Be notified of new releases
Create your free GitHub account today to subscribe to this repository for new releases and build software alongside 36 million developers.Sign up
This is the first release of the new refactored code. The following things are supported:
- Split volumes (e.g.
winpmem.exe -t -dd -o test.aff4 --split 10m -i c:\Windows\System32\*)
- Directory volume (e.g.
winpmem.exe -t -dd -o test/)
- Extracting from multiple AFF4 volumes (e.g.
winpmem.exe -dd -e "*notepad*" -D . test.aff4*)
This is a Winpmem release. The binary is now distributed signed.
Quick start - to obtain an image in aff4 format with progress reporting:
winpmem_3.2.exe -dd -o test.aff4 -t
If you just want raw image:
winpmem_3.2.exe -o test.raw --volume_format raw -dd -t
More details on http://docs.aff4.org/en/latest/
Latest RC release is RC10: 6545c07a6cc3eac45990a47988b43f1fbb1be3c55c91a8f37617c1c336e01356
This release addresses a critical bug which causes a BSOD for windows systems running VSM.
We are extremely thankful to Emre Tinaztepe from Binalyze who signed the fixed drivers and donated them back into the community!
Please test this release on VSM enabled systems.
A bug fix release for pmem tools.
- Pmem is released at version 3.0 (while the AFF4 library is released at 1.0).
- Since the pmem tools are functionally equivalent to the aff4 imager (with extra memory capabilities) we just release the pmem tools as the main user facing tool.
This is the first release of the AFF4 imager tool which complies with the AFF4 Standard v1.0.