SRUM Database Parser
This EnScript parses the System Resource Usage Monitor (SRUM) ESE database, SRUDB.dat, which is located in the %SYSTEMROOT%\System32\sru folder. Only the core database-file will be parsed, not any log-files.
The database contains a significant amount of information over and above that available from other sources, e.g., prefetch. It is particularly useful when it comes to linking users to particular processes.
The primary output of the script is a SQLite database, one for each SRUDB.dat file parsed.
This format was chosen to facilitate comprehensive querying of SRUM data e.g., JOINing values from multiple tables to cross-reference data pertaining to a particular process or user.
The script supports the following SRUM extensions:
- SDP Volume Provider - {17F4D97B-F26A-5E79-3A82-90040A47D13D}
- App Timeline Provider - {5C8CF1C7-7257-4F13-B223-970EF5939312}
- VFUProv (purpose unknown) - {7ACBBAA3-D029-4BE4-9A7A-0885927F1D8F}
- SDP Physical Disk Provider - {841A7317-3805-518B-C2EA-AD224CB4AF84}
- Windows Network Data Usage Monitor - {973F5D5C-1D90-4944-BE8E-24B94231A174}
- Tagged Energy Provider - {B6D82AF1-F780-4E17-8077-6CB9AD8A6FC4}
- WPN SRUM Provider - {D10CA2FE-6FCF-4F6D-848E-B2E99266FA86}
- Application Resource Usage Provider - {D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}
- Energy Estimation Provider - {DA73FB89-2BEA-4DDC-86B8-6E048C6DA477}
- SDP Cpu Provider - {DC3D3B50-BB90-5066-FA4E-A5F90DD8B677}
- Windows Network Connectivity Usage Monitor - {DD6636C4-8929-4683-974E-22C046A43763}
- SDP Network Provider - {EEE2F477-0659-5C47-EF03-6D6BEFD441B3}
- Energy Usage Provider - {FEE4E14F-02A9-4550-B5CE-5FA2DA202E37}
The data from each extension is stored in a separate table in the SRUDB.dat database.
Each record listed therein will have a TimeStamp, AppId and UserId column.
The 'TimeStamp' column represents when the record was written, which may be sometime after the activity to which it relates took place. Timestamps are discussed further below.
The AppId and UserId columns link to the names of applications and user-SIDs stored in the IdBlob column of another table called 'SruDbIdMapTable'. As the name of this column implies, the values it contains are stored in binary, which the script will convert automatically upon reading.
With the exception of values from the SruDbIdMapTable.IdBlob column, the aforementioned tables are reproduced in the SQLite database as-is. The examiner is encouraged to validate their contents using another application such as ESEDatabaseView. Note that the current version of this particular application doesn't identify fixed-length null values.
SRUM timestamps appear to take two forms: JET_coltypDateTime timestamps and Windows FILETIME timestamps stored as JET_coltypLongLong (signed 64-bit integer) values.
JET_coltypDateTime is a native format of ESE databases, so the script reads timestamps of this type automatically.
JET_coltypLongLong timestamps are not native, so the script presents them as-is in the aforementioned tables so that they can be examined/verified.
The script will produce a SQLite VIEW for each table, one that converts FILETIME timestamps to human-readable format as well as cross-referencing the values in the AppID and UserID columns to those stored in the 'SruDbIdMapTable' table.
Timestamps are presented as-is without any TZ or DST settings applied.
This version of the script does not interpret the NET_LUID structure from InterfaceLuid values. This functionality may be included in a future release.
For additional information, please see the following Twitter post:
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now