01Location
- SYSTEM hive: ControlSet00n\Services\bam\UserSettings\<SID>
- SYSTEM hive: ControlSet00n\Services\bam\State\UserSettings\<SID>
- SYSTEM hive: ControlSet00n\Services\dam\UserSettings\<SID>
- SYSTEM hive: ControlSet00n\Services\dam\State\UserSettings\<SID>
02Questions it answers
- Which executables ran under which user SID?
- When was each executable last recorded as executed?
- Was the entry a packaged Windows app?
03Format and versions
| Format | One value per tracked executable, named with its device path (e.g. \Device\HarddiskVolume1\…\powershell.exe). 24-byte data: execution FILETIME (offset 0), 8 unknown bytes, a 4-byte flag indicating a Windows app (offset 16) and a 4-byte value observed as 2. |
|---|---|
| Applies to | winreg-kb states that BAM seems to have been introduced in Windows 10 after version 1709. |
04Key fields
| Field | What it tells you |
|---|---|
| <SID> key | User whose activity is recorded. |
| Value name | Kernel device path of the executable. |
| Execution time | FILETIME at offset 0 of the value data. |
| Windows app flag | 4-byte flag at offset 16. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Execution time | FILETIME (UTC) | Single time per executable and user; earlier executions are not retained in the value. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Parse the bam and dam keys in every control set of the SYSTEM hive.
- Resolve SIDs to accounts and convert device paths to drive letters using MountedDevices.
- Correlate execution times with Prefetch, AppCompatCache, Amcache and SRUM.
07Interpretation pitfalls
- The key structure is not documented by Microsoft; half of the value fields are unknown.
- The Windows version that introduced BAM is stated only approximately in the cited source.
- Only the latest execution time per executable is kept.
09Sources
- Background activity moderator (BAM) libyal / winreg-kb · checked 2026-10-14
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14
- RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14