DAM

Location & availability

SYSTEM hive: Services\dam\...\UserSettings where implemented

Presence and schema depend on the operating-system build and power-management configuration.

Fields to examine

• User SID and application path where recorded.
• Activity values interpreted by a parser that supports the source build.
• The actual key layout and collection time.

What it can establish

• Provide additional application activity context when supported records exist.

What it cannot prove

• Guarantee the same coverage or timestamp semantics as BAM.
• Treat an absent DAM key as evidence of deleted activity.

Use it in a screenshare

1. Record the Windows build and export the relevant hive without enabling services or changing power settings.
2. Check the actual DAM key layout and the parser’s support. If a value is not documented, preserve it as uninterpreted data.
3. Compare with BAM, Prefetch or process events before assigning a run time or user association. Report unsupported interpretations as unresolved.

Worked example

A system has BAM records but no useful DAM entries. The correct result is that DAM supplied no additional evidence for this examination, not that the player removed a history database.

Cross-check the finding

• BAM →Support recent executable activity associated with a Windows user SID.
• Prefetch →Support execution of an associated executable within the retained history.

Sources

• RECmd — registry parser and batch definitions ↗
• Velociraptor — Windows execution artifacts ↗