Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. sru
FolderRisk: Caution

sru C:\Windows\System32\sru

C:\Windows\System32\sru: the SRUDB.dat database of the System Resource Usage Monitor (SRUM), a history of application usage. A key forensic artifact.

Updated on By AltF4 Formation

What it’s for

sru holds the database of the System Resource Usage Monitor (SRUM), which records application activity on the machine: network use, energy, CPU. That data feeds the App history tab of Task Manager, among other things. In digital forensics it is also one of the most telling artifacts for what ran and what moved data.

What it contains

  • SRUDB.dat, the SRUM database, in ESE format.
  • The associated ESE transaction log files (.log, .chk), as with ntds.dit.
  • The SRUM extension tables, described in the Registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions.

Risks and best practices

  • A service writes to SRUDB.dat all the time: the file is locked and cannot be deleted while Windows runs.
  • For a forensic collection, copy it with esentutl /y ... /vss, which goes through a shadow copy. Copying from File Explorer fails.
  • The database reveals usage habits: applications launched, volume of data per application. Treat its copies as personal data.

Useful commands

Fenêtre de terminal
# Files in the folder (read-only)
Get-ChildItem "$env:windir\System32\sru" -Force | Select-Object Name, Length, LastWriteTime


# SRUM extensions declared in the Registry
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions' | Select-Object PSChildName
Fenêtre de terminal
:: As administrator: copy the locked database through a shadow copy
esentutl.exe /y C:\Windows\System32\sru\SRUDB.dat /vss /d C:\Temp\SRUDB.dat

Report a mistake