Rekall Logo

Rekall

0
Free
Visit Website

This project is no longer maintained. In December 2011, a new branch within the Volatility project was created to explore how to make the code base more modular, improve performance, and increase usability. This branch was later forked to become Rekall. The modularity allowed physical memory analysis functionality to be used in GRR to enable remote live in-memory analysis. Lessons learned: Rekall has introduced many improvements to memory analysis methodology over the years. For more information see: http://blog.rekall-forensic.com/ Rekall framework allowed for limited modularization due to the nature of interdependent in-memory structure and early architectural decisions. Increasing RAM sizes and security measures like memory encryption are making traditional physical memory analysis more cumbersome. Physical memory analysis is fragile and maintenance heavy. Most physical memory analysis tools are basically kernel debuggers, without access to the source and debug symbols. Most memory analysis therefore can be a costly process of debugging / reverse engineering and keeping debug symbols / structure definitions up to date. Active development on Rekall has been

FEATURES

ALTERNATIVES

A collaborative forensic timeline analysis tool for organizing and analyzing data with rich annotations and comments.

A tool for collecting and analyzing screenshots from remote desktop protocols, web applications, and VNC connections.

A script for extracting common Windows artifacts from source images and VSCs with detailed dependencies and usage instructions.

A command line utility for managing volume shadow copies with capabilities for evasion, persistence, and file extraction.

Modern digital forensics and incident response platform with comprehensive tools.

Web interface for the Volatility Memory Analysis framework with advanced features.

OSINTLeak is a tool for discovering and analyzing leaked sensitive information across various online sources to identify potential security risks.

A tool that uses Plaso to parse forensic artifacts and disk images, creating custom reports for easier analysis.

PINNED