The Rekall Framework is a completely open collection of tools, implemented in
Python under the GNU General Public License, for the extraction of digital
artifacts from volatile memory (RAM) samples. The extraction techniques are
performed completely independent of the system being investigated but offer
visibility into the runtime state of the system. The framework is intended to
introduce people to the techniques and complexities associated with extracting
digital artifacts from volatile memory samples and provide a platform for
further work into this exciting area of research.
WWW: http://www.rekall-forensic.com/
If you want to use online profile repositories using https, make sure that root
certificates from certificate authorities are installed (via ca_root_nss for
instance).
Convert Python ports to FLAVORS.
Ports using USE_PYTHON=distutils are now flavored. They will
automatically get flavors (py27, py34, py35, py36) depending on what
versions they support.
There is also a USE_PYTHON=flavors for ports that do not use distutils
but need FLAVORS to be set. A USE_PYTHON=noflavors can be set if
using distutils but flavors are not wanted.
A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
added to cope with Python ports that did not have the Python
PKGNAMEPREFIX but are flavored.
USES=python now also exports a PY_FLAVOR variable that contains the
(Only the first 15 lines of the commit message are shown above )
Update rekall to 1.4.1
It was split in 3 modules
- security/py-rekall-core : CORE component with command line interface
- security/py-rekall_gui : GUI with ipython and web interface
- security/py-rekall : "meta" module
