SRUM tables explained: AppResource, Network, Energy, Push

The big picture

SRUDB.dat is an Extensible Storage Engine (ESE) database. Most of its tables are named with curly-brace GUIDs that identify a SRUM extension — a piece of telemetry that the SRUM service collects on a schedule (every 60 minutes by default, every 10 seconds when AC power changes).

Plus two control tables:

• SruDbIdMapTable — joins integer IDs to application paths or SIDs
• SruDbCheckpointTable — internal flush state

Application Resource Use

Per-application activity sampled once per hour. Each row tells you who ran what, when, and at what cost.

Key columns:

• TimeStamp — bucket boundary
• AppId, UserId — foreign keys into SruDbIdMapTable
• ForegroundCycleTime, BackgroundCycleTime — CPU cycles (not seconds)
• FaceTime — time the app's UI was visible to the user
• ForegroundBytesRead, ForegroundBytesWritten — disk I/O while focused
• ForegroundNumReadOperations / NumWriteOperations / NumberOfFlushes
• Background variants of all the I/O columns

The "Long Term" sibling ({...}LT) aggregates the same rows weekly and is retained for up to a year.

Network Data Usage

Per-application bytes sent and received over each network profile.

• InterfaceLuid — Windows LUID for the network interface
• L2ProfileId — opaque ID resolvable against the SOFTWARE\Microsoft\ Windows NT\CurrentVersion\NetworkList\Profiles registry key for the friendly SSID/wired name
• L2ProfileFlags — bitmask: 0x100 = wired, 0x200 = wireless, 0x400 = WWAN
• BytesSent, BytesRecvd — counters since last sample

Combined with AppId resolution, this answers "how many MB did chrome.exe send over my home Wi-Fi between 14:00 and 15:00?"

Network Connectivity

When the system connected to and disconnected from each network.

• ConnectStartTime — FILETIME of association
• ConnectedTime — duration in seconds
• InterfaceLuid, L2ProfileId, L2ProfileFlags — same as above

Useful for placing a device on a specific network at a specific moment.

Energy Usage

Battery and power-source telemetry. Sampled on every power state transition.

• EventTimestamp — FILETIME of the transition
• StateTransition — AC plug/unplug, sleep enter/exit, low-battery
• ChargeLevel, CycleCount, ConfigurationHash
• DesignedCapacity, FullChargedCapacity (mWh)
• ActiveAcTime, CsAcTime, ActiveDcTime, CsDcTime — time-on counters per power source

The "LT" variant tracks battery health degradation over months.

Push Notifications

For Modern apps that use the Windows Push Notification Service.

• NotificationType — toast, tile, badge, raw
• PayloadSize — bytes of the notification body
• NetworkType — which interface delivered it

Resolution: SruDbIdMapTable

Every data table holds AppId and UserId as small integers. To make them human-readable you join against SruDbIdMapTable:

The parser on the home page does this join automatically — open any SRUM table tab and the AppId / UserId columns render the resolved string when available, or #42 when the IdMap is missing an entry.

Related reading

• What is SRUM and why forensic analysts care
• Using SRUM in a forensic investigation
• The ESE database format that powers SRUDB.dat
• Drop a file into the SRUM parser to see every table live.