BAM Parser Comparison: RegRipper, EZ Tools, Velociraptor
A fair look at the tools that parse BAM and DAM: RegRipper bam.pl, Registry Explorer's BamDam plugin, Velociraptor, Plaso and BAM/DAM Parser: coverage, gaps.
Blog
Articles, guides, and updates.
BAM vs UserAssist: Two Per-User Execution Artifacts
BAM and UserAssist both tie program execution to a user. Compare their locations, timestamps, run counts, coverage of GUI and background launches and retention.
BAM vs Prefetch vs ShimCache vs Amcache: Which to Trust
Side-by-side comparison of Windows program execution evidence: what BAM, Prefetch, ShimCache and Amcache record, how long they keep it, and how to combine them.
BAM Evidence of Execution: A Lateral Movement Case
A fictional investigation on FIN-WKS-07 read through BAM: phishing, a hijacked service account, scanning, PsExec, RDP and rclone — and what BAM could not show.
BAM SID to Username: Attributing Execution to a User
How BAM ties programs to accounts: reading the SID, resolving it via ProfileList, SAM or the domain, well-known SIDs like SYSTEM and DWM, and traps to avoid.
How to Analyze BAM and DAM Registry Keys, Step by Step
A practical workflow to parse BAM/DAM from a SYSTEM hive: collect, parse in the browser, scope by user and control set, triage flags, corroborate and export.
BAM Limitations and Anti-Forensics: What BAM Misses
Seven-day pruning, deleted executables, removable and network paths, console tools, dirty hives and tampering: every known BAM blind spot and how to detect it.
Desktop Activity Moderator (DAM) Forensics Explained
What the Desktop Activity Moderator is, why its registry key is empty on most desktops, how DAM entries differ from BAM, and how to use them on laptops.
BAM Across Windows Versions: 1709, 1809, 11 and Server
Which Windows builds have BAM and DAM, where the key moved in 1809, what an upgraded host looks like, and what to check on Windows 11 and Windows Server.