Difference between pages "Rekall" and "Volatility Framework"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
 
{{Infobox_Software |
 
{{Infobox_Software |
   name = Rekall |
+
   name = Volatility |
   maintainer = [[Michael Cohen]] |
+
   maintainer = [[AAron Walters]] |
 
   os = {{Cross-platform}} |
 
   os = {{Cross-platform}} |
   genre = {{Memory analysis}}, {{Memory imaging}} |
+
   genre = {{Memory analysis}} |
 
   license = {{GPL}} |
 
   license = {{GPL}} |
   website = [https://code.google.com/p/rekall/ code.google.com/p/rekall/] |
+
   website = [https://www.volatilesystems.com/default/volatility https://www.volatilesystems.com/] |
 
}}
 
}}
  
Rekall is the stand-alone continuation of the [[Volatility]] Technology Preview (TP) version, aka the scudette branch.
+
The '''Volatility Framework''' is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.  
  
One of Rekalls goals is to provide better integration with [[GRR]] by improved modularity of the framework and having memory acquisition capability.
+
The project was originally developed by and is now headed up by [[AAron Walters]] of [[Volatile Systems]].
 +
 
 +
== Plugins ==
 +
See: [[List of Volatility Plugins]]
  
 
== Memory acquisition drivers ==
 
== Memory acquisition drivers ==
  
The drivers can be found under:
+
In 2012 [[Michael Cohen]] contributed both a Linux and a Windows Open Source memory (acquisition) driver to the Volatility project as part of the Technology Preview (TP) version, aka scudette branch.
<pre>
+
Since the scudette branch of Volatility has moved on as a separate project, the drivers can now be found as part of the [[rekall]] project.
rekall/tools/linux
+
rekall/tools/osx
+
rekall/tools/windows
+
</pre>
+
 
+
=== Linux ===
+
 
+
To build the kernel module for the current kernel version, make sure you have a working build environment and the kernel headers installed. Change into this directory and run make:
+
<pre>
+
cd rekall/tools/linux/
+
make
+
</pre>
+
 
+
The acquisition driver is named pmem.ko.
+
 
+
To load the driver:
+
<pre>
+
sudo insmod pmem.ko
+
</pre>
+
 
+
To check if the driver is running:
+
<pre>
+
sudo lsmod
+
</pre>
+
 
+
The driver create a device file named:
+
<pre>
+
/dev/pmem
+
</pre>
+
 
+
To unload the driver:
+
<pre>
+
sudo rmmod pmem
+
</pre>
+
 
+
To read acquire the memory just read from the device file. e.g.
+
<pre>
+
dd if=/dev/pmem of=image.raw
+
</pre>
+
 
+
For more information see:
+
<pre>
+
rekall/tools/linux/README
+
</pre>
+
 
+
=== Mac OS X ===
+
 
+
For more information see:
+
<pre>
+
rekall/tools/osx/OSXPMem/README
+
</pre>
+
 
+
=== Windows ===
+
Since recent versions of Windows require a signed driver rekall comes with both pre-built (signed binary) and source versions of the driver.
+
 
+
Both the i386 and amd64 binary version of the driver can be found in the directory:
+
<pre>
+
rekall/tools/windows/winpmem/binaries
+
</pre>
+
 
+
E.g.
+
<pre>
+
rekall/tools/winpmem/binaries/amd64/winpmem.sys
+
</pre>
+
 
+
A standalone tool for imaging memory that uses an embedded copy of the pmem driver can be found as winpmem.exe in:
+
<pre>
+
rekall/tools/winpmem/executables/Release/
+
</pre>
+
 
+
To load the driver:
+
<pre>
+
winpmem.exe -l
+
</pre>
+
 
+
The device filename is (This can not be changed without recompiling):
+
<pre>
+
\\.\pmem
+
</pre>
+
 
+
Note that running dd directly on this device file can crash the machine.
+
Use the winpmem.exe tool instead because it handles protected memory regions.
+
 
+
To read and acquire the physical memory and write it to image.raw:
+
<pre>
+
winpmem.exe image.raw
+
</pre>
+
 
+
To unload the driver:
+
<pre>
+
winpmem.exe -u
+
</pre>
+
 
+
For more information see:
+
<pre>
+
rekall/tools/windows/README
+
</pre>
+
  
 
== See Also ==
 
== See Also ==
* [[Volatility]]
+
* [[List of Volatility Plugins]]
  
 
== External Links ==
 
== External Links ==
* [https://code.google.com/p/rekall/ Project site]
+
* [https://www.volatilesystems.com/default/volatility Official web site]
* [http://docs.rekall.googlecode.com/git/index.html Project documentation]
+
* [http://code.google.com/p/volatility/ Code repository], direct link to [http://code.google.com/p/volatility/source/browse/ source]
 +
* [http://code.google.com/p/volatility/w/list Volatility Documentation]

Revision as of 14:23, 12 January 2014

Volatility
Maintainer: AAron Walters
OS: Cross-platform
Genre: Memory Analysis
License: GPL
Website: https://www.volatilesystems.com/

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The project was originally developed by and is now headed up by AAron Walters of Volatile Systems.

Contents

Plugins

See: List of Volatility Plugins

Memory acquisition drivers

In 2012 Michael Cohen contributed both a Linux and a Windows Open Source memory (acquisition) driver to the Volatility project as part of the Technology Preview (TP) version, aka scudette branch. Since the scudette branch of Volatility has moved on as a separate project, the drivers can now be found as part of the rekall project.

See Also

External Links