srum logs 30 to 60 days of per app network usage on windows

the log you didn't know you had

quick question. if someone asked you "what sent 4gb of data out of your machine last tuesday," could you answer that right now, today, with no packet capture running and no fancy edr agent watching? most people can't. but windows has been quietly keeping the receipts anyway, and it's called srum.

srum stands for system resource usage monitor. it's been baked into windows since windows 8, originally built so the os could make smarter decisions about battery life and network throttling. nobody designed it to be a forensic goldmine, but that's exactly what it turned into. it sits at C:\Windows\System32\sru\SRUDB.dat and quietly logs per-application network usage, cpu usage, and more, in roughly hourly buckets, going back 30 to 60 days depending on your system.

the wild part is almost nobody checks it. it's not hidden, it's not exotic, it's just ignored.

what srum actually tracks

srum isn't a packet capture and it doesn't care about ip addresses or destinations. what it does give you is a per-executable breakdown of bytes sent and bytes received, tied to specific time windows. so if malware, a rogue script, or a compromised app quietly shipped gigabytes of data off your machine, srum has a record of which exe did it and roughly when, even if you had zero monitoring tools running at the time.

this is huge for defenders because it turns "i have no idea what happened" into "let me check the one database windows has been keeping the whole time."

pulling the data with srumecmd

srumecmd is a free tool from eric zimmerman's forensic toolkit that parses the srum database into readable csv files. here's the command:

SrumECmd.exe -f C:\Windows\System32\sru\SRUDB.dat --csv .

breaking it down piece by piece:

SrumECmd.exe is the parser itself.
-f points it at the srum database file you want to read.
C:\Windows\System32\sru\SRUDB.dat is the actual database, a local esent file windows maintains automatically, no setup required.
--csv . tells it to dump the parsed output as csv files into the current directory.

run that and you'll get a handful of csv files covering different srum tables, including one specifically for network usage per application.

finding the top offender

once you've got the csvs, powershell does the rest of the work:

Import-Csv *_NetworkUsages.csv | sort {[int]$_.BytesSent} -desc | select -first 5 ExeInfo,BytesSent

this imports the network usage csv, sorts every entry by bytes sent in descending order, and shows you the top 5 apps by outbound traffic. ExeInfo tells you which executable was responsible, BytesSent tells you how much it pushed out.

the top row is usually your answer. if it's a browser or a backup tool, fine, that's expected. if it's some process you've never heard of, or a legit-looking exe running from a weird path like appdata or a temp folder, that's your lead. srum won't tell you where the data went, but it tells you exactly where to point your next investigation, whether that's checking prefetch, event logs, or network logs from your firewall if you have them.

why this matters even if you're not under attack

you don't need to suspect a breach to get value out of this. running srumecmd once in a while is basically a free audit of what's been talking on your network. it catches things like abandoned software phoning home, a browser extension gone rogue, or a "free" tool that's quietly uploading more than it should. it's also genuinely useful after the fact, like if you notice your data cap got blown through and you want to know why.

the takeaway

srum has been sitting on your windows machine this whole time, keeping a rolling log of which apps sent what, and almost nobody looks at it until something's already gone wrong. don't wait for that. grab srumecmd, run it against your own srudb.dat, sort by bytes sent, and actually look at your top 5. it takes a few minutes and costs nothing, and it turns "i have no visibility into this" into "i have 30 to 60 days of receipts." check your own box before you assume you're clean.