Using SRUM in a forensic investigation

SRUM is the artefact that closes the loop on "did this run, when, who ran it, how much data did it move". On the cases where EDR is absent, where the suspicious window predates EDR coverage, or where EDR has been bypassed, SRUM is frequently the most defensible per-process activity record on the machine. The trade-off is resolution: most rows are bucketed to the hour, so you anchor coarse claims with SRUM and sharpen them with second-precise artefacts elsewhere.

What SRUM is good at proving

• An application was running on a given date. Application Resource Use rows with FaceTime > 0 or BackgroundCycleTime > 0 for an AppId-resolved binary place that process on the system for a given hourly bucket.
• How much data an application sent or received. Network Data Usage BytesSent / BytesRecvd per AppId per network profile.
• Which network the host was on. Network Connectivity carries precise FILETIME connect timestamps per Wi-Fi profile.
• Whether the laptop was on AC or battery. Energy Usage records every transition with a second-precise FILETIME.

A worked example: data exfiltration

The standard departing-employee pattern. Image taken three days after last day; the question is whether they staged and exfiltrated data.

1. Acquire C:\Windows\System32\sru\* and the SOFTWARE registry hive from the image. See where SRUDB.dat lives.
2. Recover the database if dirty — how to fix a dirty SRUDB.dat.
3. Parse. Drop the database in the in-browser parser or run SrumECmd. See how to parse SRUDB.dat.
4. Filter Network Data Usage to the suspect's UserId (resolved via SruDbIdMapTable to their SID, which you map back to a user name via ProfileList in the registry).
5. Sort by BytesSent desc for the suspicion window (last 14 days of employment). Look for non-browser processes with multi-hundred-MB outbound: OneDrive.exe, Dropbox.exe, pwsh.exe, curl.exe, 7z.exe, custom binaries.
6. Cross-check Network Connectivity for the same window. Was the device on corporate Wi-Fi, a personal hotspot, or an unknown SSID? Mobile broadband (L2ProfileFlags & 0x400) often means a hotspot intentionally chosen to bypass egress filtering.
7. Pivot to Application Resource Use for those processes. `FaceTime

   0` distinguishes foreground use from a background sync agent.

8. Corroborate file activity with the USN journal and MFT — the bytes are gravy if you can also show what was archived and copied.

Process + bytes + network + user + time is a far stronger story than any single source.

A worked example: malware persistence

SOC alert fires on a low-prevalence binary executed yesterday morning.

1. Resolve the binary path in SruDbIdMapTable. If a row exists, the process registered with SRUM at some point — meaning it ran.
2. Pull every Application Resource Use row for that AppId, sorted by TimeStamp. The earliest row is first execution; subsequent rows show recurrence intervals — a fingerprint for scheduled-task or run-key persistence.
3. If background CPU cycles continue with no foreground time, the process is running silently.
4. Cross-reference Network Data Usage for the same AppId to see whether it phoned out, and which network it used.
5. Pull the binary's hash via AmCache for threat-intel pivoting, Prefetch for second-precise execution timestamps, and Sysmon 1 / EVTX 4688 (EVTX) for the parent process.

EDR overlap and where SRUM still wins

Modern EDR records most of what SRUM does, often with better granularity. SRUM still earns its place when:

• EDR was not deployed at the time of the suspicious activity.
• EDR has been disabled or bypassed by the adversary (and SRUM has not — DPS is rarely on adversary checklists).
• EDR retention is shorter than the investigation window.
• The host is a personal/contractor laptop where EDR coverage was patchy.

In those cases SRUM is a built-in, on-by-default audit log Microsoft left running for years.

Cautions

• Hourly bucketing. A five-minute browser session may show up as one 60-minute row. Do not claim minute-by-minute resolution.
• FaceTime > 0 ≠ human at keyboard. UI visible is not human input. RDP sessions, kiosks, unattended login screens all register.
• LT aggregates differ from short-term counters. Do not compare weekly LT byte counts one-to-one with hourly short-term rows.
• SYSTEM can tamper. Check SRUDB.dat's MFT MFT entry for unexpected modification timestamps and use Energy Usage as a continuity oracle (it logs even when most application telemetry is suppressed).

Further reading

• What is SRUM and why forensic analysts care
• SRUM tables explained: AppResource, Network, Energy, Push
• How to parse SRUDB.dat without installing anything
• Detecting data exfiltration with SRUM
• SRUM vs Prefetch vs Amcache