BAM

Location & availability

SYSTEM hive: Services\bam\State\UserSettings\<SID>; older layouts differ

Available on supported Windows 10/11 builds. Not every application or launch mechanism leaves a retained BAM entry.

Fields to examine

• User SID associated with the record.
• Executable path and parsed activity timestamp.
• Hive source, control set and Windows build.

What it can establish

• Support recent executable activity associated with a Windows user SID.
• Correlate a path and time with the disputed session.

What it cannot prove

• Identify the physical person using an account.
• Recover a complete launch history from a record that retains only recent activity.

Use it in a screenshare

1. Preserve the SYSTEM hive before deliberately running the candidate executable.
2. Resolve the SID using the examined machine’s profile information. Parse timestamps with a build-aware registry tool.
3. Compare the path and time with Prefetch and process events. State if the record is absent, overwritten or outside the relevant retention window.

Worked example

A BAM value associates a renamed executable with the active profile near the session time. This is useful execution context. Confirm the bytes or program identity separately and avoid presenting the SID as proof of who was physically at the keyboard.

Cross-check the finding

• Prefetch →Support execution of an associated executable within the retained history.
• UserAssist →Support shell-associated application activity in a particular profile.
• Security event 4688 →Support process creation recorded by the audited host.

Sources

• Velociraptor — Windows execution artifacts ↗
• RECmd — registry parser and batch definitions ↗