# google/rekall

Rekall Memory Forensic Framework

Repository: https://github.com/google/rekall
Canonical: https://ross.abutalabs.com/products/rekall
Homepage: http://www.rekall-forensic.com
Language: Python
License: GPL-2.0
License Family: copyleft
Archived: true
Last push: 2020-10-18T04:33:58+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 4492, "days_push": 2145, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2007, forks 402 (observed 2026-08-28T04:06:04.774175+00:00)

## What it is
Rekall is a Python-based memory forensic framework for extracting and analyzing digital artifacts from physical memory images of Windows, Linux, and macOS systems. It also provides memory acquisition tools and was forked from the Volatility project, but is now officially discontinued and archived.

## Use cases
- analyze a Windows memory dump for malware
- extract running processes from a Linux memory image
- perform incident response memory forensics
- acquire a physical memory sample from a live system
- investigate macOS memory captures
- find injected code in a 64-bit memory dump

## When to choose
- you need to analyze legacy memory images and already have a working environment
- you want to study memory forensics techniques or fork the codebase
- you need a GPL-2.0 open-source memory analysis tool with no licensing constraints

## When to avoid
- you need an actively maintained memory forensics tool - the project is discontinued and archived
- you are starting a new incident response workflow - consider Volatility or YARA-based approaches instead
- you need memory acquisition on Windows - use the separately maintained WinPmem project

## Facets
- artifact type: cli-tool
- maturity: abandoned
- function: security, reverse-engineering
- domain: security, developer-tools, operating-systems
- platform: python, windows, cli, cross-platform
- tags: memory-forensics, incident-response, digital-forensics, memory-acquisition, discontinued, forensics, linux, macos

## Member repositories
- google/rekall (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:04.774175+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:01:24.948197+00:00, confidence not recorded.
  - readme: https://github.com/google/rekall (fetched 2026-08-28T04:06:04.774175+00:00, sha cd783b86cc1b)
  - homepage: http://www.rekall-forensic.com (fetched 2026-08-29T10:41:19.085383+00:00, sha 904a12bbb66f)
- Data as of 2026-08-30T08:39:29.467469+00:00.