BAM vs Prefetch vs ShimCache vs Amcache: Which to Trust
Side-by-side comparison of Windows program execution evidence: what BAM, Prefetch, ShimCache and Amcache record, how long they keep it, and how to combine them.
TL;DR. BAM answers which account ran a program and when, lately. Prefetch answers how often and what it loaded. Amcache answers which exact file (SHA-1). ShimCache answers was this path on disk. None of them answers everything, and each fails differently — BAM forgets after a week and skips USB and network paths, Prefetch can be off, ShimCache only flushes at shutdown, Amcache presence isn't always execution. Use them as co-witnesses.
This is the comparison we keep coming back to when writing up evidence of execution on Windows 10 and 11. For BAM itself, see the BAM/DAM forensics guide; for the per-user comparison with UserAssist, see BAM vs UserAssist.
At a glance
| BAM / DAM | Prefetch | ShimCache | Amcache | |
|---|---|---|---|---|
| Location | SYSTEM hive, Services\bam\State\UserSettings\<SID> | C:\Windows\Prefetch\*.pf | SYSTEM hive, Control\Session Manager\AppCompatCache | C:\Windows\AppCompat\Programs\Amcache.hve |
| Per user? | Yes (SID key) | No | No | No |
| Timestamps | Last recorded activity (1) | Up to 8 last run times (Win 8+), run count | File's last-modified time, not execution | Key/entry write times; not a clean "run time" |
| File identity | Path only | Name + path hash, volume serial | Path (+ size on some versions) | SHA-1, size, version, publisher |
| Retention | ~7 days, pruned at boot | Bounded number of .pf files; oldest replaced | Cache size limit; oldest evicted | Long-lived |
| Written | At process start/exit | Shortly after launch (first seconds monitored) | Only at shutdown | By inventory tasks |
| Missing from | USB, network shares, CLI console tools | Hosts with prefetch disabled | Recent session if no clean shutdown | Depends on inventory runs |
| Parse it | BAM/DAM Parser | Prefetch Parser | ShimCache Parser | Amcache Parser |
Sources: BAM — Suhanov, BAM internals; Prefetch — libscca format documentation; ShimCache — Mandiant, Caching Out; Amcache — ANSSI, Analysis of the AmCache.
(1) Updated at process creation and termination, per Suhanov.
Where BAM wins
Attribution. It's the only artifact in the table that puts a SID on the execution. When the question is "was it the service account or the user?", BAM decides it — see BAM user attribution.
Precision for the last run. A 100 ns FILETIME written at the moment of process activity, versus Prefetch's timestamps (also precise but system-wide) or ShimCache's file modification time, which isn't an execution time at all.
Independent of Prefetch settings. Prefetch is controlled by the EnablePrefetcher setting and is often unavailable on servers (why Prefetch is often missing on Windows Server). BAM doesn't depend on that setting — but on Server builds, first check that BAM is there at all (BAM across Windows versions).
Cheap to collect. It's in the SYSTEM hive you're collecting anyway.
Where BAM loses
Memory. About a week, pruned at boot; entries for deleted executables go at the next boot (limitations). Prefetch and Amcache can reach back much further.
Coverage. No entries for executables on removable media or network shares, and console programs launched from a command line were observed without entries. Prefetch still records programs started from a removable volume — its volume information then shows a serial that isn't the system drive's — which makes it the natural complement.
Identity. Path only. A renamed tool is invisible as such; Amcache's SHA-1 identifies it.
Depth. One timestamp. Prefetch gives up to eight run times, a run count and the list of files and directories the program touched in its first seconds — often enough to see which DLLs or documents it opened.
Reading combinations
| BAM | Prefetch | Amcache | ShimCache | Likely story |
|---|---|---|---|---|
| ✓ | ✓ | ✓ | ✓ | Executed, identified, attributed. Strongest position. |
| ✓ | — | ✓ | ✓ | Executed under that user; Prefetch disabled or cleaned. Check EnablePrefetcher and Prefetch folder timestamps. |
| — | ✓ | ✓ | ✓ | Executed, but BAM has no record: older than a week and rebooted, run from USB/share, CLI console launch, or deleted before a reboot. |
| ✓ | — | — | — | Recent execution, file identity unknown. Get the file or its hash from elsewhere. |
| — | — | — | ✓ | File was on disk; execution not shown. ShimCache alone is not proof of execution on Windows 10+. |
| — | — | ✓ | — | Inventory saw the file; execution needs corroboration (ANSSI's paper discusses when Amcache entries do and don't imply execution). |
Event logs: the fifth witness
Process creation events give the command line and parent process that none of the four artifacts has:
- Security 4688 — only if "Audit Process Creation" is enabled, and the command line only if that extra policy is set (Microsoft Learn).
- Sysmon event 1 — when Sysmon is deployed (Sysmon).
Parse them with EVTX Parser and join on path and time. BAM's user attribution plus 4688's command line is the pairing that ends most arguments.
A practical order of work
- BAM first — it's small, per user, and tells you which accounts to focus on.
- Prefetch — for run counts, earlier runs and CLI tools BAM missed.
- Amcache — hashes for every suspicious path from steps 1–2.
- ShimCache — paths that existed but show no execution elsewhere (dropped, never run, or run from somewhere BAM ignores).
- Event logs, SRUM, USN journal — command lines, network usage, file creation and deletion.
Frequently asked questions
Is BAM better than Prefetch?
Neither is better; they answer different questions. BAM attributes execution to a user account with one recent timestamp. Prefetch is system-wide but keeps a run count, up to eight run times and the files the program loaded. Use both when you can.
Which Windows artifact shows which user ran a program?
Among the classic execution artifacts, BAM/DAM (per-SID keys in SYSTEM) and UserAssist (in each user's NTUSER.DAT) are per user. Prefetch, ShimCache and Amcache are system-wide.