Per-app resource use
Foreground and background CPU cycles, bytes read and written, by app and user SID.
SRUDB.dat · WebAssembly · 100% local
SRUM ParserRead the Windows resource meter.
SRUM logs which apps ran, how much CPU they burned, how many bytes they sent and when the machine was on battery — for 30 to 60 days. Drop SRUDB.dat or a whole triage ZIP and investigate it right here.
- No upload, no account
- KAPE & Velociraptor ZIPs
- CSV / JSON export
The sample is a synthetic SRUDB.dat from a fictional intrusion (host FIN-WKS-07) — no real data. Tip: in Network Data Usage, click rclone.exe’s 10:57 timestamp to focus the time range on the exfiltration.
How to get SRUDB.dat
From a Windows machine to results in two minutes: copy the locked database with one command, then drop it above.
- Collect SRUDB.dat with one command
- Drop the file, the sru folder or the triage ZIP here
- It is parsed in your browser — nothing is uploaded
RecommendedWindows 10 / 11 or Server 2016+. Run it in an administrator Command Prompt or PowerShell (/vss needs admin).
cmd /c "mkdir C:\triage 2>nul & esentutl /y C:\Windows\System32\sru\SRUDB.dat /vss /d C:\triage\SRUDB.dat"Then drop C:\triage\SRUDB.dat here. The copy is usually in Dirty Shutdown state: the tool reads it and tells you so.
Optional: clean copy with the logs replayed
With /vssrec sru ., esentutl replays the SRU*.log files inside the snapshot, so the copy is in Clean Shutdown state with the latest committed records. If it fails, use the command above.
cmd /c "mkdir C:\triage\clean 2>nul & cd /d C:\Windows\System32\sru && esentutl /y SRUDB.dat /vssrec sru . /d C:\triage\clean\SRUDB.dat"KAPE
Administrator prompt in the KAPE folder. The SRUM target copies the whole sru folder (logs included) and the SOFTWARE hive with raw disk reads, so the lock doesn't matter.
kape.exe --tsource C: --tdest C:\triage\kape --target SRUMDrop the C:\triage\kape folder (or a ZIP of it) as is: C\Windows\System32\sru\SRUDB.dat is found automatically, the other files are listed as not used.
Velociraptor
- Collect the artifact
Windows.Triage.Targetswith theSRUMtarget (older releases:Windows.KapeFiles.Targets, tickSRUM), from a hunt or an offline collector. - Drop the collection ZIP as is. Leave the offline collector unencrypted, or extract the ZIP first: password-protected ZIPs can't be opened in the browser.
Windows.Forensics.SRUMparses on the endpoint and returns rows, not the database: collect the file itself to use this tool.
- Mount the image read-only (Arsenal Image Mounter, or FTK Imager → File → Image Mounting) and drop the
Windows\System32\srufolder from the mounted drive. Nothing is locked on a mounted image. - FTK Imager without mounting: add the image as evidence, browse to
Windows\System32\sru, right-click the folder → Export Files…, then drop the exported folder.
mmls image.E01
fls -r -p -o <offset> image.E01 | grep -i "system32/sru/"
icat -o <offset> image.E01 <inode> > SRUDB.dat<offset> is the start sector of the Windows (NTFS) partition listed by mmls; <inode> is the number before SRUDB.dat in the fls output (e.g. 12345-128-4). Drop the resulting SRUDB.dat.
- The SRUM database · Windows 8 / Server 2012 and later
C:\Windows\System32\sru\SRUDB.dat - Whole folder: SRU.chk, SRU*.log, *.jrs · only needed to replay a dirty copy with esentutl
C:\Windows\System32\sru\ - After an in-place upgrade: the previous installation's database
C:\Windows.old\Windows\System32\sru\SRUDB.dat
- Drop SRUDB.dat alone, the whole
srufolder, a triage folder or its ZIP: the database is found automatically, and if there are several the tool says which one it opened. - No SOFTWARE hive needed: app and user names are resolved from SRUDB.dat itself (the hive only adds network profile names, in a registry tool).
- No SRUM on Windows 7 and earlier.
Gotchas
- “File in use” or Access denied on a plain copy: the Diagnostic Policy Service keeps SRUDB.dat locked. Use
/vss(as admin), KAPE or an image rather than stopping the service on the machine you are investigating. - SRUM writes to its database about once an hour and a live copy is usually Dirty Shutdown, so the last hour of activity can be missing. Use the clean copy option, or collect the whole folder and replay the logs (guide below).
- Retention is about 30 days of hourly rows (Long Term tables: up to about a year, weekly). Collect early; all times are shown in UTC.
7SRUM tables decoded
0Bytes uploaded
YesWorks offline
Everything SRUM records, decoded
The ESE database is read by a Rust parser compiled to WebAssembly. App and user IDs are resolved through SruDbIdMapTable, FILETIMEs become UTC dates, flags get readable labels.
Network data usage
Bytes sent and received per app and interface, with Wi-Fi / wired / mobile labels.
Energy & connectivity
Battery and AC transitions, connected-standby, and how long each network profile was up.
Anomaly rules
Large outbound transfers, one-shot binaries and off-hours activity flagged for triage.
Compare two machines
Diff two SRUDB.dat files: apps only in one, and the biggest outbound changes.
Built for big databases
Virtualized tables with sort, filter, resizable and pinnable columns, and saved sessions.
From evidence to answers in three steps
Collect
Copy C:\Windows\System32\sru\ with a raw/VSS copy, or run a KAPE / Velociraptor collection.
Drop
Drop SRUDB.dat, the whole collection ZIP or its folder. The database is found automatically.
Investigate
Pivot by app, spot anomalies, chart activity by hour and export what matters.
Related tools
Artifacts that answer the next question in the same case.
Frequently asked questions
What is SRUDB.dat?
SRUDB.dat is the database file used by the Windows System Resource Usage Monitor (SRUM). It records per-application CPU cycles, foreground/background time, network bytes, and energy use, with roughly 30–60 days of history.
Is my file uploaded to a server?
No. Parsing happens entirely in your browser via WebAssembly. The file you drop never leaves your device — there is no upload endpoint.
Where do I find SRUDB.dat on a Windows machine?
It lives at C:\Windows\System32\sru\SRUDB.dat. The SRUM service holds an open handle on a running system, so most analysts copy it from a forensic image or a volume snapshot.
Does the parser need an internet connection after loading?
No. Once the page and the WASM module are cached, parsing works fully offline.
What browsers are supported?
Any modern browser with WebAssembly support — Chrome, Edge, Firefox, Safari, and Brave on desktop. Tested primarily on the latest Chromium.
Your evidence never leaves this tab.
No server, no telemetry on file contents. Close the tab and it's gone — unless you save the session in this browser.