SRUM vs Prefetch vs Amcache: which execution artifact to use

5/19/2026

Three artefacts, three different things proved. Reaching for the wrong one for the question at hand wastes time and leaves the report defensible only on the bits the other two would have nailed cold. The short form: Prefetch is your second- precise recent-run record, SRUM is your long-range record with user attribution and bytes, Amcache is your binary hash plus presence. They corroborate; they do not substitute.

Side by side

	SRUM	Prefetch	Amcache
Proves execution	Yes (CPU cycles > 0)	Yes	Associated, not definitive
Time resolution	~1-hour bucket	Per-second (last 8 runs)	Install / first-seen
History depth	30–60 days (short term), ~1 year (LT)	~1024 entries, rolls over	Weeks to months
User attribution	Yes (UserId → SID)	No	No
Bytes / network	Yes	No	No
Binary hash	No	No	Yes (SHA-1)
Default availability	On (Win8+)	Often off on SSD / server	On

When SRUM is the right tool

The questions only SRUM answers cleanly:

Which user account ran this tool? Prefetch and Amcache cannot attribute by user. SRUM's UserId resolves to a SID via SruDbIdMapTable.
How much data did the process send? Only Network Data Usage has per-process byte counters.
Did this run repeatedly over the last month? SRUM keeps 30-60 days plus an LT sibling. Prefetch on a busy host probably rolled over in days.
Was the device on AC or battery when it ran? Energy Usage gives you the power-state context, which is sometimes the difference between "ran in the office" and "ran in a coffee shop".

When SRUM is the wrong tool

Exact second of the most recent execution. Prefetch .pf LastRunTime slots — last 8 with one-second precision.
Binary hash to match against threat intel. Amcache SHA1 is the right pivot.
Server with Prefetch disabled and SRUM also stale. Amcache's InventoryApplicationFile survives in places nothing else does.
The host has been off for months. SRUM does not run when the machine is off; Amcache survives untouched.

The combined workflow

Amcache. Get the binary's SHA-1 and the InventoryApplicationFile LastWrite (Appraiser noticed the file).
Prefetch. Pull precise timestamps for the most recent runs and the volume serial of the disk it ran from.
SRUM. Confirm long-range recurrence, attribute to a user SID, measure any network egress.
EVTX / Sysmon. For real-time corroboration of process creates (Sysmon 1, EVTX 4688) — see EVTX triage.
Shimcache / RecentFileCache. Shimcache and RecentFileCache round out the execution-evidence picture on older Windows.

A report that corroborates execution across SRUM + Prefetch + Amcache holds up. A report leaning on one of the three is a target for cross- examination.

A worked pivot

Suspicious loader.exe discovered in \Users\suspect\AppData\Local\Temp\.

Amcache → SHA-1 abc123…, LastWrite 2026-04-10 14:23 UTC.
Prefetch → LOADER.EXE-XXXXXXXX.pf, LastRunTime 2026-04-10 14:23:18, six total run counts.
SRUM Application Resource Use → six rows for the AppId resolving to the loader path, spread across April 10-15, all under the suspect's SID, all with non-zero BackgroundCycleTime.
SRUM Network Data Usage → 78 MB outbound on the 2026-04-12 21:00 bucket, network = mobile broadband.
USN / MFT → archive staged.zip written in the same minute as the 21:00 SRUM bucket.

Five artefacts, one story.

Frequently asked questions

Does SRUM prove a program executed?

Yes. A row in the Application Resource Use table with non-zero CPU cycles means the process ran during that hourly bucket. Unlike Prefetch it also ties the execution to a user SID and resource cost.

Is Prefetch more precise than SRUM for execution time?

Prefetch records the last 8 run timestamps to the second, so for the most recent executions it is more precise. SRUM buckets activity into ~1-hour windows but retains far more history (30–60 days vs Prefetch's ~128 entries).

Can Amcache prove execution?

Amcache proves presence and is strongly associated with execution, but it is primarily a program-inventory artifact. SRUM and Prefetch are stronger direct execution evidence.

Which artifact survives the longest?

Amcache and SRUM both retain weeks to months. Prefetch is capped at 1024 files (and disabled by default on servers/SSDs in some configs), so it rolls over fastest on busy systems.

Should I use only one of them?

No. They corroborate each other. Prefetch gives precise recent timestamps, SRUM gives long-range activity plus user attribution and bytes transferred, Amcache gives the binary's SHA-1 and install metadata. Together they build a defensible timeline.