Glossary
Background Activity Moderator (BAM)
A Windows 10 1709+ kernel driver (bam.sys) that throttles background apps and keeps a per-user list of executables with a timestamp in the SYSTEM hive.
The Background Activity Moderator is a Windows service driver (bam.sys) introduced with Windows 10 version 1709. It moderates the activity of background applications and, to do so, stores one registry key per user SID under SYSTEM\ControlSet00X\Services\bam\State\UserSettings (or bam\UserSettings before 1809). Each value is an executable path whose data starts with a FILETIME.
For investigators it is per-user evidence of execution covering roughly the last week: reverse engineering by Maxim Suhanov shows entries older than seven days are removed at boot.
Read more in the BAM/DAM forensics guide, or parse a hive with the BAM/DAM Parser.