Sitemap
All pages on the site.
Home
Blog
- BAM Parser Comparison: RegRipper, EZ Tools, Velociraptor
- BAM vs UserAssist: Two Per-User Execution Artifacts
- BAM vs Prefetch vs ShimCache vs Amcache: Which to Trust
- BAM Evidence of Execution: A Lateral Movement Case
- BAM SID to Username: Attributing Execution to a User
- How to Analyze BAM and DAM Registry Keys, Step by Step
- BAM Limitations and Anti-Forensics: What BAM Misses
- Desktop Activity Moderator (DAM) Forensics Explained
- BAM Across Windows Versions: 1709, 1809, 11 and Server
- BAM Value Data Format: FILETIME, Paths and Internals
- BAM Registry Key: Where It Is and How to Collect It
- BAM/DAM Forensics: The Complete Guide to Windows BAM