Skip to content
BAM/DAMparser
Blog

Windows execution evidence · SYSTEM hive

BAM/DAM Parser

Every program a user ran, with its last execution time, straight from the SYSTEM hive. Parsed in your browser with WebAssembly — nothing is uploaded.

  • Per user, per SID
  • FILETIME to 100 ns
  • Rust → WebAssembly, offline

Drop a SYSTEM hive here

Add the SOFTWARE hive too to turn SIDs into user names. Folders and ZIP triage collections (KAPE, Velociraptor) work as-is.

Synthetic hives from a fictional intrusion — no real data.

100% client-side: hives are parsed by WebAssembly in your browser and never uploaded.

How to get your data

Two hives, one admin command, under a minute.

  1. CollectExport SYSTEM (plus SOFTWARE for user names).
  2. DropDrop the files, the folder or the ZIP onto this page.
  3. Stays localParsed in your browser; nothing is uploaded.

On the live Windows host, open PowerShell or Command Prompt with “Run as administrator” and paste one of these lines.

PowerShell · admin
New-Item -ItemType Directory -Force C:\triage | Out-Null; reg save HKLM\SYSTEM C:\triage\SYSTEM /y; reg save HKLM\SOFTWARE C:\triage\SOFTWARE /y
Command Prompt · admin
mkdir C:\triage 2>nul & reg save HKLM\SYSTEM C:\triage\SYSTEM /y & reg save HKLM\SOFTWARE C:\triage\SOFTWARE /y

You get C:\triage\SYSTEM and C:\triage\SOFTWARE. Drop the C:\triage folder (or both files) on the drop zone. reg save writes a consolidated copy, so changes still pending in the transaction logs are included.

Gotchas

  • A plain copy fails while Windows runs, and some backup tools return a file full of zeros: use reg save or a raw-copy tool.
  • Windows prunes BAM entries older than about a week at boot: collect before the host is rebooted.
  • Raw copies can be dirty, with the newest executions still in SYSTEM.LOG1/LOG2: this tool warns but does not replay them.

What is BAM?

The Background Activity Moderator (BAM) is a Windows service driver, added in Windows 10 1709, that throttles background applications. To do that it records, per user, the full path of each executable it sees and the last time it ran.

The Desktop Activity Moderator (DAM) keeps the same kind of record for desktop apps under Modern Standby. Both are stored in the SYSTEM hive, which makes them a compact, per-user source of evidence of execution.

Where BAM and DAM are stored

  • Hive file: C:\Windows\System32\config\SYSTEM
  • Windows 10 1809+ and Windows 11: ControlSet00X\Services\bam\State\UserSettings\<SID> (and dam\State\UserSettings)
  • Windows 10 1709–1803: ControlSet00X\Services\bam\UserSettings\<SID>
  • Each value is named after an executable (\Device\HarddiskVolumeN\… or a packaged-app name); its data starts with an 8-byte FILETIME: the last execution time, in UTC.

Why it matters in an investigation

  • Ties a program to a user account through its SID — unlike ShimCache or Prefetch.
  • Gives a precise timestamp of the program's last recorded activity (updated when it starts and when it exits), per user.
  • Works independently of Prefetch, so it can still help when Prefetch is disabled.

Limitations

  • Only the last execution is kept, not the first or a run count.
  • Windows prunes entries older than about a week at boot, so acquire early.
  • Programs run from removable media or network shares get no entry, and entries for deleted programs are removed at the next boot (Suhanov, 2020).
  • Paths use \Device\HarddiskVolumeN; map volume numbers to drive letters with other artifacts.

How to get the hive

  • SYSTEM is locked on a live system: collect it with KAPE (!SANS_Triage or RegistryHives target), Velociraptor, FTK Imager or reg save HKLM\SYSTEM.
  • Keep SYSTEM.LOG1 and SYSTEM.LOG2: a dirty hive may be missing the most recent BAM writes until the logs are replayed.
  • Add C:\Windows\System32\config\SOFTWARE to name each SID from the ProfileList.

FAQ

Is my hive uploaded anywhere?

No. The parser is Rust compiled to WebAssembly and runs in a Web Worker in your browser. There is no upload endpoint; you can use the site offline once loaded.

What is the difference between BAM and DAM?

BAM moderates background activity for every app; DAM does the same for desktop apps on Modern Standby devices. Their keys have the same format; DAM usually holds fewer entries.

Why do I see the same program in two control sets?

ControlSet002 is often an older last-known-good copy. Keep 'Active control set only' on for the current state, or turn it off to compare with the older snapshot.

How long do BAM entries last?

Windows removes entries older than roughly seven days when the system boots, so BAM mostly covers recent activity.

Which Windows versions have BAM?

Windows 10 1709 and later, and Windows 11. Earlier versions have no BAM key. Behaviour on Windows Server is not well documented: check whether the key exists.

Blog

Read the blog