Package rekall :: Package plugins :: Package windows :: Module cache

Module cache

This module adds plugins to inspect the windows cache manager.

The windows cache manager is responsible for maintaining file cache for files read from disk. The manager maintains a large arena of 256kb cached blocks. These blocks are controlled using the VACB (Virtual Address Control Block) arrays.

References: http://www.codemachine.com/article_kernelstruct.html

Author: Michael Cohen <scudette@google.com>

Classes
	EnumerateVacbs Enumerate all blocks cached in the cache manager.
	DumpFiles Dump files from memory.
	TestDumpFiles
	SparseArray
	MftDump Enumerate MFT entries from the cache manager.
	TestMftDump The order is someone non-deterministic.

Variables
	__package__ = `'rekall.plugins.windows'`