SRUM: resource use in context
Use resource and network-usage records as timeline context without treating them as packet captures or exact launch logs.
Question & scope
System Resource Usage Monitor data can help investigate application activity and resource usage. Its Windows ESE database is commonly located at Windows\System32\sru\SRUDB.dat. Depending on collected tables and system version, records can provide application, user, resource, or network-usage context. Establish the available schema and parser interpretation before relying on a field.
Normal launchers, voice applications, overlays, and updates can produce substantial activity. Compare the recorded identity and interval with the relevant session instead of equating high usage with misconduct.
What to collect
| Source | Retain and examine |
|---|---|
| SRUM database | Collected SRUDB.dat and supporting ESE files required by the acquisition method. |
| Schema context | Windows build, available tables, and parser version. |
| Identity context | Application identifiers and associated user or mapping information. |
| Time context | Original timestamps, aggregation intervals, and matching session records. |
Examination workflow
- Use an acquisition method that produces a coherent database copy rather than stopping services merely to unlock the file.
- Select a parser supporting the source schema and preserve its table-level output.
- Resolve application and user identifiers using relevant mappings; document unresolved identifiers.
- Review the interval represented by each resource or network record before comparing it with a match.
- Correlate leads with process, event, file, and game records rather than treating the output as a verdict.
Interpretation & false positives
Usage accounting is not packet content. A network-usage figure does not identify every destination or disclose what bytes were exchanged. Aggregated records should not be relabeled as precise program-start or transfer timestamps.
Collection state, parser support, configuration, and retention limit coverage. A missing application record is not a universal disproof of execution. Shared processes, services, launchers, and legitimate downloads can make a suspicious-looking pattern ordinary once identity and interval are resolved.
Worked scenario
A launcher records substantial network use near a disputed session. Its update log and filesystem records show a game update. Evaluate that explanation before describing the usage as a tool download. If a process cannot be identified confidently, record the unresolved mapping and avoid assigning its bytes to a player action.
Report checklist
- Database collection and schema support are documented.
- Mappings are resolved or explicitly uncertain.
- Accounting intervals are not presented as exact event times.
- Network usage is not described as packet content.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.