This release fixes an issue with the drivers loading on recent Windows versions.

For this release we make available the old "mini" pmem imager based on the old 1.6 branch. This imager is very simple - it can only make raw images. The AFF4 based imager may be back in the future but for now we can produce RAW images.

We started to distribute Winpmem releases directly from this project as it is now separated from the Rekall project (which has been discontinued).

The new drivers implement Fast IO mode so should be faster than before.

There is now also an experimental Go userspace imager which supports 3 methods of compression (Snappy, S2 and Gzip). Use the -h flag to see usage instruction.

NOTE

For production use please use the go-winpmem_amd64_1.0-rc2_signed.exe binary below which contains the old drivers using the new Golang userspace program. Unfortunately we do not have the possibility of signing the new drivers so for the foreseeable future this remains the only version available for production use.

Thanks

We would like to thank Emre Tinaztepe and Mehmet GÖKSU at Binalyze as well as Viviane Zwanger for making this release possible.