BAM Registry Parser
This script Background Activity Moderator (BAM) Registry entries generated by later versions of Windows 10.
The user has the option of choosing which files to parse albeit the script will only parse those files with the name 'system' and a 'regf' file-signature.
The script will attempt to resolve user-names from user-SIDs using SAM User and Net Logon entries from the Secure Storage tab. Note that Net Logons will only be shown after running the Analyze EFS function.
It's not unusual to find more than one reference to the same SID especially if the Active Directory Account Importer For Secure Storage EnScript has been used to import domain-account information.
In such cases, the script will give priority to SAM User entries as opposed to Net Logon entries.
Note that EnCase does not make the user-names accessible to EnScript, so this script has to read them from the data shown in Report view.
This relies on the format of that data being preserved and is therefore somewhat of a kludge. It has only been tested with English language versions of EnCase.
Output is by way of data bookmarks and a tab-delimited spreadsheet file, which can be opened automatically upon completion.
For more information, please see the following Twitter post:
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now