Release 4.1

This is a pre-release for testing of the latest WinPmem 4.1.

In this release the driver is test signed so to test you will need to enable test signing on:

1. As admin run bcdedit /set testsigning on
2. Reboot
3. Use the minitool
4. To revert use bcdedit /set testsigning off

PS: Dbgprint is set verbose, you can use dbgview.exe from Microsoft Sysinternals to see all of it (check 'kernel capture' in the menu)

Release 4.0 RC2

This release fixes an issue with the drivers loading on recent Windows versions.

For this release we make available the old "mini" pmem imager based on the old 1.6 branch. This imager is very simple - it can only make raw images. The AFF4 based imager may be back in the future but for now we can produce RAW images.

We started to distribute Winpmem releases directly from this project as it is now separated from the Rekall project (which has been discontinued).

The new drivers implement Fast IO mode so should be faster than before.

There is now also an experimental Go userspace imager which supports 3 methods of compression (Snappy, S2 and Gzip). Use the -h flag to see usage instruction.

Thanks

We would like to thank Emre Tinaztepe and Mehmet GÖKSU at Binalyze as well as Viviane Zwanger for making this release possible.