# Rekall

Rekall is a Digital Forensics product. It runs on-premises. Pricing is free.

Rekall is a discontinued project that aimed to improve memory analysis methodology but faced challenges due to the nature of in-memory structure and increasing security measures.

Checked October 2026.

## What is Rekall?

This project is no longer maintained. In December 2011, a new branch within the Volatility project was created to explore how to make the code base more modular, improve performance, and increase usability. This branch was later forked to become Rekall. The modularity allowed physical memory analysis functionality to be used in GRR to enable remote live in-memory analysis. Lessons learned: Rekall has introduced many improvements to memory analysis methodology over the years. For more information see: http://blog.rekall-forensic.com/ Rekall framework allowed for limited modularization due to the nature of interdependent in-memory structure and early architectural decisions. Increasing RAM sizes and security measures like memory encryption are making traditional physical memory analysis more cumbersome. Physical memory analysis is fragile and maintenance heavy. Most physical memory analysis tools are basically kernel debuggers, without access to the source and debug symbols. Most memory analysis therefore can be a costly process of debugging / reverse engineering and keeping debug symbols / structure definitions up to date. Active development on Rekall has been

Tags: Memory Forensics, Volatility

## Where it fits in your security program (NIST CSF 2.0)

- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 1,999
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## Rekall FAQ

### What is Rekall?

Rekall is a product in the Digital Forensics category. It covers Memory Forensics and Volatility.

### What is the pricing for Rekall?

Rekall is free. Download and setup instructions are at https://github.com/google/rekall/.

### What are alternatives to Rekall?

Alternatives to Rekall listed on CybersecTools:

1. [WindowsSCOPE Cyber Forensics](https://cybersectools.com/tools/windowsscope-cyber-forensics) - GUI-based memory forensic capture tool for cyber forensics and cyber crime investigation. (Commercial)
2. [Magnet Forensics](https://cybersectools.com/tools/magnet-forensics) - Digital forensics platform for evidence acquisition, analysis, and DFIR. (Commercial)
3. [Cellebrite Digital Forensics Platform](https://cybersectools.com/tools/cellebrite-digital-forensics-platform) - Digital forensics platform for mobile & endpoint evidence extraction and analysis. (Commercial)
4. [DigiStor WiebeTech](https://cybersectools.com/tools/digistor-wiebetech) - Hardware write-blockers and forensic tools for secure evidence acquisition. (Commercial)

Compare all Rekall alternatives at [https://cybersectools.com/alternatives/rekall](https://cybersectools.com/alternatives/rekall)

### What deployment and organization size does Rekall fit?

Rekall is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.

## Compare Rekall with similar solutions

- [Rekall vs WindowsSCOPE Cyber Forensics](https://cybersectools.com/compare/rekall-vs-windowsscope-cyber-forensics)
- [Rekall vs Magnet Forensics](https://cybersectools.com/compare/magnet-forensics-vs-rekall)
- [Rekall vs Cellebrite Digital Forensics Platform](https://cybersectools.com/compare/cellebrite-digital-forensics-platform-vs-rekall)

All alternatives to Rekall: [/alternatives/rekall](https://cybersectools.com/alternatives/rekall)

---

Source: https://cybersectools.com/tools/rekall

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Rekall: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md