Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SRUM Forensics

Avatar for Veronica Schmitt Veronica Schmitt
October 26, 2018
Technology
720
0

SRUM Forensics

Delving into the world of SRUM forensics.

Avatar for Veronica Schmitt

Veronica Schmitt

October 26, 2018

More Decks by Veronica Schmitt

See All by Veronica Schmitt
The Autopsy of the PHOENIX X36 Hemodialysis System
Avatar for Veronica Schmitt velandra666
2
1.1k

Other Decks in Technology

See All in Technology
VPCセキュリティ対応の最新事情
Avatar for nagisa_53 nagisa53
1
340
41歳でAWSが好きすぎてITエンジニアになったおっさんの話
Avatar for Yuuki Yamashita yama3133
1
780
全社でのソフトウェアサプライチェーン攻撃対策をやってみた with Takumi Guard
Avatar for kaita z63d
0
320
エンタープライズデータへ安全につなぐ Production-ready なエージェント設計 ― AI × MCP リファレンスアーキテクチャ ― #AIDevDay
Avatar for CData Software Japan cdataj
1
170
AI時代におけるテストの基礎の再定義 / Rethinking the Fundamentals of Testing in the AI Era
Avatar for Matsu mineo_matsuya
15
5.9k
2026年のソフトウェア開発を考える（2026/07版） / Agentic Software Engineering 2026-07 Findy Edition
Avatar for Takuto Wada twada
PRO
30
17k
NYC Summit 2026 における Amazon Bedrock AgentCore のアップデート
Avatar for Renya Kujirada ren8k
0
160
ソフトウェアアーキテクチャ研修【MIXI 26新卒技術研修】
Avatar for MIXI ENGINEERS mixi_engineers
PRO
2
770
セキュリティ研修【MIXI 26新卒技術研修】
Avatar for MIXI ENGINEERS mixi_engineers
PRO
24
20k
人手不足への挑戦:車両保全を支えるIoTとクラウド内製化の道【SORACOM Discovery 2026】
Avatar for SORACOM（ソラコム） soracom
PRO
0
130
オートマトンと字句解析でRoslynを読む
Avatar for tomokusaba tomokusaba
0
110
StepFunctionsとGraphRAGを活用した暗黙知活用のためのRAG基盤
Avatar for やくも yakumo
0
180

Featured

See All Featured
Claude Code のすすめ
Avatar for schroneko schroneko
67
230k
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
413
23k
Building AI with AI
Avatar for Ines Montani inesmontani
PRO
1
1.1k
Leo the Paperboy
Avatar for Maya Tellez mayatellez
8
1.9k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
Avatar for Vitaly Friedman smashingmag
254
22k
Between Models and Reality
Avatar for mayunak mayunak
4
380
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
57
14k
Skip the Path - Find Your Career Trail
Avatar for Mark Kilby mkilby
1
170
Designing Experiences People Love
Avatar for Jonathan Moore moore
143
24k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1370
210k
Agile Leadership in an Agile Organization
Avatar for Dr. Kim W Petersen kimpetersen
PRO
0
190
職位にかかわらず全員がリーダーシップを発揮するチーム作り / Building a team where everyone can demonstrate leadership regardless of position
Avatar for MADOX madoxten
64
56k

Transcript

  1. Veronica Schmitt

  2. whoami Veronica Schmitt P01z0n_P1x13 Slides Published online: • https://medium.com/ •

    @P01z0n_P1x13 • [email protected] • www.dfirlabs.com
  3. None

  4. What does it monitor? 1 3 5 2 4

  5. • • • • • • •

  6. NOT AVAILABLE

  7. None
  8. None
  9. None

  10. SRUM Energy Usage (Long Term)

  11. None
  12. None
  13. None
  14. None

  15. • Timestamps are in UTC in OLE format (64 bits)

    and FILETIME format (64 bits) • Network interfaces are specified as InterfaceLuid (NET_LUID)
  16. None
  17. None

  18. Prefetch file records start time of process, not duration

  19. • Prefetch only retains last 8 start times, no record

    of prior runs • SRUM can tell you if an app was run or not
  20. None

  21. Downloads to Ares and Utorrent and he was running OpenVPN

  22. Application Resource Manager

  23. None
  24. None

  25. Energy Usage

  26. Well, what did we find...

  27. • Utorrent and Ares downloading. • Network connected to and

    total downloads. • TOR being used • Veracrypt • Ccleaner being run. • OpenVPN being used • Skype Activity • Viber Chat Activity

  28. Using srum-dump-master https://github.com/MarkBaggett/srum-dump LET'S DO THIS

  29. None