Glossary
SYSTEM hive
The Windows registry hive file at C:\Windows\System32\config\SYSTEM that backs HKLM\SYSTEM: services, control sets, and the BAM and DAM keys.
The SYSTEM hive is the file C:\Windows\System32\config\SYSTEM, loaded as HKEY_LOCAL_MACHINE\SYSTEM (Microsoft Learn: registry hives). It holds the machine's control sets — services and drivers, computer name, time zone, mounted devices — and the bam and dam service keys where BAM records execution.
It is locked while Windows runs, so collect it with a raw-copy tool or reg save, together with its transaction logs SYSTEM.LOG1 and SYSTEM.LOG2 (see dirty hive). Acquisition options are compared in where the BAM registry key is.