SRUM

Location & availability

C:\Windows\System32\sru\SRUDB.dat with applicable ESE companion files

Requires suitable acquisition of the database and parser support for the source Windows build.

Fields to examine

• Application identities and associated user identifiers.
• Usage intervals and resource counters.
• Network-related totals where present, with their table context.

What it can establish

• Support that an application consumed resources during a recorded interval.
• Add application/user context to a broader timeline.

What it cannot prove

• Prove a specific destination, downloaded file or game action from byte totals.
• Turn an aggregate interval into an exact start and stop time.

Use it in a screenshare

1. Preserve the SRUM database with a trusted acquisition method instead of stopping services to unlock it.
2. Inspect the relevant table and resolve application/user identifiers using the source data. Record interval granularity.
3. Compare usage with process creation, firewall logs or game-session times. Explain coarse intervals and any retention gap.

Worked example

A program used network resources during an interval overlapping a match. That supports resource use, not contact with a particular cheat server. Destination claims require another source that actually records destinations.

Cross-check the finding

• Live network connections →Support an observed endpoint/state association with a process at collection.
• Windows Firewall logs →Support a recorded permit/drop event according to the log format.
• Security event 4688 →Support process creation recorded by the audited host.

Sources

• Velociraptor — examining SRUM ↗