BAM/DAM Forensics Cheat Sheet

What it is

The Background Activity Moderator (BAM) is a Windows service driver, introduced in Windows 10 version 1709, that throttles background applications. The Desktop Activity Moderator (DAM) does a similar job, mainly on devices with modern standby. To do this they track executables per user and store the time each one was last seen running in the SYSTEM hive. The result is one of the few execution artifacts that is attributed to a user SID.

Location

Windows build	Key (SYSTEM hive)
10 1709 – 1803	`ControlSet00x\Services\bam\UserSettings\<SID>` and `ControlSet00x\Services\dam\UserSettings\<SID>`
10 1809 and later, 11	`ControlSet00x\Services\bam\State\UserSettings\<SID>` and `ControlSet00x\Services\dam\State\UserSettings\<SID>`

Each value name under a SID key is an executable, written as a device path (\Device\HarddiskVolume3\Windows\System32\cmd.exe) or, for packaged apps, the package family name. Map HarddiskVolumeN to a drive letter with MountedDevices or the volume layout of the image. Map the SID to an account with ProfileList in the SOFTWARE hive (see SAM and user accounts).

Windows 7 and 8 do not have BAM.

What it proves

Execution by a user: the SID key tells you which account the process ran under.
Last execution time for each executable.
It does not give a run count, the first execution time or the command line, and it only keeps recent activity (see retention).

Key fields

Field	Meaning
SID subkey	Security identifier of the user who ran the program
Value name	Executable device path or packaged app identifier
Value data, bytes 0–7	Last execution time, FILETIME
`Version`, `SequenceNumber`	Bookkeeping values present under each SID key, not executables

Timestamps

Timestamp	Set when	Format	Pitfalls
Value data (first 8 bytes)	Updated while/when the program runs in the user session	FILETIME, UTC	It is the last execution only; a program still running may show a time close to acquisition
SID key LastWrite	Any value under the key changes	FILETIME, UTC	Tells you when the most recent update happened, not which value changed

Retention and clearing

Entries older than about seven days are removed when the system boots, so BAM mostly covers the week before the last reboot. Earlier activity may survive in shadow-copy SYSTEM hives.
Deleting a user's SID key or individual values requires SYSTEM-level access to the hive; gaps compared with Prefetch or Amcache deserve a second look.
Programs executed from removable media still appear, with the removable volume's device path.

Collection

KAPE target: RegistryHivesSystem (SYSTEM plus .LOG1/.LOG2); KAPE's --vss option adds the copies held in shadow copies.
Velociraptor (Windows.Triage.Targets): RegistryHivesSystem; the Windows.Forensics.Bam artifact parses BAM live.
Built-in:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings" /s
reg save HKLM\SYSTEM E:\case\SYSTEM.hiv

Parsing tools

Registry Explorer / RECmd (Eric Zimmerman): browse the keys interactively; the community RECmd batch files (such as Kroll_Batch.reb) extract BAM/DAM to CSV.
RegRipper: bam plugin.
Velociraptor: Windows.Forensics.Bam.

Investigation tips

Because BAM is per SID, it is the quickest way to answer "who ran it": check for tools under a service account or an unexpected local account.
Convert device paths carefully: HarddiskVolume numbers change between systems and boots of different disks.
Correlate with UserAssist (GUI launches by the same user) and with logon sessions in the event logs.
For an older incident, parse the SYSTEM hive from every volume shadow copy to recover entries that were pruned.
Expect every ControlSet00x to be parsed; offline hives have no CurrentControlSet (control set).

BAM / DAM (Background Activity Moderator)

Tools