dissect.target.plugins.os.windows.sru

Module Contents

Classes

SRUPlugin

Return all available SRUM data stored in the SRUDB.dat.

Functions

transform_app_id

Attributes

NetworkDataRecord
NetworkConnectivityRecord
EnergyEstimatorRecord
EnergyUsageRecord
EnergyUsageLTRecord
ApplicationRecord
PushNotificationRecord
ApplicationTimelineRecord
VfuRecord
SdpVolumeProviderRecord
SdpPhysicalDiskProviderRecord
SdpCpuProviderRecord
SdpNetworkProviderRecord
FIELD_MAPPINGS
TRANSFORMS

dissect.target.plugins.os.windows.sru.NetworkDataRecord

dissect.target.plugins.os.windows.sru.NetworkConnectivityRecord

dissect.target.plugins.os.windows.sru.EnergyEstimatorRecord

dissect.target.plugins.os.windows.sru.EnergyUsageRecord

dissect.target.plugins.os.windows.sru.EnergyUsageLTRecord

dissect.target.plugins.os.windows.sru.ApplicationRecord

dissect.target.plugins.os.windows.sru.PushNotificationRecord

dissect.target.plugins.os.windows.sru.ApplicationTimelineRecord

dissect.target.plugins.os.windows.sru.VfuRecord

dissect.target.plugins.os.windows.sru.SdpVolumeProviderRecord

dissect.target.plugins.os.windows.sru.SdpPhysicalDiskProviderRecord

dissect.target.plugins.os.windows.sru.SdpCpuProviderRecord

dissect.target.plugins.os.windows.sru.SdpNetworkProviderRecord

dissect.target.plugins.os.windows.sru.FIELD_MAPPINGS

dissect.target.plugins.os.windows.sru.transform_app_id(value)

dissect.target.plugins.os.windows.sru.TRANSFORMS

class dissect.target.plugins.os.windows.sru.SRUPlugin(target)

Bases: dissect.target.plugin.Plugin

Return all available SRUM data stored in the SRUDB.dat.

The System Resource Usage Monitor (SRUM) stores its information in a SRUDB.dat file. As the names suggests, it contains data about resource usage, such as network and memory usage by applications.

References

• https://docs.microsoft.com/en-us/sql/relational-databases/performance-monitor/monitor-resource-usage-system-monitor?view=sql-server-ver15

• https://blog.1234n6.com/2019/01/

__namespace__ = 'sru'

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

read_records(table_name, record_type)

network_data()

Return the contents of Windows Network Data Usage Monitor table from the SRUDB.dat file.

Gives insight into the network usage of the system.

network_connectivity()

Return the contents of Windows Network Connectivity Usage Monitor table from the SRUDB.dat file.

Gives insight into the network connectivity usage of the system.

energy_estimator()

Return the contents of Energy Estimator table from the SRUDB.dat file.

energy_usage()

Return the contents of Energy Usage Provider table from the SRUDB.dat file.

Gives insight into the energy usage of the system.

energy_usage_lt()

Return the contents of Energy Usage Provider Long Term table from the SRUDB.dat file.

Gives insight into the energy usage of the system looking over the long term.

application()

Return the contents of Application Resource Usage table from the SRUDB.dat file.

Gives insights into the resource usage of applications on the system.

push_notification()

Return the contents of Windows Push Notification Data table from the SRUDB.dat file.

Gives insight into the notification usage of the system.

application_timeline()

Return the contents of App Timeline Provider table from the SRUDB.dat file.

vfu()

Return the contents of vfuprov table from the SRUDB.dat file.

sdp_volume_provider()

Return the contents of SDP Volume Provider table from the SRUDB.dat file.

sdp_physical_disk_provider()

Return the contents of SDP Physical Disk Provider table from the SRUDB.dat file.

sdp_cpu_provider()

Return the contents of SDP CPU Provider table from the SRUDB.dat file.

sdp_network_provider()

Return the contents of SDP Network Provider table from the SRUDB.dat file.