D2Rekall

Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system.

Type: javascript
Pack: D2

Source

if (args.format)
    fmt = args.format;
else
    fmt= "text";
var out = execute('rekal --format ' + fmt + ' -f ' + args.file + ' ' + args.cmd, 60*60); // 1 hour timeout
pack(out.Stdout);
if( ! out.Success) {
    pack('Exception thrown: ' + out.Error + "\nStderr: " + out.Stderr);
}

README

Executes Rekall on a system (usually a forensics workstation) and analyzes a memory dump file located on that system.

Script Data

Name	Description
Script Type	javascript
Tags	agent, memory, forensics

Inputs

Argument Name	Description
file	The path to the memory dump file in the machine’s filesystem.
format	The format argument for Rekall. For example, json or text.

Outputs

There are no outputs for this script.