Profile cover photo
Profile photo
Michael Cohen
304 followers
304 followers
About
Michael's posts

Post has attachment
The Rekall Agent Whitepaper
This post introduces the Rekall Agent - a new experimental IR/Forensic endpoint agent that appears in Rekall versions 1.6. The Rekall Agent will be officially released with the next major Rekall release but for now you can play with it by installing from gi...

Post has attachment
The DFRWS 2016 Rekall + GRR workshop was fun... Thanks everyone for coming :-).

Post has attachment
Searching memory with Rekall
This blog post covers the new searching capability in the latest Rekall release (Starting from Rekall 1.5.2). The searching capabilities in Rekall are powered by the Efilter project . Customizing plugin output Rekall is a plugin based framework. This means ...

Post has attachment
It's so sad that there are enough data points to actually have a statistical analysis.

Good to know... If less than three people are shot it is too common to warrant national coverage. Apparently the magic number is four killed.

Post has attachment

Post has attachment
Rekall and the windows PFN database
Rekall has long had the capability of scanning memory for various signatures. Sometimes we scan memory to try and recover pool tags (e.g. psscan ), other times we might scan for specific indicators or Yara rules (e.g. yarascan ). In the latest version of Re...

Post has attachment
**
The pmem suite of memory acquisition tools The recent Rekall Furka release updated the pmem suite of acquisition tools, so I thought this would be a good time to write a blog post about the new features and to recap the work we have been doing on reliable a...

Post has attachment
Thanks for the short notice MS - Too bad if one still wants vista support.

Post has attachment

Post has attachment
Installing Rekall on Windows
In the past developing and compiling python software on Windows was a troubling process. Getting the python environment setup just right was quite tricky since one had to install MS Visual Studio, then get python to use it for building C code. The whole thi...
Wait while more posts are being loaded