Rekall uses Python as its scripting language, to allow you to provide functionality over and above Rekall's basic data display and update facilities. As well as giving access to both the data that is retrieved from the server database and control over how it is displayed, you can have access to all the python libraries that are available. This chapter describes how to use python scripting in Rekall and assumes at least a basic knowledge of python.
Scripts can be located in three places. First, they can be embedded in form and report objects, whence they are executed in response to various events. Secondly, they can be embedded in form and report objects as parts of expressions. And thirdly, they are stored in script modules which are in effect libraries available for import, much as the standard Python libraries.
Since, in this release at least, scripts execution always starts with an event, the next section deals with events.
Rekall uses a number of scripts itself, both to provide some common script functions (for instance the code which allows record navigation buttons to be easily defined), and to support internal functionality, such as table design and data display. These can be seen in $PREFIX/share/apps/rekall/script/py/.
Introduction to Scripting