D2Rekall

Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system.

javascript · D2 (Deprecated)

Details

ID	`D2Rekall`
Language	javascript
From Version	5.0.0
Tags	agent memory forensics

README

Executes Rekall on a system (usually a forensics workstation) and analyzes a memory dump file located on that system.

Script Data

Name	Description
Script Type	javascript
Tags	agent, memory, forensics

Inputs

Argument Name	Description
file	The path to the memory dump file in the machine’s filesystem.
format	The format argument for Rekall. For example, json or text.

Outputs

There are no outputs for this script.

Source

D2Rekall.js D2Rekall.yml

Download History Raw

if (args.format)
    fmt = args.format;
else
    fmt= "text";
var out = execute('rekal --format ' + fmt + ' -f ' + args.file + ' ' + args.cmd, 60*60); // 1 hour timeout
pack(out.Stdout);
if( ! out.Success) {
    pack('Exception thrown: ' + out.Error + "\nStderr: " + out.Stderr);
}