If you are doing memory forensics using Volatility, maybe you have noticed that one of the disadvantages that you can’t do a live analysis. If you need to do live memory forensics, then Rekall is your best friend.
Rekall can be obtained from the following location:
Rekall supports the following Operation systems:
For this diary, I am going to use Rekall for Windows. The installation is straightforward.
Rekall needs to be run as administrator to perform the live analysis. Unfortunately, sometimes you need to specify the profile to do the analysis. To find the right profile type the following command inside the Rekall console:
Now locate the guid for ntkrnlmp.pdb
In my case its “5B396742883C48D0AB74C7374DEEE9161”
Now exit from rekall console by typing:
Now run rekall again with the following command (notice that I have provided the guid in the command):
Now we can play with rekall , here are some examples,
To list the available plugins
List the running process:
To list the process tree:
To view the services and save the output to services.txt
Dec 25th 2018
1 month ago