BAM Value Data Format: FILETIME, Paths and Internals
Byte-level walkthrough of a BAM registry value: the 24-byte REG_BINARY, the FILETIME, device paths vs package names, Version, SequenceNumber and key times.
Blog
BAM Registry Key: Where It Is and How to Collect It
The exact BAM and DAM registry paths per Windows build, why CurrentControlSet doesn't exist offline, and how to acquire SYSTEM with its transaction logs.
BAM/DAM Forensics: The Complete Guide to Windows BAM
What the Windows Background Activity Moderator records, where BAM and DAM live in the SYSTEM hive, what they prove, what they miss, and how to read them.