Changelog v1.5.2 Some highlights of this release:
+ Rekall had obtained many live plugins for Incident Response:
— glob, wmi, registry yara scanning of files etc. This capability makes Rekall a capable tool for incident response and triaging.
+ EFilter is now better integrated. Users can simple run SQL queries directly in the console.
+ Artifact collector allows Rekall to use the forensic artifacts project (https://github.com/ForensicArtifacts/artifacts)
As always install with pip and virtualenv:
$ virtualenv /path/to/env
$ source /path/to/env/bin/activate
$ pip install --upgrade pip setuptools wheel
$ pip install rekall
The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
Rekall supports investigations of the following 32bit and 64bit memory images:
+ Microsoft Windows XP Service Pack 2 and 3
+ Microsoft Windows 7 Service Pack 0 and 1
+ Microsoft Windows 8 and 8.1
+ Linux Kernels 2.6.24 to 3.10.
+ OSX 10.7-10.10.x.