GCIH · Question #810
What would a forensic analyst extract from the following registry key? HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SRUM\Extensions
The correct answer is A. Temporarily stored system activity data. The SRUM registry extension stores historical resource usage data collected by the System Resource Usage Monitor, making it a key forensic artifact for reconstructing past system activity.
Question
What would a forensic analyst extract from the following registry key? HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SRUM\Extensions
Options
- ATemporarily stored system activity data
- BFile associations for installed programs
- CRecently searched files and directories
- DSystem policies for web browser add-ons
How the community answered
(26 responses)- A88% (23)
- C8% (2)
- D4% (1)
Why each option
The SRUM registry extension stores historical resource usage data collected by the System Resource Usage Monitor, making it a key forensic artifact for reconstructing past system activity.
The SRUM (System Resource Usage Monitor) extensions stored under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions record per-application CPU, network, and memory usage over time. Forensic analysts extract this data to reconstruct what processes were running, how much network data they transferred, and when - even after the processes have terminated. It is a temporary rolling store, not a permanent application registry.
File associations are stored under HKCR (HKEY_CLASSES_ROOT) or HKLM\SOFTWARE\Classes, not in the SRUM extensions path.
Recently accessed files and search history are tracked in artifacts like the ShellBags, RecentDocs, or WordWheelQuery keys, not SRUM.
Browser add-on and extension policies are controlled via HKLM\SOFTWARE\Policies or browser-specific keys, not the SRUM path.
Concept tested: Windows SRUM forensic artifact analysis
Source: https://learn.microsoft.com/en-us/windows-hardware/test/wpt/system-resource-usage-monitor
Topics
Community Discussion
No community discussion yet for this question.