“Evidence of execution” is a useful search category, but it conceals important differences. A shell-related record, a moderation entry, a launch-related artifact, and a resource-usage row do not all describe the same event. Begin with a bounded question: whether a particular program was active on the examined host, within which interval, and under what recorded account context.
Keep source families distinct
| Family | Useful investigative angle | Unsupported shortcut |
|---|---|---|
| UserAssist | Shell and profile context for interpreted application activity. | Every possible process launch was recorded. |
| BAM | Recorded executable and account-related moderation state. | A displayed “last execution” value is always the process start. |
| DAM | Power-management context and applicable collected records. | DAM and BAM have identical forensic coverage. |
| Prefetch | Launch-related traces interpreted for the source format. | The artifact alone identifies the human operator. |
| SRUM | Application or service resource-use context. | Aggregate usage identifies a particular command or destination. |
Match the reference to the acquired source
Use the UserAssist and Windows Prefetch guides as entry points, then check the examined Windows build and record format against the source-specific research. Pair Registry-based findings with Registry Hives so the collection preserves relevant hive context and companion material. BAM, DAM, and SRUM require their own coverage assessment; a finding or retention expectation from one family does not define the others.
For every source, retain original records, relevant account identifiers, Windows build, collection method, parser version, and raw time values. A tool's friendly label is an interpretation that should remain traceable to a specific source field. Keep decoded names alongside source identifiers so normalization does not hide an ambiguous join.
BAM timing needs particular care
Maxim Suhanov’s original BAM internals research reports reverse engineering and experiments on specified Windows 10 builds. It found timestamp updates at process creation and termination, and documented conditions affecting record retention and coverage. That supports caution about treating every BAM timestamp as a launch time. It does not make those tested builds a universal specification for current Windows versions.
Microsoft’s historical DAM documentation describes a power-management component for connected-standby systems. The current modern-standby integration guide explains the continuing role of moderation. Those documents establish component purpose; they do not promise a stable forensic Registry schema or complete audit history. Treat BAM and DAM as separately collected sources until the examined structures and behavior justify a relationship.
Prefetch and SRUM supply different corroboration
The upstream PECmd project documents a Prefetch parser and version-dependent options. It is a source for implementation scope, not a certification of any output. Confirm the acquired file's format and the exact parser build before relying on displayed times, counts, or paths. Referenced filenames need interpretation; do not turn every listed dependency into a separately executed program.
NirSoft’s NetworkUsageView documentation describes network-usage information from SRUDB.dat, including application or service, user SID, and byte totals. The original SRUM-DUMP project documents another extraction approach. Resource totals are useful context, but they do not identify transmitted content, a remote recipient, or a person's intent without other records.
Resolve disagreements instead of taking a vote
If one source is present and another absent, compare collection coverage, retention, configuration, application type, and record semantics. Absence is not automatically a contradiction. Likewise, five parser outputs reading the same source do not create five independent observations. Join records by supported identifiers and compatible intervals rather than by filename alone.
A strong report separates the observed rows from the inference: several source families may support program activity while leaving exact start time, command line, successful completion, or human attribution unresolved. Use the narrowest conclusion supported by the combined evidence.