Upgrade to Pro — share decks privately, control downloads, hide ads and more …

SRUM Forensics

Avatar for Veronica Schmitt Veronica Schmitt
October 26, 2018
Technology
710
0

SRUM Forensics

Delving into the world of SRUM forensics.

Avatar for Veronica Schmitt

Veronica Schmitt

October 26, 2018

More Decks by Veronica Schmitt

See All by Veronica Schmitt
The Autopsy of the PHOENIX X36 Hemodialysis System
Avatar for Veronica Schmitt velandra666
2
1.1k

Other Decks in Technology

See All in Technology
本当の”仕事”を手放せる未来が見えた
Avatar for mu7889yoon / Yuta Nakamura mu7889yoon
0
210
AWS Blocks を触ってみた/first-tach-aws-blocks
Avatar for MURAKAMI Masahiko fossamagna
2
110
【FinOps】データドリブンな意思決定を目指して
Avatar for kaita z63d
3
580
Mastraエージェント、どのクラウドにデプロイする？
Avatar for みのるん minorun365
PRO
2
130
AWS Summit Japan 2026の振り返りと2027へ向けて / AWS Summit Japan 2026 Recap and Prospects for 2027
Avatar for 株式会社カミナシ kaminashi
1
170
WebGIS AI Agentの紹介
Avatar for _shimizu _shimizu
0
610
フルAIで個人開発して学んだあれこれ / yuruai vol.1
Avatar for Isao Shimizu isaoshimizu
0
170
グローバルチームと挑むプロダクト開発
Avatar for SansanTech sansantech
PRO
1
140
10x Speed With QA Agent Platform - How we scaled adoption from individual effort to organizational capability
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
110
知見・人・API・DB・予算 ─ ナイナイ尽くしだった人事データ整備 with dbt、5年間の学び
Avatar for ken ken6377
1
130
小さいから、全部わかる。— 常駐AI "xangi" のすすめ
Avatar for suguuuuuすぐー sugupoko
0
220
AIエージェントとPhysical AIが拓く製造業の変革（ハノーバーメッセリキャップ）
Avatar for AIxIoTビジネス共創ラボ iotcomjpadmin
0
200

Featured

See All Featured
Data-driven link building: lessons from a $708K investment (BrightonSEO talk)
Avatar for Szymon Słowik szymonslowik
1
1.1k
HTML-Aware ERB: The Path to Reactive Rendering @ RubyCon 2026, Rimini, Italy
Avatar for Marco Roth marcoroth
2
280
WCS-LA-2024
Avatar for Leonardo Collado-Torres lcolladotor
0
670
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
15k
Designing Powerful Visuals for Engaging Learning
Avatar for Mike Taylor tmiket
1
430
Public Speaking Without Barfing On Your Shoes - THAT 2023
Avatar for David Neal reverentgeek
1
450
Game over? The fight for quality and originality in the time of robots
Avatar for Wayne Barker wayneb77
1
210
End of SEO as We Know It (SMX Advanced Version)
Avatar for Michael King ipullrank
3
4.2k
The Mindset for Success: Future Career Progression
Avatar for Greg Gifford greggifford
PRO
0
370
The Illustrated Children's Guide to Kubernetes
Avatar for Chris Short chrisshort
51
52k
Docker and Python
Avatar for Tania Allard trallard
47
3.9k
Imperfection Machines: The Place of Print at Facebook
Avatar for Scott Boms scottboms
270
14k

Transcript

  1. Veronica Schmitt

  2. whoami Veronica Schmitt P01z0n_P1x13 Slides Published online: • https://medium.com/ •

    @P01z0n_P1x13 • [email protected] • www.dfirlabs.com
  3. None

  4. What does it monitor? 1 3 5 2 4

  5. • • • • • • •

  6. NOT AVAILABLE

  7. None
  8. None
  9. None

  10. SRUM Energy Usage (Long Term)

  11. None
  12. None
  13. None
  14. None

  15. • Timestamps are in UTC in OLE format (64 bits)

    and FILETIME format (64 bits) • Network interfaces are specified as InterfaceLuid (NET_LUID)
  16. None
  17. None

  18. Prefetch file records start time of process, not duration

  19. • Prefetch only retains last 8 start times, no record

    of prior runs • SRUM can tell you if an app was run or not
  20. None

  21. Downloads to Ares and Utorrent and he was running OpenVPN

  22. Application Resource Manager

  23. None
  24. None

  25. Energy Usage

  26. Well, what did we find...

  27. • Utorrent and Ares downloading. • Network connected to and

    total downloads. • TOR being used • Veracrypt • Ccleaner being run. • OpenVPN being used • Skype Activity • Viber Chat Activity

  28. Using srum-dump-master https://github.com/MarkBaggett/srum-dump LET'S DO THIS

  29. None