\n\nThis page has been machine-translated from the original page.
\n
The other day, when I attended a digital forensics study session, I learned about a Windows artifact called SRUM (System Resource Usage Monitor).
\nThis may be common knowledge in the forensics community, but I could find very little information even after searching Windows Internals material and official documentation, so I was very glad to have a chance to learn about it.
\nFrom a forensic perspective, SRUM seems to be used to discover suspicious processes and network activity. This time, however, I want to summarize how to use SRUM information mainly from the perspective of performance-related troubleshooting.
\n\n\nSRUM (System Resource Usage Monitor) is a Windows feature that monitors how applications and services are used, and it appears to have been introduced in Windows 8.
\nAfter SRUM collects data, it is temporarily stored inside the system and then transferred to C:\\Windows\\System32\\sru\\SRUDB.dat every hour or at shutdown.
The following article says that information collected by SRUM is temporarily kept in the SOFTWARE registry until it is transferred to SRUDB.dat.
\nReference: フォレンジックにおけるSRUMの活用: NECセキュリティブログ | NEC
\nHowever, the following source explains that in recent versions of Windows, information collected by SRUM is no longer stored in the SOFTWARE registry and is instead stored in memory.
\n\n\nIn recent versions of Windows, SRUM no longer uses the registry to store temporarily database records. Nowadays, SRUM relies on 2 types of storage:
\nA Tier1 store, which is in memory and is updated every Tier1Period (60 seconds by default) with the data from the SRUM extensions.\nA Tier2 store, which is the SRUM database on disk and is updated every Tier2Period (1 hour by default) with the content of the Tier1 store.
\n
Reference: SRUM Analysis · WithSecureLabs/chainsaw Wiki
\nI could not find any officially published documentation describing SRUM behavior in detail, but either way, the point seems consistent that temporarily stored data is written to C:\\Windows\\System32\\sru\\SRUDB.dat about once an hour.
SRUM records statistics about network data usage and application activity.
\nReference: Beyond Windows Forensics with Built-in Microsoft Tooling
\nReference: SRUM: Forensic Analysis of System Resource Utilization Monitor
\nAlso, according to Forensic insights about the DLLs related to the SRUM extensions, the information saved in the SRUM database is collected by several extensions.
\nInformation collection for network data depends on WFP, and the size of recorded communication data apparently includes the size of Layer 2 frames in the OSI model.
\nAlso, if a system’s network traffic goes through a VPN process, the size of the audited input and output data appears to be associated with that VPN process.
\nThis SRUDB is also stored in the Extensible Storage Engine (ESE) format, so it can be analyzed with libraries such as libesedb, as shown later.
\nReference: 拡張可能なストレージ エンジン - Win32 apps | Microsoft Learn
\n\nInformation stored in C:\\Windows\\System32\\sru\\SRUDB.dat can be analyzed with tools such as srum-dump and NetworkUsageView.
Reference: Displays network usage information stored in the SRUDB.dat database of Windows 10/8.
\nWhen using NetworkUsageView, you can inspect network data from SRUMDB by starting the application, opening [Options] > [Advanced Options], and loading the SRUDB.dat collected from the device you want to examine.
\nWhen I used srum-dump, I could easily dump not only network data but also application usage information, so if you want to inspect a wider range of data, srum-dump seems like the better option.
\nBy the way, copying C:\\Windows\\System32\\sru\\SRUDB.dat fails surprisingly often with an error like the following. (If you wait about one minute, it usually becomes copyable.)
When you analyze the SRUMDB captured from the machine that actually performed this upload, you can see that roughly 1 GB of upload traffic is associated with the Microsoft Edge application.
\nOne important point is that the Timestamp value shown here is not the time when the communication actually occurred, but the time when the data was written to SRUMDB.
\nAlso, the communication-data size shown here corresponds to information recorded since the previous event transfer. (Data is transferred to SRUMDB about once an hour or when the machine shuts down.)
\nThe following article explains this area very clearly, and I found it helpful.
\nWhen I actually uploaded a 1 GB file from Microsoft Edge, nearly the same amount of traffic was associated with the App ID 1 entry, so it seems reasonably plausible.
\nIf anyone knows the details here, I would really appreciate hearing about it.
\nThis time I installed libesedb with apt, but I was also able to build it from source with the following commands.
sudo apt install git autoconf automake autopoint libtool pkg-config\n\nwget https://github.com/libyal/libesedb/releases/download/20240420/libesedb-experimental-20240420.tar.gz\ntargz libesedb-experimental-20240420.tar.gz\ncd libesedb-20240420/\n\n./configure --enable-python\nmake\nsudo make installReference: Building · libyal/libesdb Wiki
\nSRUM seems to be used often for forensic purposes, but personally I also felt that it could be extremely useful for performance and network-related troubleshooting. (That is probably its original purpose.)
\nEspecially for intermittent performance issues and bandwidth-saturation problems, identifying the process that caused the spike is often the bottleneck in an investigation, but analyzing SRUM seems likely to make it possible to investigate these kinds of issues more smoothly.
","fields":{"slug":"/windows-srum-en","tagSlugs":["/tag/forensic/","/tag/english/"]},"frontmatter":{"date":"2025-03-16","description":"Notes on analyzing SRUM used in Windows forensics.","tags":["Forensic","English"],"title":"Notes on Analyzing SRUM Used in Windows Forensics","socialImage":{"publicURL":"/static/beee8f0e9df86d84b38788123464ecb2/windows-srum.png"}}}},"pageContext":{"slug":"/windows-srum-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}