Skip to content

SRUM

What SRUM is

The System Resource Usage Monitor (SRUM) stores an ESE database of application and service resource usage. Depending on the Windows version, it records network bytes, interface/profile identifiers, connections, CPU time, foreground/background activity, disk activity, energy use, push notifications, and application timeline data. Entries are associated with application IDs and user SIDs through SruDbIdMapTable.

SRUM is especially useful when an executable has been deleted: its application ID, user, and resource-use rows can outlive the file. Network totals can support an exfiltration hypothesis, but SRUM is not packet capture and generally does not identify every remote endpoint or transferred file.

Best conclusion: Windows attributed the recorded resource usage to the application/account during the table's measurement period.

Location and collection

C:\Windows\System32\sru\SRUDB.dat
C:\Windows\System32\config\SOFTWARE   (context for account and Wi-Fi names)

SRUM exists on Windows 8 and later. Copy SRUDB.dat consistently, ideally from a snapshot or with a forensic collector. Also collect SOFTWARE and the ESE transaction/log files in the sru directory.

The matching SOFTWARE hive is separate from the ESE database: Juntei automatically replays its adjacent SOFTWARE.LOG, .LOG1 and .LOG2 registry transaction logs in memory when the hive is dirty. Collect those files too. Recovery details and warnings are reported; missing logs can leave account or Wi-Fi names incomplete or out of date. This does not replay the SRUM database logs.

Dirty databases

Juntei reads a dirty SRUDB.dat as collected and reports it. It does not currently replay SRU*.log, so changes existing only in those logs are missing. Do not silently describe a dirty database as complete.

Analyst cautions

  • Many rows represent periodic aggregation, commonly around hourly boundaries—not exact action time.
  • Byte totals do not identify content, intent, protocol, or destination by themselves.
  • An application identity can be a path, service, packaged app, or object; examine AppType.
  • User and Wi-Fi names are enrichment from the matching SOFTWARE hive. Missing names do not mean the underlying ID is absent.
  • null, zero, absent columns, unsupported types, and damaged values are different states.
  • Provider schemas vary by Windows version. Preserve unknown tables and original column names.
  • Background Windows services legitimately generate large resource totals.

Parse with Juntei

Usage: juntei parse-ese srum <INPUT> [OPTIONS]

Input:
  -d, --directory <DIR>  Recursively find SRUDB.dat
  -f, --file <FILE>      Parse one SRUDB.dat
  -r, --software <FILE>  Matching SOFTWARE hive for names

Output:
  -o, --output <PATH>        Directory of CSV tables, or JSON/JSONL file
  -t, --output-type <TYPE>   csv, json, or jsonl
      --include-value-state  Add per-value read state and raw bytes to JSON/JSONL

juntei parse-ese srum -f SRUDB.dat -r SOFTWARE -o srum-csv
juntei parse-ese srum -f SRUDB.dat -t jsonl \
  | jq 'select(.Provider == "NetworkUsages" and (.BytesSent // 0) > 100000000)'
juntei parse-ese srum -f SRUDB.dat -t jsonl --include-value-state \
  | jq '{Provider, Timestamp, ValueState, Raw}'

Output tables

CSV creates SRUM-IdentityMap.csv for SruDbIdMapTable and one table per provider. Known output names include:

Provider/table Investigative purpose
NetworkUsages Bytes sent/received per application, user, interface, and profile.
NetworkConnections Connection-count/duration style activity and connection start times.
AppResourceUseInfo Foreground/background CPU, disk, network, and related application usage.
AppTimelineProvider Application timeline activity with end-time and usage-state fields.
EnergyUsage Short- and long-term energy/provider measurements; IsLt distinguishes them.
PushNotifications Push-notification activity.
VfuProvider The vfuprov provider; its detailed purpose is not well documented, so interpret its fields cautiously.
EnergyEstimation, TaggedEnergy Version-specific energy and usage providers.
ProcessorTime, SizeInBytes, TotalUsed, NetworkBytes Windows Server provider tables.
Unknown table name Juntei preserves unknown providers under their GUID/table name and emits every catalog column.

Because SRUM is catalog-driven and Windows adds provider columns, there is intentionally no fixed finite list of provider-specific fields. Juntei emits every column present in the database with Juntei's PascalCase field labels. The following fields are the stable/common output contract.

Categorized auto-parse output

auto-parse places each SRUM table directly in its investigative category. CSV, JSON and JSONL use the same SRUM- filename prefix; there is no enclosing SRUM/ directory.

Category CSV files
NetworkActivity SRUM-NetworkConnections.csv, SRUM-NetworkUsages.csv, SRUM-NetworkBytes.csv, SRUM-PushNotifications.csv
ProcessExecution SRUM-AppResourceUseInfo.csv, SRUM-AppTimelineProvider.csv, SRUM-ProcessorTime.csv
SystemInformation SRUM-EnergyUsage.csv, SRUM-EnergyEstimation.csv, SRUM-TaggedEnergy.csv, SRUM-SizeInBytes.csv, SRUM-TotalUsed.csv, SRUM-IdentityMap.csv, SRUM-VfuProvider.csv, and unknown-provider tables

Only tables present in the capture are exported. Network counters and notification records are placed by their main investigative use; this is not a claim that every row describes a remote connection. The identity map supports several categories. VFU and unknown providers stay in SystemInformation because their presence alone does not establish execution.

SystemInformation/SRUM-logs.txt contains the parser diagnostics and original-to-final output mapping. Both manifests list the actual table paths in OutputFiles; the SRUM task's Output is the computer directory and Category identifies its shared log/metadata location.

With multiple databases, filenames gain -Source1, -Source2, etc., before the extension. The log preserves the original capture aliases, and JSON/JSONL rows retain their SourceFile, Table, Provider, Comp and Artifact provenance. No table is copied into several categories. The combined -j SIEM timeline includes every retained SRUM record once.

Standalone parse-ese srum keeps its requested output location. Its CSV table files also have the SRUM- prefix; explicit JSON/JSONL output filenames remain analyst-selected.

Common output fields

Field Interpretation
SourceFile Input database; present in JSON/JSONL and useful across hosts.
Table Original ESE table name/GUID. Preserve when comparing versions or unknown providers.
Provider Friendly provider/output name, or the original table name if unknown.
ID Row's AutoIncId; a database row identifier, not a process ID.
Timestamp When SRUM recorded/aggregated the figures, rounded to milliseconds. Usually not exact event time.
EXE-Info Resolved application/service/package identity from AppID. Main program pivot.
EXE-InfoDescription Description extracted from composite SRUM application names. Context only.
EXE-Timestamp Time embedded in a composite application identity where present; not the row's usage time.
AppType NormalApp, Service, ModernApp, or Object; controls how EXE-Info should be interpreted.
SID Resolved account SID from UserID. Strong user/service identity pivot.
User Friendly profile name enriched from SOFTWARE; may be null while SID remains valid.
UserID, AppID Raw numeric references into SruDbIdMapTable; preserve for unresolved or duplicate names.
IsLt true for the long-term EnergyUsage table, false for short-term.
InterfaceLUID Raw network interface LUID from provider rows.
InterfaceType Decoded interface class (for example IF_TYPE_IEEE80211); class, not a unique adapter.
L2ProfileID Numeric network profile reference.
ProfileName Wi-Fi/profile name enriched from SOFTWARE; potentially sensitive and not proof of current connection.
ConnectStartTime, EventTimestamp, EndTime, StartTime Known provider FILETIME columns decoded to UTC. Their exact meaning belongs to the provider, not a universal execution time.
Provider-specific columns Exported provider columns such as BytesSent, BytesReceived (the database column BytesRecvd), CPU/disk counters, durations, counts, flags, or estimates. Interpret units according to the provider and compare rows within the same schema.

Diagnostic fields (--include-value-state)

Field Interpretation
ValueState Map of database field to parsed, null, absent, unsupported, or damaged. This separates evidence absence from parser failure.
Raw Original bytes in hexadecimal for values that have bytes. Use for validation and future decoding.

SRUM-IdentityMap.csv (from SruDbIdMapTable) contains IdIndex, IdType, and IdBlob: the raw index, identity category, and decoded program/SID/object text used by provider rows.

Investigation strategy

  1. Identify the program with EXE-Info, AppType, and AppID; do not confuse Id with PID.
  2. Group network rows by program, user, profile, interface, and time interval.
  3. Compare bytes sent/received with normal baselines and other hosts.
  4. Correlate suspicious intervals with Prefetch, event logs, DNS/proxy/firewall data, and file access.
  5. Report dirty-database status and missing transaction-log replay as a collection limitation.

Further Details