This may be a similar mental image to how you learned addition and subtraction as a child. However, try to slow down and imagine that a physical chalkboard is being pulled from your brain’s hard disk drive (HDD) and placed into RAM, and this chalkboard is being used by you to physically write out “2+2=4,” spraying various amounts of chalk dust residue across your subconscious in the process. Unlike the eight ball, if I were to ask you what two plus two is, your processing of the question may not feel anything like how we imagined an eight ball.

It’s easy to understand visualizing a physical object, but we frequently visualize information without being consciously aware of it. If I were to ask you to imagine an eight ball from a billiards table and rotate it around with your mind’s eye, you would do so by actively using your “visuospatial sketchpad.” The eight ball is now in your brain’s RAM, having been pulled from the folder on your hard drive labeled “Billiards” or “Things I only know about from ESPN2” or “Activities I’ve Only Performed While Drinking.” You can think of our own working memory as random access memory (RAM) if it helps, as it is the place where things we’re actively contemplating reside. Human beings are creatures that primarily learn visually, thanks to what scientists refer to as the “visuospatial sketchpad,” a term used to describe the way our working memory functions. Say what, now? The Visuospatial Sketchpad As a digital forensic examiner, the act of “visualizing” can help us track investigations in progress, understand and comprehend the important elements of that investigation, and better express the outcomes of those investigations.Īdditionally, it can also make you better at your job in future investigations-or improve your skills at the Sunday paper Sudoku puzzle. It can be difficult to grasp and understand the intricate actions that the attacker is trying to achieve, or why. Two of these connections are downloading files, one is sending newly created files, and the fourth is simply listening.

Imagine an attacker breaches a host on a business’s domain and kicks off processes that establish connections to four different public internet protocols (IPs) simultaneously. There is rarely a straight A-to-B-to-C review with complete timestamps.

Digital forensics report template