Windows registry artifactBackground Activity Moderator (BAM)
Displays the last execution time of a program
- Program Execution
- 1 key
SYSTEM
Registry keys
1 key that RECmd reads for this artifact
SYSTEMControlSet*\Services\BAM\State\UserSettings\*Displays the last execution time of a program
References
4 links
- github.comBam plugin(opens in new tab)
- andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-execution-on-windows-systems/(opens in new tab)
- cellebrite.com/en/analyzing-program-execution-windows-artifacts/(opens in new tab)
- linkedin.com/pulse/alternative-prefetch-bam-costas-katsavounidis/(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)