A computer implemented method of identifying unauthorized activities on a computer system, said computer system comprising: one or more processors; and memory segmented into multiple pages, said memory storing one or more programs for execution by the one or more processors, said method comprising: locating a list of target addresses; while executing at least one of the one or more programs: in response to detecting a request to execute an instruction located at a first address of a first page: locating a first page table entry corresponding to the first page, the first page table entry having a first executability state; and determining the first executability state; when the first executability state is non-executable, identifying a first set of one or more target addresses in the list of target addresses that correspond to the first page; identifying a second set of one or more target addresses in the list that correspond to one or more pages other than the first page; storing one or more target addresses of the first set of target addresses in breakpoint registers of the computer system, each breakpoint register configured to store an address of a respective breakpoint in the memory; setting the first executability state of the first page table entry as executable; and setting the executability states of page table entries that correspond to the second set of target addresses as non-executable; and when the first address corresponds to one of the target addresses stored in the breakpoint registers, recording forensic data associated with the request to execute the instruction located at the first address. locating a list of target addresses; in response to detecting a request to execute an instruction located at a first address of a first page: locating a first page table entry corresponding to the first page, the first page table entry having a first executability state; and determining the first executability state; locating a first page table entry corresponding to the first page, the first page table entry having a first executability state; and determining the first executability state; when the first executability state is non-executable, identifying a first set of one or more target addresses in the list of target addresses that correspond to the first page; identifying a second set of one or more target addresses in the list that correspond to one or more pages other than the first page; storing one or more target addresses of the first set of target addresses in breakpoint registers of the computer system, each breakpoint register configured to store an address of a respective breakpoint in the memory; setting the first executability state of the first page table entry as executable; and setting the executability states of page table entries that correspond to the second set of target addresses as non-executable; and identifying a first set of one or more target addresses in the list of target addresses that correspond to the first page; identifying a second set of one or more target addresses in the list that correspond to one or more pages other than the first page; storing one or more target addresses of the first set of target addresses in breakpoint registers of the computer system, each breakpoint register configured to store an address of a respective breakpoint in the memory; setting the first executability state of the first page table entry as executable; and setting the executability states of page table entries that correspond to the second set of target addresses as non-executable; and when the first address corresponds to one of the target addresses stored in the breakpoint registers, recording forensic data associated with the request to execute the instruction located at the first address.