Version: 3.3 RC3

Release: 2019-08-20

Category: Security - Forensic Tools

Size: 2489Kb

Dependency:

Not stealth:

Publisher: Velocidex

Web site: https://github.com/Velocidex/c-aff4/releases

This is a physical memory imager which implements the following features: - This code builds on 64 bit windows as well as 32 bit windows. - A read device interface is used instead of writing the image from the kernel like some other imagers. This allows us to have complex userspace imager (e.g. copy across network, hash etc), as well as run analysis on the live system (e.g. rekall can be run directly on the device). - The userspace component can write crash dumps of 32 and 64 bit systems. - The image can be written to stdout (using an output filename of "-"). This can then be piped using the usual ways (netcat, ssh etc).

Apache License v2