SRUM数据库取证与数据提取解码实用指南

Jul 17, 2026

Upload by Himbo

System Resource Usage Monitor (SRUM) is a Windows 8/8.1 technology that records process and network statistics over time in a local database. The paper explains SRUM’s role for forensic examiners, outlines how the system collects and periodically updates data, and specifies what information is stored versus what is intentionally omitted. It examines database locations and formats, provides working details for extracting and decoding records, and demonstrates forensic value in correlating users, processes, and network activity for incident response.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

AccessFree to download

Introduction

Research methods

System Resource Usage Monitor

Data collection and update frequency

Viewing SRUM data on Windows

Digital Investigation 12 (2015) 53e65 Contents lists available at ScienceDirect Digital Investigation journal [homepage: www. elsevier. com/locate/diin](homepage: www. elsevier. com/locate/diin) | Forensic implications of System Resource Usage Monitor (SRUM) data in Windows 8
Yogesh Khatri*
163 South Willard Street, P O Box 670, VT 05402-0670, USA | | | | --- | --- | --- | | a r t i c l e i n f o | a b s t r a c t
The Microsoft Windows 8 operating system has a newly added feature to track system resource usage, speciﬁcally process and network metrics over time. Process related information such as process owner, CPU cycles used, data bytes read/written, and network data (sent/received) are continuously recorded by a mechanism called System Resource Usage Monitor (SRUM). This paper describes the SRUM mechanism, its databases, Windows registry entries, data logging, and potential uses in a forensic examination. Prior to this applied research, no tools were available to parse the SRUM data to a usable format. As part of this paper, two scripts have been developed to aid forensic examiners who would want to read, parse, and decode this information from a forensic disk image.
© 2015 Elsevier Ltd. All rights reserved. | | | Article history:
Received 5 March 2014
Received in revised form 16 December 2014 Accepted 15 January 2015
Available online | | | | Keywords:
System Resource Usage Monitor SRUM
Windows 8
Forensics
Process metrics | | | Introduction System Resource Usage Monitor (SRUM) is a new technology that made its debut in Windows 8. SRUM tracks process and network statistics over time in a database. The information collected by SRUM includes process details, user details, CPU cycles, and network data sent or received by a particular process. Only a limited amount of this information is available to the end user e the bulk of the SRUM database is not displayed. Windows 8.1 which released in October 2013 continued to use this technology and expanded upon it. SRUM offers forensic examiners an historical view into past system usage on a computer. From a forensic examiner's point of view, this database can be immensely useful in tracing user activity and linking process, user and network activity together. This paper examines SRUM databases, exposes the locations of these databases, the types of data stored, the formats and some working details of SRUM. A practical guide to extracting and decoding this * Tel.: þ1 626 344 9189. E-mail address: [yogesh@swiftforensics.com](yogesh@swiftforensics.com). [http://dx.doi.org/10.1016/j.diin.2015.01.002](http://dx.doi.org/10.1016/j.diin.2015.01.002) [1742-2876/](1742-2876/)© 2015 Elsevier Ltd. All rights reserved. data is included in this paper. A limited analysis and interpretation of this data is presented to demonstrate its usefulness in a forensic investigation. This includes tracking processes in ways previously not possible, linking of process

FAQs

What is SRUM and what does it record on Windows 8/8.1 systems?

SRUM tracks process and network statistics over time, storing process details, user ownership, CPU cycle usage, and network data sent or received by processes. It also includes Windows Push Notification details and network connectivity timing.

Which kinds of information are not collected by SRUM?

SRUM does not record command-line arguments, DLL information, resource handles, thread information, or file access. It also does not capture network endpoint details such as IP addresses, computer names, protocols, or port numbers.

How often does SRUM update its database, and what can force an immediate update?

The default database update period is one hour, with typical writes at 30 minutes after each hour on Windows 8. A shutdown triggers an immediate update of the SRUM database.

Jul 17, 2026

Upload by Himbo