Release 3.3 RC3

This is a bugfix release - VSM support was broken due to file cache.

Release 3.3 RC2

This is primarily a bug fix release:

• Log output is written to stdout without color when stdout is not a terminal.
• Deflate mode is now default

Release 3.3

This is the first release of the new refactored code. The following things are supported:

• Split volumes (e.g. winpmem.exe -t -dd -o test.aff4 --split 10m -i c:\Windows\System32\* )
• Directory volume (e.g. winpmem.exe -t -dd -o test/ )
• Extracting from multiple AFF4 volumes (e.g. winpmem.exe -dd -e "*notepad*" -D . test.aff4* )

Release 3.2

This is a Winpmem release. The binary is now distributed signed.

Quick start - to obtain an image in aff4 format with progress reporting:

winpmem_3.2.exe -dd -o test.aff4 -t

If you just want raw image:

winpmem_3.2.exe -o test.raw --volume_format raw -dd -t

More details on http://docs.aff4.org/en/latest/

Bugfix release for winpmem

Latest RC release is RC10: 6545c07a6cc3eac45990a47988b43f1fbb1be3c55c91a8f37617c1c336e01356

Release of WinPmem 3.1.rc1

This release addresses a critical bug which causes a BSOD for windows systems running VSM.

We are extremely thankful to Emre Tinaztepe from Binalyze who signed the fixed drivers and donated them back into the community!

Please test this release on VSM enabled systems.

SHA256

RC3 92150af748ede27a95b73d6021594488704144d33625a0fb9842d6bed6c1358b

Bugfix release

Fixes issue with windows binary (#31)

Release 1.0 RC2

A bug fix release for pmem tools.

Release Notes

• Pmem is released at version 3.0 (while the AFF4 library is released at 1.0).
• Since the pmem tools are functionally equivalent to the aff4 imager (with extra memory capabilities) we just release the pmem tools as the main user facing tool.

Version 1.0

This is the first release of the AFF4 imager tool which complies with the AFF4 Standard v1.0.