> For the complete documentation index, see [llms.txt](https://mahmoud-shaker.gitbook.io/dfir-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mahmoud-shaker.gitbook.io/dfir-notes/bam-background-activity-moderator.md).

# BAM (Background Activity Moderator)

### **Overview:**

* **Purpose**: Manages background activity for applications to optimize system performance.
* **Registry Location**:
  * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\UserSettings\<SID>`
* **Data Stored**:
  * Executable paths and timestamps of last execution.

### **Benefits for DFIR:**

* **Activity Tracking**: Tracks when applications were last active in the background.
* **User Behavior**: Provides insight into frequently used programs.

### **How It Works:**

* Logs executables that perform background activity, including:
  * **Timestamps**: Time of last activity.
  * **Paths**: Full paths of executables.
  * **User-Specific Data:** Each user's executed programs are stored under their corresponding SID (Security Identifier).

### **Tools:**

* **BAM Parser**: Specialized tool for analyzing BAM data.
* **Registry Explorer**: Manual exploration of BAM keys.