srum

Windows forensics Engine

PowerShell Script to facilitate the processing of SRUM data for on-the-fly forensics and if needed threat hunting

A new method to extract System Resource Utilization Management (SRUM) forensic artifacts.

Fix the Windows SRUM/SRUJet ESENT event log flood (ESENT 483, 488, 413, 490) safely - one folder ACL, not the dangerous 'Everyone owns C:\Windows' advice

See exactly what Windows tracks, logs, and stores about you — GDID, SRUM, UserAssist & more. Local-first, open source

Single-file HTA GUI for triaging Windows SRUM (System Resource Usage Monitor) with Eric Zimmerman's SrumECmd - DFIR data-exfiltration hunting.

SRUM forensics: prove whether a human was at the keyboard. Parse SRUDB.dat on Linux/macOS. Detect malware, exfiltration, and automated execution. Single static Rust binary.