BAM Parser Comparison: RegRipper, EZ Tools, Velociraptor
A fair look at the tools that parse BAM and DAM: RegRipper bam.pl, Registry Explorer's BamDam plugin, Velociraptor, Plaso and BAM/DAM Parser: coverage, gaps.
Posts tagged: #bam
BAM vs UserAssist: Two Per-User Execution Artifacts
BAM and UserAssist both tie program execution to a user. Compare their locations, timestamps, run counts, coverage of GUI and background launches and retention.
BAM vs Prefetch vs ShimCache vs Amcache: Which to Trust
Side-by-side comparison of Windows program execution evidence: what BAM, Prefetch, ShimCache and Amcache record, how long they keep it, and how to combine them.
BAM Evidence of Execution: A Lateral Movement Case
A fictional investigation on FIN-WKS-07 read through BAM: phishing, a hijacked service account, scanning, PsExec, RDP and rclone — and what BAM could not show.
BAM SID to Username: Attributing Execution to a User
How BAM ties programs to accounts: reading the SID, resolving it via ProfileList, SAM or the domain, well-known SIDs like SYSTEM and DWM, and traps to avoid.
How to Analyze BAM and DAM Registry Keys, Step by Step
A practical workflow to parse BAM/DAM from a SYSTEM hive: collect, parse in the browser, scope by user and control set, triage flags, corroborate and export.
BAM Limitations and Anti-Forensics: What BAM Misses
Seven-day pruning, deleted executables, removable and network paths, console tools, dirty hives and tampering: every known BAM blind spot and how to detect it.
Desktop Activity Moderator (DAM) Forensics Explained
What the Desktop Activity Moderator is, why its registry key is empty on most desktops, how DAM entries differ from BAM, and how to use them on laptops.
BAM Across Windows Versions: 1709, 1809, 11 and Server
Which Windows builds have BAM and DAM, where the key moved in 1809, what an upgraded host looks like, and what to check on Windows 11 and Windows Server.
BAM Value Data Format: FILETIME, Paths and Internals
Byte-level walkthrough of a BAM registry value: the 24-byte REG_BINARY, the FILETIME, device paths vs package names, Version, SequenceNumber and key times.
BAM Registry Key: Where It Is and How to Collect It
The exact BAM and DAM registry paths per Windows build, why CurrentControlSet doesn't exist offline, and how to acquire SYSTEM with its transaction logs.
BAM/DAM Forensics: The Complete Guide to Windows BAM
What the Windows Background Activity Moderator records, where BAM and DAM live in the SYSTEM hive, what they prove, what they miss, and how to read them.