SRUM-DUMP¶
What SRUM-DUMP does¶
Windows resource usage examination
SRUM-DUMP parses the Windows System Resource Usage Monitor database,
SRUDB.dat, and produces a multi-sheet workbook or CSV files for analysis. It
can enrich identifiers with information from the matching SOFTWARE registry
hive and generates a configuration file that records discovered applications,
users, networks, and table mappings.
Use SRUM as historical telemetry. A row can support that Windows recorded resource usage for an application, user identifier, interface, and time bucket. It does not by itself prove who initiated an action, why it occurred, or that a process remained active for the whole interval.
Reviewed against SRUM-DUMP 3.2
This guide uses the version 3.2 interface shown in the preserved screenshots and was checked against the project's official documentation in August 2026. Record the exact release, executable hash, parser engine, and options used in each examination.
Choose your journey¶
Verify the release, prepare working copies, select the database and optional hive, then preserve the parser log.
Complete when the run finishes without an unrecorded error.Beginner · Windows · 15–25 min 02Examine the workbookNavigate the SRUM tables in LibreOffice, filter a bounded time window, and connect records across applications, users, and interfaces.
Complete when one observation is traceable to source fields.Practical · LibreOffice · 25–40 min 03Hands-on LabsWork a realistic data-exfiltration lead in the browser simulation or an isolated Windows VM.
Complete when the finding separates observation from inference.Guided · 30–120 minEvidence workflow¶
The database, matching hive, parser log, configuration file, workbook, filters, and exported findings form one evidence trail. Preserve them together so a second analyst can reproduce the same rows and understand every interpretation.
A verified working copy of SRUDB.dat.
The matching SOFTWARE hive, original paths, host identity, acquisition time, and time zone.
A separate empty folder containing the log, configuration, workbook or CSV files, hashes, and analyst notes.
What to examine first¶
Network Data Usage Monitor
Which application used the network?¶
Start with timestamp, application or process, user information, interface, profile, bytes sent, and bytes received. Use it to identify activity clusters, then test them against independent network and endpoint evidence.
Application Resource Usage
Which application consumed resources?¶
Review application identity with foreground, background, CPU, disk, and network related fields where available. Field sets vary by Windows build and table.
Application Timeline Provider
When was application activity recorded?¶
Use the timeline view to locate useful periods and compare application records. Treat aggregate or bucketed values according to their displayed field labels.
Energy and connectivity tables
What supporting system context exists?¶
Energy, connectivity, and long-term tables may add context, but some can be empty or unavailable. Record absence and parse errors instead of filling gaps with assumptions.
Collection and interpretation boundaries¶
- Analyse working copies
AcquireSRUDB.datand the matchingSOFTWAREhive through an authorised forensic process, hash them, protect the originals, and parse verified copies. - Retain source pairing
The hive can resolve network profiles and other identifiers. A hive from another host or point in time can introduce misleading labels. - Record the parser path
SRUM-DUMP 3 supportsdissectandpyesedb. Preserve the engine and any warnings because engines can produce different results for some records. - Treat timestamps precisely
Keep the displayed UTC field name, host time-zone context, and any conversion method. Do not relabel a bucket time as an exact process start or user action. - Corroborate important findings
Compare SRUM observations with event logs, Prefetch, Amcache, Shimcache, browser data, firewall or proxy logs, file-system metadata, and other case evidence.
Live parsing changes the operating environment
Administrative access may let SRUM-DUMP read the live database, but a live run is not equivalent to forensic acquisition. Prefer collected evidence and verified working copies. If live triage is authorised, record the collection time, privileges, tool execution, and impact.
Claim boundaries¶
Supported observation
The examined database contained a record associating the displayed application, identifier, time field, interface, and resource values under the recorded parse conditions.
Not established alone
A named person intentionally ran the application, a particular destination was contacted, a transfer succeeded, or a displayed time is the exact start or end of an event.