BAM Parser Comparison: RegRipper, EZ Tools, Velociraptor
A fair look at the tools that parse BAM and DAM: RegRipper bam.pl, Registry Explorer's BamDam plugin, Velociraptor, Plaso and BAM/DAM Parser: coverage, gaps.
TL;DR. Every mainstream tool decodes the BAM FILETIME correctly; they differ in which keys they read. RegRipper's bam.pl reads only bam\State\UserSettings in the current control set. Eric Zimmerman's BamDam plugin covers both BAM layouts and the older DAM path across control sets. Velociraptor's artifact reads both BAM layouts live and resolves user names. Plaso reads both BAM layouts into a super-timeline. BAM/DAM Parser reads BAM and DAM in both layouts across all control sets, names SIDs from SOFTWARE, and runs in a browser — but doesn't replay transaction logs or run headless. Pick by context, and know what each one skips.
We build one of the tools in this comparison, so the method matters: every claim about another tool below is taken from its published source code or documentation, linked in each section, as of September 2026. Tools change; check the version you run. If you're new to the artifact, start with the BAM/DAM forensics guide.
Coverage matrix
RegRipper bam.pl | EZ BamDam plugin (Registry Explorer / RECmd) | Velociraptor Windows.Forensics.Bam | Plaso bam plugin | BAM/DAM Parser | |
|---|---|---|---|---|---|
| Input | Offline hive | Offline hive | Live endpoint | Offline image/hive | Offline hive(s), folder, ZIP |
bam\State\UserSettings (1809+) | ✓ | ✓ | ✓ | ✓ | ✓ |
bam\UserSettings (1709–1803) | — | ✓ | ✓ | ✓ | ✓ |
dam\UserSettings (older layout) | — | ✓ | — | — | ✓ |
dam\State\UserSettings | — | not in the published key list | — | — | ✓ |
| Control sets | Current only | All ControlSet00* | CurrentControlSet (live) | CurrentControlSet as resolved by Plaso | All, active one marked |
| SID → name | — | — | ✓ (via users()) | — | ✓ (ProfileList + well-known SIDs) |
| Dirty hive handling | Check your version | Replays logs (Registry Explorer / RECmd) | N/A (live) | See Plaso docs | Detects and warns; no replay |
| Output | Text report; bam_tln.pl for TLN | Grid, CSV via RECmd batch | VQL rows | Plaso storage → timelines | Table, CSV, JSON |
| Runs where | Windows/Perl | Windows (.NET) | Any Velociraptor client | Python/Docker | Any modern browser |
RegRipper bam.pl
Harlan Carvey's plugin (version 20200904 in RegRipper 4.0) reads Select\Current, builds ControlSet00<n>\Services\bam\State\UserSettings, and for each SID subkey prints each REG_BINARY value as an ISO-8601 time and the value name. A sibling plugin, bam_tln.pl, emits the TLN timeline format.
Strengths: fast, scriptable, part of a toolkit most examiners already run; TLN output drops straight into a timeline workflow.
Gaps, from the source: no legacy bam\UserSettings (a 1709–1803 image reports "not found"), no dam, only the current control set, SIDs not resolved to names. For a Windows 10 1809+ host where you only need the current BAM state, it's enough.
Eric Zimmerman's BamDam plugin (Registry Explorer, RECmd)
The RegistryPlugin.Bam plugin (version 0.5) registers for ControlSet00*\Services\bam\UserSettings\*, ControlSet00*\Services\dam\UserSettings\* and ControlSet00*\Services\bam\State\UserSettings\*, skips Version and SequenceNumber, and outputs program path and execution time in UTC. Registry Explorer and RECmd handle transaction-log replay for dirty hives, which is a real advantage.
Strengths: the plugin appears whenever you browse a matching key in Registry Explorer, next to every other registry artifact; RECmd batch files turn it into CSV across many hives; log replay is built in.
Gaps, from the source: the published key list doesn't include dam\State\UserSettings, so DAM data on 1809+ Modern Standby devices may need a manual look; SIDs aren't resolved to names in the plugin output.
Velociraptor Windows.Forensics.Bam
The artifact globs HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\UserSettings\*\* and ...\bam\State\UserSettings\*\* by default (a bamKeys parameter lets you change them), resolves each SID with the users() plugin, and returns SID, UserName, Binary and Bam_time. A userRegex parameter filters accounts.
Strengths: fleet-wide hunting in minutes; live data without collecting a hive; user names resolved on the endpoint.
Gaps: DAM isn't in the default globs; only the live CurrentControlSet; it runs on the endpoint, so collecting the hive files as well is still wise for evidence preservation.
Plaso bam plugin
Plaso's Windows Registry parser includes a BAM plugin whose filters cover CurrentControlSet\Services\bam\UserSettings and ...\bam\State\UserSettings. Events land in the super-timeline with every other artifact Plaso extracts.
Strengths: BAM next to file system, event log and browser events in one timeline.
Gaps: no DAM filter in the published plugin; like all of Plaso, heavier to run than a single-artifact tool.
BAM/DAM Parser (this site)
What the tool does: Rust compiled to WebAssembly, run in a Web Worker; reads bam and dam in both layouts in every ControlSet00X, marks the one from Select\Current, resolves SIDs from a SOFTWARE hive's ProfileList and labels well-known SIDs, reads host name and time zone, detects dirty hives, accepts loose files, folders and ZIP triage collections (and explains every file it skipped), flags four heuristic patterns, exports CSV (formula-injection safe) and JSON.
Strengths: nothing to install, nothing uploaded, works from a locked-down analysis laptop; complete key coverage; attribution and host context in one screen; 100 ns timestamps and raw data kept.
Gaps, stated plainly:
- No transaction-log replay. It warns you; replay with
rla.exeor Registry Explorer first. - No SAM parsing — names come from profile folders, which may not match renamed accounts (attribution caveats).
- No command-line / headless mode for batch processing hundreds of hosts; use RECmd, Plaso or Velociraptor for that.
- Single-artifact. It does BAM/DAM only; the rest of the registry is for Registry Parser or the tools above.
Choosing
| Situation | Reasonable pick |
|---|---|
| Live fleet hunt for a tool name | Velociraptor |
| Full registry review of one image on a Windows forensic workstation | Registry Explorer (BamDam plugin) |
| Scripted batch over many hives to CSV | RECmd or RegRipper |
| Super-timeline of an image | Plaso |
| Quick, private look at a SYSTEM hive, with users and DAM, anywhere | BAM/DAM Parser |
| Older 1709–1803 image | Anything except bam.pl |
Cross-checking tools
On anything that goes into a report, parse the same hive with two tools and compare counts per SID. Differences almost always come from coverage (legacy layout, DAM, other control sets) or from log replay. Our step-by-step guide shows where each of those appears in the interface, and the format article explains what every column means at byte level.