Skip to content

Install and run SRUM-DUMP

Use this journey to produce a documented workbook from verified evidence. The screenshots show a live-system test because that was the original SUSA proof of concept. For casework, point the wizard at working copies in controlled storage.

Prepare the tool and case workspace

Tool provenance

  1. Download the current Windows build from the official SRUM-DUMP releases.
  2. Record the release tag, downloaded filename, source URL, download time, and licence.
  3. Calculate SHA-256 and retain the value with the case notes.
  4. Place the verified executable in C:\Tools\SRUM-DUMP or the approved tools directory.

Evidence boundary

  1. Retain protected acquisition copies of SRUDB.dat and, when available, the matching SOFTWARE hive.
  2. Create verified working copies and a separate empty output directory.
  3. Record the source host or image, original paths, acquisition method, time zone, and hashes.
  4. Do not write parser output into the evidence source directory.

Screenshot: Download SRUM-DUMP from the release page

Create a controlled output folder for the proof of concept:

New-Item -ItemType Directory -Path 'C:\Labs\SRUM-DUMP'

Screenshot: Create an empty SRUM-DUMP output folder

Use a simple folder contract

For a real case, use separate source, working, output, and notes folders. Record the full paths instead of relying on the folder names to establish provenance.

Run the guided interface

  1. Launch the verified buildRight-click srum_dump.exe and select Run as administrator only when the approved input requires it. Accept the User Account Control prompt.

Screenshot: Accept the User Account Control prompt

  1. Select the output directoryChoose a new or empty controlled folder. Confirm it is outside the protected source and working-copy locations, then select Next.

Screenshot: Select the output and working directory

  1. Select SRUDB.datChoose the verified working copy. The live default is usually C:\Windows\System32\SRU\SRUDB.dat, but use it only for an authorised live-triage task. Select Next.

Screenshot: Select the SRUM database

  1. Add the matching SOFTWARE hiveThis input is optional but recommended because it can resolve network profiles and other identifiers. Use the hive acquired with the database, or leave the field blank and record the limitation. Select Finish.

Screenshot: Select the corresponding SOFTWARE registry hive

  1. Review the generated configurationConfirm the output folder and generated srum_dump_config.json. For a first pass, preserve the generated file unchanged. Advanced analysts can edit a copy to add highlighting or mappings, but must retain the original and document every change.
  2. Start the parseSelect Confirm. Do not treat a green progress bar alone as success. Retain the final record count, log, warnings, parser engine, and produced files.

Screenshot: Confirm the SRUM-DUMP configuration and output folder

When Current Task: Finished appears, record the displayed total and review the message pane before selecting Close. The screenshot reports 12,043 total records and notes that engines can retrieve different counts.

Screenshot: Completed SRUM-DUMP parse and record count

Verify the output package

The controlled output should contain the generated workbook or CSV files, srum_dump_config.json, srum_dump.log, and any other version-specific working files. Preserve the directory listing and calculate hashes before analysis.

Screenshot: SRUM-DUMP workbook and supporting files in the output directory

Get-ChildItem 'C:\Labs\SRUM-DUMP' -File |
  Get-FileHash -Algorithm SHA256 |
  Export-Csv 'C:\Labs\SRUM-DUMP\output-sha256.csv' -NoTypeInformation
CheckpointParse is reviewableThe verified inputs, tool and engine, record count, warnings, configuration, log, outputs, and hashes are recorded.

Optional command-line workflow

The command line is useful for repeatable processing. Confirm available options with the exact build before running it:

.\srum_dump.exe -h

Example using verified working copies and a separate output folder:

.\srum_dump.exe `
  -i 'E:\Cases\SUSA-114\working\SRUDB.dat' `
  -r 'E:\Cases\SUSA-114\working\SOFTWARE' `
  -o 'E:\Cases\SUSA-114\output' `
  -e dissect `
  -f xls

The official version 3 help identifies SRUDB.dat as required, the registry hive as optional, dissect and pyesedb as engine choices, and xls or csv as output choices. Record the full command. Do not use --NO_CONFIRM until the workflow and output paths have been validated with the selected version.

Do not silently repair or replace evidence

If the database will not parse, protect the original and record the failure. Try a verified working copy and review the project documentation and known issues. Any recovery, repair, alternate engine, or conversion must operate on a separate labelled derivative and remain documented.

Troubleshooting the run

Symptom First check
Access denied on a live path Confirm authority and elevation. Prefer an acquired working copy.
Output folder rejected or mixed with old files Select a new empty folder outside the evidence tree.
Network profile names are unresolved Confirm the matching SOFTWARE hive was supplied and parsed without error.
Record count differs between engines Preserve both commands, logs, outputs, and hashes; do not choose a count without explaining the parser difference.
Workbook is missing after completion Review srum_dump.log, final task text, output format, permissions, and available storage.
Processing appears slow Review log activity and configuration. Dirty-word highlighting can increase processing time.
PreviousSRUM-DUMP overviewNextExamine the workbook