Friday, October 31, 2014

Rekall now has OS X 10.10 Yosemite support!

Last night, I pushed a changelist that officially adds support for analysing OS X 10.10 (Yosemite) to Rekall. The profile for Yosemite is now available, and OSXPMem supports full memory acquisition and live analysis. You can install the latest pre-release version of Rekall from our github page.

Please let us know if you find any bugs!

Windows Virtual Address Translation and the Pagefile.