# System Resource Usage Monitor (SRUM) ## Purpose and Function The **System Resource Usage Monitor (SRUM)** is a feature in Windows (present from Windows 8 onwards) that provides detailed historical data on system resource consumption. Its primary purpose for the operating system is to track which applications and services are using resources like the CPU, network, and disk, which is valuable for power management and understanding application behavior over time. For DFIR analysts, SRUM is often referred to as a **"forensic goldmine"**. It maintains a rolling historical database (typically for 30-60 days) of process and network activity, making it an incredibly robust artifact that often retains evidence long after more volatile traces have been overwritten or deliberately cleared. ### Location and Structure SRUM data is stored in an Extensible Storage Engine (ESE) database, a type of database format also used by Microsoft Exchange and Active Directory. * **Location:** `C:\Windows\System32\sru\SRUDB.dat` The `SRUDB.dat` file is a complex, multi-table database that is typically locked by the system while Windows is running. Analysis requires specialized forensic tools capable of parsing ESE databases. ### Stored Metadata The SRUM database logs a wide array of detailed metrics for applications and services. The most forensically relevant information includes: * **Process Execution History:** It records which processes have run, including their full paths and the user context (SID) under which they were executed. This provides a longer-term execution history than artifacts like Prefetch or BAM. * **Network Activity:** This is a key feature. SRUM monitors network connectivity on a per-application basis, logging: * **Bytes Sent and Received:** The total amount of data transferred over both wired and wireless interfaces. * **Network Interface:** The specific network adapter used for the connection. * **Connection Timestamps:** When the application was connected to the network. * **Resource Consumption:** It logs metrics such as CPU time (distinguishing between foreground and background usage), disk I/O (reads and writes), and other performance counters for each application. * **Application Uptime and Focus:** Through tables like `AppTimelineProvider`, SRUM can track how long an application was in focus (i.e., the active foreground window), providing context on user interaction. ### Forensic Value The historical depth and breadth of data in the SRUM database make it an exceptionally powerful tool for an investigation. * **Long-Term Historical Record:** SRUM's ability to retain data for 30-60 days means it can provide evidence of activity that occurred long before an investigation began, often surviving multiple reboots and cleanup attempts. * **Detecting Network-Aware Malware:** The network monitoring capability is invaluable for identifying unauthorized applications that communicate over the network. It can prove that a specific process (e.g., a cheat loader) connected to the internet, which can be correlated with download or command-and-control (C2) activity. * **Resilience to Tampering:** While the `SRUDB.dat` file can be deleted, its absence is a highly suspicious indicator of anti-forensic activity. Unlike clearing individual Prefetch files or registry keys, wiping the entire SRUM database is a much more drastic and noticeable action. * **Correlating User and System Activity:** By combining process execution data with user SIDs and timestamps, SRUM helps analysts attribute specific activities to specific users and build a comprehensive timeline of events. Due to its complexity, command-line forensic tools like Eric Zimmerman's `SrumECmd` are the standard for parsing the database and exporting its tables into a human-readable format (like CSV) for analysis. *** --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://itzicehere.gitbook.io/redlotusguide/advanced-explanation-of-artifacts/program-execution/system-resource-usage-monitor-srum.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.