# SRUM

System Usage Resource Manager (`SRUM`) records numerous metrics of system activities such as:&#x20;

* System Usage
* Program execution
* Executed programs network usage
* Historical data **lasts from 30-60 days**.&#x20;

Entries are made with the **timestamp of the insertion not occurrence.**

**Entries contain:**&#x20;

* application resource usage (`ARU`) table that tracks program execution. For each `ARU` the following information may be recorded:&#x20;
  * Timestamp of `SRUM` entry&#x20;
  * Full path of executable or application info / description of built in components
  * Execution users SID&#x20;
  * Metrics on CPU usage (time in foreground/background)
  * Metrics with I/O operations&#x20;
* App timeline provider also tracks program execution. For each `ARU`&#x20;
  * Timestamp on `SRUM` entry&#x20;
  * Timestamp of compilation of executable&#x20;
  * timestamp of approximate end of execution
  * total duration (in miliseconds)&#x20;
  * Users `SID`&#x20;
  * Name of executable and built in description&#x20;
* Network usage data that tracks program execution and the network usage of executed programs. For each `ARU`:&#x20;
  * Timestamp of `SRUM` entry&#x20;
  * Full path of executable or app info
  * metrics on network usage - `bytes in / bytes out` on a given interface

### Location:&#x20;

```powershell
# SRUM DB 
%SystemRoot%\System32\SRU\SRUDB.dat

# Registry (used to translate some information in the DB - e.g. User SID to username and network shares) 
%SystemRoot%\System32\config\SOFTWARE
```

More information on the tables in the `SRUM` database is referenced in the [`srum-dump`](https://github.com/MarkBaggett/srum-dump) project.

## Parsing:&#x20;

**Repairing the `SRUDB.dat` database**

The (copied) `SRUM` database will have to be repaired as not on host device. The`esentutl` util can be used to recover it (recommended to make a copy of the `SRU` directory before repairing the database):

```powershell
# The following commands should be executed in the directory containing the database files.
esentutl.exe /r sru /i
esentutl.exe /p SRUDB.dat
```

[`SrumECmd` ](https://github.com/EricZimmerman/Srum)can then be used to parse and extract information from the `SRUDB.dat` database, and correlates information from the `SOFTWARE` registry hive.

```powershell
# Parses the specified SRUM database, using the optionally provided SOFTWARE registry hive.
SrumECmd.exe -f <SRUDB.dat | SRUM_DB_FILE> [-r <SOFTWARE>] --csv <OUTPUT_DIRECTORY>

# Recursively look for SRUDB.dat and SOFTWARE files in the specified directory.
SrumECmd.exe -d <DIRECTORY> --csv <OUTPUT_DIRECTORY>
```
