Abstract: Various technologies pertaining to computer-executable instruction sequence forensics are described herein. In a general embodiment, an application development framework supports a function library that includes a plurality of recording functions. Calls to these functions are inserted into source code or bytecode of the computer-executable instruction sequence. The source code is then compiled, resulting in formation of instrumented machine code of the computer-executable instruction sequence. Alternately, the runtime environment interprets instrumented bytecode for the instruction sequence. A processor executes the machine code, and the called functions cause the processor to generate forensic data pertaining to portions of the computer-executable instruction sequence that correspond to locations in the source code where the calls were inserted. An execution instance of the computer-executable instruction sequence is visualized based upon the forensic data.