Some highlights of this release v1.5.1 :
+ New windows plugins allowing inspection of the PFN database. This allows mapping of physical memory back to the owning process and file (if it is mapped from a file).
+ Improved scanning framework: Most scanners can now operate on specific memory regions, like process memory, kernel memory, pool memory etc. This allows scanners to be much faster because they are more targeted.
The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
Rekall supports investigations of the following 32bit and 64bit memory images:
+ Microsoft Windows XP Service Pack 2 and 3
+ Microsoft Windows 7 Service Pack 0 and 1
+ Microsoft Windows 8 and 8.1
+ Linux Kernels 2.6.24 to 3.10.
+ OSX 10.7-10.10.x.