Where Is the Windows SRUM Database Stored?
Where Windows keeps the SRUM usage database, why the file stays locked, and which tools actually read it.
Last updated
Windows tracks per-app resource usage in an ESE database called SRUDB.dat, tucked inside System32's sru folder. It records application activity, network connections, and power data that forensics folks love. The registry mirrors the live counters under a SRUM extensions key.
The file stays locked while Windows runs, and only administrators can touch it at all. Data lands there about once an hour and at shutdown, so it always lags the live system slightly. Reading it takes a dedicated parser, not a text editor, since ESE is a database format.
Where Windows stores this, by platform
C:\Windows\System32\sru\SRUDB.dat
ESE database with app usage, network, and energy data. Locked on a live system: use admin rights plus a shadow copy to extract it. Pair it with the SOFTWARE hive for readable network names. Hourly flushes mean the newest activity may still sit in the registry.
Frequently asked questions
how do I copy SRUDB.dat from a live system
You need administrator rights, and usually a Volume Shadow Copy, because the running system locks the file. Forensic tools like srum-dump extract it from a shadow copy automatically. Copying it raw from a live box normally fails with a sharing error.
how do I read the SRUM database
Point an ESE parser such as srum-dump at the file plus a copy of the SOFTWARE hive for network name resolution. Output lands in spreadsheet form with per-app usage, network, and power data. Repair a dirty copy first with esentutl after an unclean shutdown.
is the SRUM file always up to date
Yes. Data flushes from the registry to the file roughly hourly and at shutdown, so the freshest hour may be missing. An improper shutdown can also leave the file needing repair before it opens. Collect the registry counterpart for the latest picture.
Notice an outdated path? Let us know.