BAM vs UserAssist: Two Per-User Execution Artifacts
BAM and UserAssist both tie program execution to a user. Compare their locations, timestamps, run counts, coverage of GUI and background launches and retention.
Posts tagged: #program-execution
BAM vs Prefetch vs ShimCache vs Amcache: Which to Trust
Side-by-side comparison of Windows program execution evidence: what BAM, Prefetch, ShimCache and Amcache record, how long they keep it, and how to combine them.
BAM Evidence of Execution: A Lateral Movement Case
A fictional investigation on FIN-WKS-07 read through BAM: phishing, a hijacked service account, scanning, PsExec, RDP and rclone — and what BAM could not show.
BAM SID to Username: Attributing Execution to a User
How BAM ties programs to accounts: reading the SID, resolving it via ProfileList, SAM or the domain, well-known SIDs like SYSTEM and DWM, and traps to avoid.
How to Analyze BAM and DAM Registry Keys, Step by Step
A practical workflow to parse BAM/DAM from a SYSTEM hive: collect, parse in the browser, scope by user and control set, triage flags, corroborate and export.
BAM Limitations and Anti-Forensics: What BAM Misses
Seven-day pruning, deleted executables, removable and network paths, console tools, dirty hives and tampering: every known BAM blind spot and how to detect it.
BAM/DAM Forensics: The Complete Guide to Windows BAM
What the Windows Background Activity Moderator records, where BAM and DAM live in the SYSTEM hive, what they prove, what they miss, and how to read them.