01Location
- C:\Windows\System32\sru\SRUDB.dat
02Questions it answers
- Which applications consumed resources for which user, and in which time window?
- How many bytes did an application send and receive?
- Which network interfaces or profiles were connected, and for how long?
- How did foreground and background activity of an application compare?
03Format and versions
| Format | Extensible Storage Engine (ESE/EDB) database. Tables include SruDbIdMapTable (IdType, IdIndex, IdBlob; IdType 3 = SID), {D10CA2FE-6FCF-4F6D-848E-B2E99266FA89} Application Resource Usage, {973F5D5C-1D90-4944-BE8E-24B94231A174} Network Data Usage, {DD6636C4-8929-4683-974E-22C046A43763} Network Connectivity Usage, {FEE4E14F-02A9-4550-B5CE-5FA2DA202E37} Energy Usage and {DA73FB89-2BEA-4DDC-86B8-6E048C6DA477} Energy Estimator. |
|---|---|
| Applies to | Documented from Windows 10 test data in esedb-kb; Windows 8 coverage is still marked as to-do. |
04Key fields
| Field | What it tells you |
|---|---|
| AppId / UserId | IdIndex values resolved through SruDbIdMapTable to application strings and SIDs. |
| ForegroundCycleTime / BackgroundCycleTime | CPU cycle counters in the Application Resource Usage table. |
| Foreground/Background BytesRead and BytesWritten | Disk I/O volumes per application. |
| BytesSent / BytesRecvd | Network bytes per application, interface (InterfaceLuid) and profile (L2ProfileId). |
| ConnectedTime / ConnectStartTime | Connectivity duration and start time in the Network Connectivity Usage table. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| TimeStamp (all provider tables) | OLE Automation date | Time of the usage record, not the start of a process. |
| ConnectStartTime | FILETIME | Start of a network connection in the connectivity table. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy SRUDB.dat (and related ESE files) and check the database state; a dirty-shutdown database needs recovery before use.
- Export SruDbIdMapTable and resolve AppId and UserId in every provider table.
- Convert OLE Automation dates and FILETIMEs to UTC and build per-application timelines.
- Correlate with Prefetch, BAM and event logs for execution context.
07Interpretation pitfalls
- Rows are usage records; they do not record individual process launches or command lines.
- Provider tables and columns depend on installed SRUM extensions; several providers are only partly identified.
- An ESE database in dirty-shutdown state must not be treated as complete until recovered.
09Sources
- System Resource Usage Monitor (SRUM) database libyal / esedb-kb (J. Metz) · checked 2026-10-14
- System Resource Usage Monitor ForensicArtifacts / artifacts-kb · checked 2026-10-14
- Extensible Storage Engine (ESE) Database File (EDB) format libyal / libesedb (J. Metz) · checked 2026-10-14