Execution
SRUM (System Resource Usage Monitor)
SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.
- Location
- C:\Windows\System32\sru\SRUDB.dat
- Proves
- An app ran for a user in a given hour and how many bytes it sent and received
- Timestamps
- TimeStamp as OLE date, UTC, marking the end of a roughly hourly window; ConnectStartTime as FILETIME, UTC
- Retention
- Records kept roughly 30 to 60 days depending on the table, then purged; flushed hourly and at shutdown; older copies in VSS
- Access
- Administrator; SRUDB.dat locked live and often dirty: copy via VSS (esentutl /vss) or raw NTFS, then repair; collect SOFTWARE too
- Type
- Database
- Windows
- 8 / 8.11011
- KAPE target
- SRUM
- Velociraptor
- Windows.Triage.Targets:SRUM
Tools
Compare all toolsWhat it is
The System Resource Usage Monitor (SRUM), introduced in Windows 8, records per-application and per-user resource consumption so Windows can show battery and data-usage statistics. The data lands in SRUDB.dat, an ESE database. It is one of the few native artifacts that links a program and a user to network volume, which makes it the go-to source for data-exfiltration questions.
Location
| Windows version | Location | Notes |
|---|---|---|
| 8 / 8.1 / 10 / 11 | C:\Windows\System32\sru\SRUDB.dat | ESE database with SRU*.log, SRUtmp.log, SRU.chk beside it |
| 8 / 8.1 / 10 / 11 | SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions | Registers the provider GUIDs |
| — | SOFTWARE hive | Needed by parsers to resolve interface profiles (NetworkList) |
The database is locked while Windows runs, and it is frequently in a "dirty" state when copied live.
What it proves
- Execution and activity: an application (path, service name or packaged app ID) consumed CPU or I/O during a given hour, under a given SID.
- Network volume: bytes sent and received per application, per user and per network interface/profile. Large outbound volume from
rclone.exe, a browser or an archiver is the classic exfiltration signal. - Connectivity: which network profile (Wi-Fi SSID or wired network) the machine was connected to and for how long.
- It does not show destinations (IP addresses or URLs); combine it with proxy, firewall or DNS logs.
Key fields
| Table (provider GUID) | Useful columns |
|---|---|
SruDbIdMapTable | Maps numeric AppId/UserId to paths, app names and SIDs |
Application Resource Usage {D10CA2FE-6FCF-4F6D-848E-B2E99266FA89} | ForegroundCycleTime, BackgroundCycleTime, FaceTime, foreground/background bytes read and written |
Network Usage {973F5D5C-1D90-4944-BE8E-24B94231A174} | BytesSent, BytesRecvd, InterfaceLuid, L2ProfileId |
Network Connectivity {DD6636C4-8929-4683-974E-22C046A43763} | ConnectedTime, ConnectStartTime, L2ProfileId |
Push Notifications {D10CA2FE-6FCF-4F6D-848E-B2E99266FA86} | Notification counts per app |
Energy Usage {FEE4E14F-02A9-4550-B5CE-5FA2DA202E37} | Battery charge and capacity (laptops) |
App Timeline {5C8CF1C7-7257-4F13-B223-970EF5939312} (Windows 10+) | Per-app timeline data used by Windows' usage views |
Every data table has AutoIncId, TimeStamp, AppId and UserId.
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
TimeStamp | The provider writes its record, roughly once per hour | OLE date, UTC (parsers show UTC) | It is the end of an aggregation window, not the moment of activity; counts are totals for the period |
ConnectStartTime | Start of a connection to a network profile | FILETIME, UTC | Long-running connections span many records |
SRUDB.dat $SI modification | Last flush to disk | NTFS, UTC | The newest hour may still sit in memory / registry buffers |
Retention and clearing
- Records are kept for roughly 30 to 60 days depending on the table, then purged; long-term tables (for example energy) can go back further.
- Data is flushed about hourly, and also at shutdown, so the last hour before acquisition may be missing from a live copy.
- Deleting
SRUDB.datrequires stopping the Diagnostic Policy Service; a freshly recreated database with few records is a red flag. - Older copies are often available in volume shadow copies.
Collection
- KAPE target:
SRUM(thesrufolder plus the SOFTWARE hive) - Velociraptor (
Windows.Triage.Targets):SRUM;Windows.Forensics.SRUMparses it live. - Built-in (administrator): copy from a shadow copy with
esentutl, then repair if dirty.
esentutl.exe /y C:\Windows\System32\sru\SRUDB.dat /vss /d E:\case\sru\SRUDB.dat
esentutl.exe /mh E:\case\sru\SRUDB.dat
esentutl.exe /r sru /i
/mh shows the state (Clean Shutdown or Dirty Shutdown); run recovery (/r sru) from the folder holding the database and its logs, and keep an untouched original.
Parsing tools
- SrumECmd (Eric Zimmerman):
SrumECmd.exe -f SRUDB.dat -r SOFTWARE --csv E:\out; the-rhive resolves network profile names. - srum-dump (Mark Baggett, open source): produces an annotated workbook from a template.
- Velociraptor:
Windows.Forensics.SRUM. - AppResourcesUsageView / NetworkUsageView (NirSoft): quick views on a live system.
Investigation tips
- Sort Network Usage by
BytesSentper hour: one app with a sudden spike (oftenrclone.exe,curl.exe,winscp.exe, a browser orsvchost.exehosting BITS) marks the exfiltration window. - Map
L2ProfileIdto the SSID through the SOFTWARE hive (network profiles) to show the machine was on a hotel or personal hotspot at the time. - Use Application Resource Usage to confirm that a deleted tool ran, even when Prefetch was cleared.
- SRUM attributes activity to a SID; a tool running under
SYSTEMor a service account deserves attention. - Remember that timestamps are hourly buckets in UTC; line them up with browser and firewall logs by hour, not by second.
Related artifacts
- Network profiles (NetworkList)NetworkList cheat sheet: network profiles, SSIDs, gateway MAC addresses, first and last connection times (local time), WLAN profile files and WLAN events.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- Browser artifacts (Chrome, Edge, Firefox)Browser forensics cheat sheet: Chromium and Firefox profile files, History and places.sqlite tables, WebKit and PRTime timestamps, downloads, cookies, cache.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
- Windows Recall (Copilot+ PC snapshots)Windows Recall cheat sheet: CoreAIPlatform snapshot store, ukg.db and ImageStore, OCR text and window titles, VBS encryption, opt-in status and caveats.
Glossary terms
- ESE database (Extensible Storage Engine)Microsoft's embedded transactional database format behind SRUM, WebCache, the Windows Search index and the BITS queue, often found dirty.
- Security Identifier (SID)The unique value Windows uses to identify users, groups and computers, such as S-1-5-21-…-1001, found throughout registry, logs and file paths.
- Evidence of executionArtifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.
- UTC vs local time in Windows artifactsWhy some Windows artifacts record UTC and others local time, and how the TimeZoneInformation registry key helps normalize a forensic timeline.
Guides
- Evidence of Execution: Prefetch, Amcache, BAM and MoreProve a program ran on Windows, not just existed: Prefetch, ShimCache, Amcache, BAM, UserAssist, SRUM, PCA, WER and 4688 compared, with parsing commands.
- SRUM Forensics: App Usage and Network Bytes per HourUse SRUM (SRUDB.dat) to prove which apps ran, under which user, and how many bytes they sent: tables, ID mapping, dirty database repair, SrumECmd, pitfalls.