Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

BAM Registry Parser

This script Background Activity Moderator (BAM) Registry entries generated by later versions of Windows 10.

The user has the option of choosing which files to parse albeit the script will only parse those files with the name 'system' and a 'regf' file-signature.

The script will attempt to resolve user-names from user-SIDs using SAM User and Net Logon entries from the Secure Storage tab. Note that Net Logons will only be shown after running the Analyze EFS function.

It's not unusual to find more than one reference to the same SID especially if the Active Directory Account Importer For Secure Storage EnScript has been used to import domain-account information.

In such cases, the script will give priority to SAM User entries as opposed to Net Logon entries.

Note that EnCase does not make the user-names accessible to EnScript, so this script has to read them from the data shown in Report view.

This relies on the format of that data being preserved and is therefore somewhat of a kludge. It has only been tested with English language versions of EnCase.

Output is by way of data bookmarks and a tab-delimited spreadsheet file, which can be opened automatically upon completion.

For more information, please see the following Twitter post:

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


Version: 2.0.1
Tested with:
EnCase Forensic
Developer: Simon Key
Category: Artifact

26 Downloads in last 6 months