Glossary
Evidence of execution
Forensic artifacts showing that a program ran on a system — BAM, Prefetch, Amcache, UserAssist, event logs — each with different scope, timing and reliability.
Evidence of execution is the family of artifacts investigators use to show that a program ran, when, and ideally under which account. On Windows it includes BAM/DAM, Prefetch, Amcache, ShimCache (file presence rather than execution on Windows 10+), UserAssist, SRUM and process-creation events (4688, Sysmon event 1). The SANS Windows Forensic Analysis poster groups them this way.
No single artifact is complete: BAM is per-user but short-lived, Prefetch keeps counts but no user, Amcache identifies files by hash. Findings are strongest when several agree. Compare them in BAM vs Prefetch vs ShimCache vs Amcache.