Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

SRUM Forensics

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Veronica Schmitt Veronica Schmitt
October 26, 2018
Technology
770
0

SRUM Forensics

Delving into the world of SRUM forensics.

Avatar for Veronica Schmitt

Veronica Schmitt

October 26, 2018

More Decks by Veronica Schmitt

See All by Veronica Schmitt
The Autopsy of the PHOENIX X36 Hemodialysis System
Avatar for Veronica Schmitt velandra666
2
1.2k

Other Decks in Technology

See All in Technology
ドメインエキスパートは いかにして AI を使って プロダクト開発をするか
Avatar for tshiraishi tatsuyashiraishi
1
250
キヨさん、67歳。AIコーディングエージェントに挑む
Avatar for コロッケそば happysamurai294
0
140
eBPF 簡介 2026 版
Avatar for shunghsiyu shunghsiyu
0
140
外国人エンジニアがVueプロトタイプで仕様を合わせている話 / Vue Fes Japan 2026 LT
Avatar for Wan Noh eluwing
0
370
バックオフィスに染み出すTypeScript ── clasp で安全に仕組みを作る
Avatar for Nealle nealle
1
160
攻撃 3 時間 vs 復旧 10 時間。アクセスキー流出の非対称性を体感するために CTF を作った話
Avatar for kazzpapa3 kazzpapa3
1
130
詳解 never 型 - ボトム型の性質を深掘り
Avatar for Nealle nealle
0
130
E2Eってつらくないですか？E2Eの管理コストを下げる手段とその実践
Avatar for Kosei Akaboshi (akaboshinit) akaboshinit
6
2.9k
AIがGISを代替する日：〜すべてをAIが創る時代に、私たちがFOSS4Gに関わる意味〜
Avatar for Yuji Kobayashi lehupa
0
190
構造で守らせる　データ・法務・セキュリティ・開発チームとつくる AI時代のデータガバナンスとデータ基盤のリアル
Avatar for LegalOn Technologies, Inc legalontechnologies
PRO
3
720
AIテスト自動化と評価駆動開発EDD
Avatar for コロッケそば happysamurai294
0
130
AI時代、つくる力を自分たちの手に。 ──電通×KAG、アジャイルとAI駆動開発で挑む開発の変革
Avatar for yuukiyo yuukiyo
3
450

Featured

See All Featured
How to Get Subject Matter Experts Bought In and Actively Contributing to SEO & PR Initiatives.
Avatar for Liv Day livdayseo
0
240
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
371
20k
brightonSEO & MeasureFest 2025 - Winning Strategies for Black Friday CRO & PPC - Christian Goodrich
Avatar for Christian Goodrich cargoodrich
3
890
Deep Space Network (abreviated)
Avatar for Tony Rice tonyrice
0
400
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
Avatar for panda_program panda_program
123
22k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
53
4k
Mozcon NYC 2025: Stop Losing SEO Traffic
Avatar for Sam Torres samtorres
1
590
KATA
Avatar for Megan Lloyd mclloyd
PRO
35
16k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
Avatar for Joe Casabona jcasabona
35
2.9k
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
85
9.7k
Learning to Love Humans: Emotional Interface Design
Avatar for Aarron Walter aarron
275
41k
A brief & incomplete history of 
UX Design for the World Wide Web: 1989–2019
Avatar for Jason CranfordTeague jct
2
550

Transcript

  1. Veronica Schmitt

  2. whoami Veronica Schmitt P01z0n_P1x13 Slides Published online: • https://medium.com/ •

    @P01z0n_P1x13 • [email protected] • www.dfirlabs.com
  3. None

  4. What does it monitor? 1 3 5 2 4

  5. • • • • • • •

  6. NOT AVAILABLE

  7. None
  8. None
  9. None

  10. SRUM Energy Usage (Long Term)

  11. None
  12. None
  13. None
  14. None

  15. • Timestamps are in UTC in OLE format (64 bits)

    and FILETIME format (64 bits) • Network interfaces are specified as InterfaceLuid (NET_LUID)
  16. None
  17. None

  18. Prefetch file records start time of process, not duration

  19. • Prefetch only retains last 8 start times, no record

    of prior runs • SRUM can tell you if an app was run or not
  20. None

  21. Downloads to Ares and Utorrent and he was running OpenVPN

  22. Application Resource Manager

  23. None
  24. None

  25. Energy Usage

  26. Well, what did we find...

  27. • Utorrent and Ares downloading. • Network connected to and

    total downloads. • TOR being used • Veracrypt • Ccleaner being run. • OpenVPN being used • Skype Activity • Viber Chat Activity

  28. Using srum-dump-master https://github.com/MarkBaggett/srum-dump LET'S DO THIS

  29. None