BAM vs Prefetch vs ShimCache vs Amcache: Which to Trust
Side-by-side comparison of Windows program execution evidence: what BAM, Prefetch, ShimCache and Amcache record, how long they keep it, and how to combine them.
Series
BAM compared
3 posts in this series. Read them in order or jump to any one.
- BAM vs Prefetch vs ShimCache vs Amcache: Which to Trust
Side-by-side comparison of Windows program execution evidence: what BAM, Prefetch, ShimCache and Amcache record, how long they keep it, and how to combine them.
- BAM vs UserAssist: Two Per-User Execution Artifacts
BAM and UserAssist both tie program execution to a user. Compare their locations, timestamps, run counts, coverage of GUI and background launches and retention.
- BAM Parser Comparison: RegRipper, EZ Tools, Velociraptor
A fair look at the tools that parse BAM and DAM: RegRipper bam.pl, Registry Explorer's BamDam plugin, Velociraptor, Plaso and BAM/DAM Parser: coverage, gaps.
All posts in this series
BAM vs UserAssist: Two Per-User Execution Artifacts
BAM and UserAssist both tie program execution to a user. Compare their locations, timestamps, run counts, coverage of GUI and background launches and retention.
BAM Parser Comparison: RegRipper, EZ Tools, Velociraptor
A fair look at the tools that parse BAM and DAM: RegRipper bam.pl, Registry Explorer's BamDam plugin, Velociraptor, Plaso and BAM/DAM Parser: coverage, gaps.