Guidance for visualisation of volatile memory

The following video shows an experimental interactive memory debugger and visualiser called ICU64, running against the  Frodo C64 emulator

The video below shows an interactive exploration of the memory space of the emulated C64 while it runs the game “Cataball”, pointing out correspondences between the raw memory and the on-screen action.

Hex editor authors and forensic tool manufacturers should take note of the zoomable memory map.

[via Root Labs Rdist]


OzCar email faked by producer

In late June I wrote about the forged email that had been at the heart of a political scandal. Mr Godwin Grech at the time claimed he had received an email from the office of the Prime Minister of Australia pushing for preferential treatment of a friend of the PM. The Australian Federal Police raided Mr. Grech’s home and found the email in question, deleted, on his home computer. They pronounced it a fake.

Today, The Australian is reporting that Mr. Grech last night admitted to having faked the email.  Mr. Grech claims that he recollected receiving an original email similar to the one in question. Unable to find the original, he concocted the fake one in order to substantiate verbal claims he had made about the matter.