SRUM tables explained: AppResource, Network, Energy, Push

SRUDB.dat is an ordinary ESE database. Most of its tables are named with curly-brace GUIDs — each GUID identifies a SRUM extension that registers itself with the service to record one slice of telemetry. The GUIDs are stable across Windows builds, so a parser that recognises them can read the data regardless of locale, service pack, or feature update.

The catalog

Plus the control tables:

• SruDbIdMapTable — translates integer AppId/UserId to paths and SIDs.
• SruDbCheckpointTable — internal flush state.

The ESE system tables (MSysObjects, MSysObjids, MSysLocales) are the engine's own catalog. Skim them; do not pivot on them.

Application Resource Use {D10CA2FE-…FA89}

Per-application activity sampled hourly. The single most useful table for "did this run, when, under whom".

Key columns:

• TimeStamp — bucket boundary (OLE variant date, 8-byte float).
• AppId, UserId — foreign keys into SruDbIdMapTable.
• ForegroundCycleTime, BackgroundCycleTime — CPU cycles, not seconds.
• FaceTime — time the UI was visible to the user.
• ForegroundBytesRead, ForegroundBytesWritten, ForegroundNumReadOperations, NumWriteOperations, NumberOfFlushes — disk I/O while focused.
• Background variants of all the I/O columns.

The LT sibling aggregates the same rows weekly and survives up to a year. Granularity drops; reach extends.

Network Data Usage {973F5D5C-…}

Per-application bytes per network profile. The exfiltration table.

• InterfaceLuid — Windows LUID for the interface.
• L2ProfileId — opaque ID; resolve against HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles in the registry for the SSID or wired name.
• L2ProfileFlags — bitmask: 0x100 wired, 0x200 wireless, 0x400 WWAN.
• BytesSent, BytesRecvd — counters since last sample, per process.

Combined with AppId resolution this answers "how many MB did chrome.exe send over the home Wi-Fi between 14:00 and 15:00?". For an exfiltration-specific workflow see detecting data exfiltration with SRUM.

Network Connectivity {DD6636C4-…}

When the system attached to and detached from each network.

• ConnectStartTime — FILETIME of association (precise to the second).
• ConnectedTime — duration in seconds.
• InterfaceLuid, L2ProfileId, L2ProfileFlags — as above.

Places a device on a specific network at a specific moment. Useful for correlating with corporate Wi-Fi controller logs and VPN concentrator records.

Energy Usage {FEE4E14F-…}

Battery and power-source telemetry. Sampled on every transition.

• EventTimestamp — FILETIME of the transition.
• StateTransition — AC plug/unplug, sleep enter/exit, low-battery.
• ChargeLevel, CycleCount, ConfigurationHash.
• DesignedCapacity, FullChargedCapacity (mWh).
• ActiveAcTime, CsAcTime, ActiveDcTime, CsDcTime — time-on counters per power source.

The LT variant tracks battery health degradation over months — also useful for proving "the laptop was never charged at HQ" types of claim.

Push Notifications {D10CA2FE-…FA8F}

For Modern apps using the Windows Push Notification Service.

• NotificationType — toast, tile, badge, raw.
• PayloadSize — bytes of the notification body.
• NetworkType — which interface delivered it.

Less frequently load-bearing in a typical investigation, but the notification cadence sometimes reveals a Modern app that was running in the background when nothing else logged it.

SruDbIdMapTable

Every data table holds AppId and UserId as small integers. Joining to SruDbIdMapTable turns them human-readable.

App paths in IdBlob come in two shapes:

• A full file path, e.g. \\?\C:\Users\suspect\loader.exe.
• A modern AUMID, e.g. Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge.

Binary SIDs decode using the standard SID format; map to user names via HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList from the registry.

Further reading

• What is SRUM and why forensic analysts care
• Using SRUM in a forensic investigation
• The ESE database format that powers SRUDB.dat
• Detecting data exfiltration with SRUM