Introduction
The Windows operating system maintains various logs and databases for performance monitoring, user activity tracking, and resource usage statistics. One such database is the SRUDB.dat file, which stands for System Resource Usage Database. For forensic analysis, performance troubleshooting, and security auditing, parsing and analyzing this database can provide valuable insights.
Eric Zimmerman's tool, SrumECmd, is designed to facilitate the extraction and analysis of data from the SRUDB.dat file.
Prerequisites
Before we begin, ensure you have the following:
SrumECmd Tool: Download Eric Zimmerman's SrumECmd tool from the official repository.
SRUDB.dat File: The SRUDB.dat file you want to analyze. You can find this file on your system at C:\Windows\System32\sru.
KAPE Tool (Optional): For advanced users, KAPE (Kroll Artifact Parser and Extractor) can automate the collection and parsing process.
Step-by-Step Guide
1. Download and Prepare SrumECmd
First, download SrumECmd from Eric Zimmerman's official repository. Extract the contents to a convenient location on your computer.
2. Locate and Copy SRUDB.dat
Navigate to the directory containing the SRUDB.dat file:
C:\Windows\System32\sruCopy the SRUDB.dat file to a location where you have full read/write permissions, such as:
(I am choosing download folder)
C:\Users\<YourUsername>\Downloads3. Open Command Prompt
Open a Command Prompt window with administrative privileges. You can do this by searching for "cmd" in the Start menu, right-clicking on Command Prompt, and selecting "Run as administrator."
4. Run SrumECmd
Navigate to the directory where you extracted SrumECmd. Use the following command to parse the SRUDB.dat file and output the results to a CSV file:
SrumECmd.exe -f "C:\Users\<YourUsername>\Downloads\SRUDB.dat" --csv "C:\Users\<YourUsername>\Desktop\SrumECmd"-f "C:\Users\<YourUsername>\Downloads\SRUDB.dat": Specifies the path to the SRUDB.dat file.
--csv "C:\Users\<YourUsername>\Desktop\SrumECmd": Specifies the directory where the output CSV files will be stored.
5. Review the Output
Once the command executes successfully, navigate to the specified output directory (in this case, C:\Users\<YourUsername>\Desktop\SrumECmd).
You should find multiple CSV files containing parsed data from the SRUDB.dat file.
Using KAPE for Collection and Parsing
For users familiar with KAPE, you can streamline the process by collecting and parsing the SRUDB.dat file simultaneously.
1. Install KAPE
Download and install KAPE from the Kroll Artifact Parser and Extractor GitHub page.
2. Configure KAPE
Create a configuration file or use the default configuration to specify the collection and parsing targets. For SRUDB.dat, you can use a module that includes SrumECmd.
3. Execute KAPE
Run KAPE with the appropriate flags to collect and parse the SRUDB.dat file. An example command might look like:
kape.exe --target SRUM --module SrumECmd --output "C:\Users\<YourUsername>\Desktop\SrumECmd"This command tells KAPE to collect the SRUDB.dat file using the SRUModule and parse it with SrumECmd, outputting the results to the specified directory.
Analyzing the Results
Open the generated CSV files using timeline explorer(My preferred one). The CSV files will contain detailed logs and statistics on system resource usage, network activity, application activity, and more. You can filter, sort, and analyze this data to identify patterns, anomalies, or specific events of interest.
Conclusion
Eric Zimmerman's SrumECmd is a powerful tool for parsing and analyzing SRUDB.dat files, providing detailed insights into system resource usage and user activity. Whether you use it standalone or integrate it with KAPE for automated workflows, SrumECmd can significantly enhance your forensic and troubleshooting capabilities.
Akash Patel