SRUM

What SRUM records and why it matters

SRUM is a Windows accounting database that keeps local records of per-process and per-user activity, including network use, application activity and resource consumption. It is valuable because it preserves historical behaviour that can corroborate execution timelines, user interaction and system use.

Unlike a simple event log, SRUM is designed to aggregate usage over time. That makes it especially useful when an investigator needs to answer not just what ran, but how the system and user profile behaved across a period of activity.

How SRUM supports endpoint forensics

In practice, SRUM is often used alongside registry artefacts, event logs, prefetch, jump lists and file system evidence to reconstruct a host timeline. It can help confirm whether an application was launched, whether network activity was associated with that activity, and whether the observed usage pattern matches the rest of the endpoint evidence.

Forensic value is highest when SRUM is interpreted as one source of corroboration rather than a standalone proof point. The database can show patterns, but those patterns still need to be aligned with user context, timestamps and other Windows artefacts to avoid over-reading partial data.

Windows artefacts are best interpreted as a set, and the Windows Forensic Artefacts Guide is a useful reference for placing SRUM in the broader Windows evidence picture.

What investigators look for in SRUM data

Investigators typically look for usage trends that answer basic attribution and timeline questions: which process consumed resources, which user account was active, and whether observed network or application activity aligns with the suspected incident window. That makes SRUM useful for triage when a host is noisy, shared or only partially preserved.

Because SRUM is local to the endpoint, it can also be helpful when central logging is incomplete or when defenders need to validate whether a host behaved as expected before a suspected compromise. The artefact is not a replacement for telemetry, but it often fills gaps left by short log retention or missing host visibility.

How SRUM is used in investigations and response

SRUM is most useful when responders are trying to reconstruct usage after the fact, especially on Windows systems where local artefacts may be the only durable evidence of activity. It can support incident scoping, user-behaviour review and retrospective validation of suspicious process or network patterns.

Practitioners should treat the database as evidence that may survive beyond other logs, which is why it is often collected during triage and post-incident review. The key question is whether the artefact helps explain how the endpoint was used, and whether that usage is consistent with the incident hypothesis.