Skip to main content
This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (pypi.python.org).
Help us improve Python packaging - Donate today!

Rekall Memory Forensic Framework

Project Description

The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The Rekall distribution, as well as further information is available from: http://www.rekall-forensic.com/

Quick start

Rekall is available as a python package installable via the pip package manager. Simply type (for example on Linux):

  • sudo pip install rekall

To have all the dependencies installed. You still need to have python and pip installed first.

To be able to run the ipython notebook, the following are also required:

  • pip install Jinja2 MarkupSafe Pygments astroid pyzmq tornado wsgiref

If you want to use the yarascan plugin, install [yara and yara-python](http://plusvic.github.io/yara/).

For windows, Rekall is also available as a self contained installer package. Please check the download page for the most appropriate installer to use [Rekall-Forensic.com](http://www.rekall-forensic.com/)

Mailing Lists

Mailing lists to support the users and developers of Rekall can be found at the following address:

rekall-discuss@googlegroups.com

Bugs and Support

There is no support provided with Rekall. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

If you think you’ve found a bug, please report it at:

https://github.com/google/rekall/issues

In order to help us solve your issues as quickly as possible, please include the following information when filing a bug:

  • The version of rekall you’re using
  • The operating system used to run rekall
  • The version of python used to run rekall
  • The suspected operating system of the memory image
  • The complete command line you used to run rekall

Further documentation is available at http://www.rekall-forensic.com/

Release History

Release History

This version
History Node

1.6.0

History Node

1.5.3.post1

History Node

1.5.3

History Node

1.5.3rc3

History Node

1.5.3rc2

History Node

1.5.2.post1

History Node

1.5.2

History Node

1.5.2rc1

History Node

1.5.1

History Node

1.5.0.post5

History Node

1.5.0.post4

History Node

1.5.0.post3

History Node

1.5.0.post2

History Node

1.5.0.post1

History Node

1.5.0.post0.dev3

History Node

1.5.0

History Node

1.4.1

History Node

1.4-0

History Node

1.4.0.post0.dev1

History Node

1.4.0.post.dev1

History Node

1.4.0

History Node

1.4.0.pre4

History Node

1.4.0.pre3

History Node

1.4.0.pre1

History Node

1.4.0.pre0.post.dev5

History Node

1.4.pre0

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
rekall_core-1.6.0-py2-none-any.whl (1.1 MB) Copy SHA256 Checksum SHA256 py2 Wheel Nov 4, 2016
rekall-core-1.6.0.zip (1.1 MB) Copy SHA256 Checksum SHA256 Source Nov 4, 2016

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting