Module data_export

source code

This module implements the data export renderer.

The data export renderer is a way of exporting structured data from Rekall. The renderer is based on the JsonRenderer but has a different goal - while the JsonRenderer is designed to be able to exactly recreate the objects in the future the data export renderer aims to include useful information about exported objects.

For example, in order to decode the JsonRenderer output one must have access to the original image, since the decoder will generate the exact BaseObject() instances that the encoder used.

Not so with the data exporter - the exported data contains a lot of additional information about the exported objects. The exported data also omits information which is not relevant without access to the original image.