computer forensics, computer forensics expert, mobile phone forensics, expert witness

Inside Out

Guidance for visualisation of volatile memory

The following video shows an experimental interactive memory debugger and visualiser called ICU64, running against the Frodo C64 emulator.

The video below shows an interactive exploration of the memory space of the emulated C64 while it runs the game “Cataball”, pointing out correspondences between the raw memory and the on-screen action.

Hex editor authors and forensic tool manufacturers should take note of the zoomable memory map.

[via Root Labs Rdist]