C:\Windows\System32\sru\SRUDB.dat

In the world of Windows system administration and digital forensics, understanding how a system has been used—long after an event occurs—is crucial. One powerful but lesser-known utility that facilitates this is srumecmd . This command-line tool parses the System Resource Usage Monitor (SRUM) database, a hidden repository of application, network, and energy usage data built into Windows starting with Windows 8 and continuing through Windows 10 and 11. What is SRUM? SRUM is a Windows component that silently logs a wide array of system activity. It was originally designed to help Windows manage power and background tasks (via the Energy Estimation Engine ), but its forensic value quickly became apparent. SRUM stores data in an Extensible Storage Engine (ESE) database located at: