Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

SRUM Forensics

Avatar for Veronica Schmitt Veronica Schmitt
October 26, 2018
Technology
750
0

SRUM Forensics

Delving into the world of SRUM forensics.

Avatar for Veronica Schmitt

Veronica Schmitt

October 26, 2018

More Decks by Veronica Schmitt

See All by Veronica Schmitt
The Autopsy of the PHOENIX X36 Hemodialysis System
Avatar for Veronica Schmitt velandra666
2
1.2k

Other Decks in Technology

See All in Technology
Making AI Agents Safe and Fast- Jev, Obsidian, and the Meta-Harness
Avatar for Daisuke Masuda x5gtrn
PRO
0
160
3人で1000GPU超を統合運用する？マルチクラウド＆オンプレを跨ぐ、構築と運用のリアル！
Avatar for kazuki odo kazukun0716
2
770
20260930_Gemma4_Hands-on
Avatar for tsho tsho
0
170
AI感のないAWS構成図をAIエージェントに描かせたい！
Avatar for さご sagochiko
2
480
覗いてみよう 関数型ビジュアル言語×2Dグラフィックスの世界
Avatar for Yohei Yamasaki yohyamasaki
0
150
Kiro Meetup #8 Kiro アップデート (2026/3/21〜2026/9/24)
Avatar for Katz Ueno katzueno
1
310
生成AIを使って「人が」考える技術 ― AI時代の人機共想と実践ノウハウ｜UNITT AC2026
Avatar for 石井力重 ishiirikie
0
450
DORA_Metrics.pdf
Avatar for Wagner Voltz - Fusca wagnerfusca
1
140
Lambda MicroVMsは常駐サーバーの代わりに なるか？ Kiro Crew を動かして検証してみた / Kiro Crew on Lambda MicroVMs
Avatar for Kazuki Adachi k_adachi_01
2
340
AI駆動開発で仕様はどこまで書くべきか？ ― 人とAIの責務境界から考える開発プロセスの実践
Avatar for matsui-dmm takahiromatsui
1
250
プラットフォームを「作る」、 チームに「入り込む」
Avatar for SansanTech sansantech
PRO
0
400
メルカリにおけるAI時代の高速プロトタイピング基盤「Arca」
Avatar for Ryota Arai ryotarai
18
13k

Featured

See All Featured
Music & Morning Musume
Avatar for Bryan Veloso bryan
48
7.4k
技術選定の審美眼（2025年版） / Understanding the Spiral of Technologies 2025 edition
Avatar for Takuto WADA twada
PRO
120
120k
CSS Pre-Processors: Stylus, Less & Sass
Avatar for Bermon Painter bermonpainter
360
31k
The Curious Case for Waylosing
Avatar for Cassini Nazir cassininazir
1
550
4 Signs Your Business is Dying
Avatar for Josh Pigford shpigford
187
23k
ラッコキーワード サービス紹介資料
Avatar for ラッコ株式会社 rakko
1
5.1M
Abbi's Birthday
Avatar for Violet Bock coloredviolet
4
10k
Self-Hosted WebAssembly Runtime for Runtime-Neutral Checkpoint/Restore in Edge–Cloud Continuum
Avatar for Yuki Nakata chikuwait chikuwait
0
850
Distributed Sagas: A Protocol for Coordinating Microservices
Avatar for Caitie McCaffrey caitiem20
333
23k
Code Review Best Practice
Avatar for Trisha Gee trishagee
74
20k
Design in an AI World
Avatar for tapps tapps
1
340
Utilizing Notion as your number one productivity tool
Avatar for Mfonobong Umondia mfonobong
4
600

Transcript

  1. Veronica Schmitt

  2. whoami Veronica Schmitt P01z0n_P1x13 Slides Published online: • https://medium.com/ •

    @P01z0n_P1x13 • [email protected] • www.dfirlabs.com
  3. None

  4. What does it monitor? 1 3 5 2 4

  5. • • • • • • •

  6. NOT AVAILABLE

  7. None
  8. None
  9. None

  10. SRUM Energy Usage (Long Term)

  11. None
  12. None
  13. None
  14. None

  15. • Timestamps are in UTC in OLE format (64 bits)

    and FILETIME format (64 bits) • Network interfaces are specified as InterfaceLuid (NET_LUID)
  16. None
  17. None

  18. Prefetch file records start time of process, not duration

  19. • Prefetch only retains last 8 start times, no record

    of prior runs • SRUM can tell you if an app was run or not
  20. None

  21. Downloads to Ares and Utorrent and he was running OpenVPN

  22. Application Resource Manager

  23. None
  24. None

  25. Energy Usage

  26. Well, what did we find...

  27. • Utorrent and Ares downloading. • Network connected to and

    total downloads. • TOR being used • Veracrypt • Ccleaner being run. • OpenVPN being used • Skype Activity • Viber Chat Activity

  28. Using srum-dump-master https://github.com/MarkBaggett/srum-dump LET'S DO THIS

  29. None