Last night, I pushed a changelist that officially adds support for analysing OS X 10.10 (Yosemite) to Rekall. The profile for Yosemite is now available, and OSXPMem supports full memory acquisition and live analysis. You can install the latest pre-release version of Rekall from our github page.
Please let us know if you find any bugs!
This comment has been removed by the author.
ReplyDelete