Memory analysis is one of the most powerful investigation techniques available to forensic examiners. Rekall auto-detects the target system’s profile, using a repository of more than 100 kernel versions available either online or stored locally. When launching Rekall, you can run single commands or drop into an interactive session to take advantage of caching, preventing the need to obtain the sam