symbols.
Most memory analysis therefore can be a costly process of debugging / reverse engineering and keeping debug symbols / structure definitions up to date. Active development on Rekall has been
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Rekall: features, pricing and alternatives.
Rekall is a product in the Digital Forensics category. It covers Memory Forensics and Volatility.
Rekall is free. Download and setup instructions are at https://github.com/google/rekall/.
Alternatives to Rekall listed on CybersecTools:
Compare all Rekall alternatives at https://cybersectools.com/alternatives/rekall
Rekall is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A free endpoint security tool for host investigative capabilities to find signs of malicious activity through memory and file analysis.
Automated tool for parsing Windows registry hives and extracting valuable information for forensic analysis.
RegRippy is a modern Python 3 alternative to RegRipper for extracting data from Windows registry hives.
replayproxy allows you to 're-live' a HTTP session captured in a .pcap file, parsing HTTP streams, caching them, and starting a HTTP proxy to reply to requests with matching responses.
Extracts resources (bitmaps, icons, cursors, AVI movies, HTML files, and more) from dll files
Tool for analyzing Windows Recycle Bin INFO2 file
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
