Package rekall :: Package plugins :: Package addrspaces :: Module pagefile
[frames] | no frames]

Module pagefile

source code

This address space overlays a pagefile into the physical address space.

This essentially implements the --pagefile parameter. Note that for images taken with winpmem there is no need to specify the pagefile specifically since it is already detected by the Elf64CoreDump class.


Author: Michael Cohen <scudette@gmail.com>

Classes
  PagefilePhysicalAddressSpace
Variables
  __package__ = 'rekall.plugins.addrspaces'