Observed arrival · 2026-09-28
A Windows execution-evidence parser that stays in the browser
BAM/DAM Parser reads Windows registry hives to show programs’ last execution times per user, with processing done locally in the browser.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- DFIR investigators handling Windows registry hives
- Worth noticing
- It accepts folders and ZIP triage collections from KAPE and Velociraptor, and includes synthetic intrusion hives.
Field notes
The collection guide walks through exporting SYSTEM and SOFTWARE from a live host, gathering hives with KAPE or Velociraptor, and extracting them from a disk image. The sample is described as synthetic and based on a fictional intrusion; its “Last hour” preset is intended to help isolate activity in that scenario. The page says parsing happens locally through WebAssembly and that files are not uploaded.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue