Where Is the Windows SRUM Database?
Windows SRUM database SRUDB.dat under System32 sru with app network and energy usage.
Last updated
Windows logs per-app network usage, energy consumption and push traffic into the SRUM database, an ESE file analysts mine for timelines. It records which apps talked, when, and how much data moved.
The file locks while Windows runs, so live copies corrupt. Image the disk or parse it with forensics tools that handle locked ESE databases.
Where Windows stores this, by platform
C:\Windows\System32\sru\SRUDB.dat
ESE database with hourly network, energy and notification tables per app. Copy only from a disk image or volume shadow copy; live file copies read torn. Parse with SRUM forensics tools rather than opening it raw.
Frequently asked questions
What does SRUM record?
Per-application bytes sent and received, energy usage, and notification activity in hourly buckets going back weeks. It is a timeline goldmine for incident response.
Can I delete SRUDB.dat to clear history?
Windows recreates it on boot, but tampering with telemetry stores looks terrible in any investigation. Disable the underlying services instead if policy allows.
Notice an outdated path? Let us know.