As was previously discussed, some memory acquisition tools work better with different memory analysis tools. In the case of the memory analysis tool Rekall, there are several memory acquisition tools provided by the same organization that created Rekall. The PMEM tools are available for capturing raw memory from Linux, macOS, and Windows systems. These tools are available at the Rekall website http://releases.rekall-forensic.com/.
In the following demonstration, the target system is the same that was utilized in the FTK Imager demonstration. As a result, the tool WinPmem, which is specifically designed to capture the memory of Windows systems, will be utilized.
Starting with version 2.0.1, the default output for the WinPmem tool is ...
