How to Clean SRUM on Windows?

SRUM, the System Resource Usage Monitor, is a Windows feature that logs how much CPU, network and energy each program consumes, hour by hour. It exists mainly for battery reporting and network data-usage tracking, but as a side effect it becomes a detailed diary of everything that ran on your PC, whether launched from the Start Menu, a script, or a background service.

Collection is driven by the Diagnostic Policy Service (DPS), which periodically queries running and recently-run processes and writes the results to a database. Because it works independently of Explorer, SRUM can catch programs that other traces (like UserAssist) miss entirely, and the data can persist for several weeks. It is stored as an ESE database (the same engine used by Windows Search) at C:\Windows\System32\sru\SRUDB.dat, with the categories of data it tracks configured under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions.

Like Amcache, a SRUM record has no cosmetic part, every field is a measurement of what a program actually did. What makes it unusually thorough is the combination: not just that a program ran, but how much it used the network, the disk and the battery, hour by hour, for weeks. PrivaZer removes these records so that resource-usage diary no longer sits in the database.

SRUM doesn't just say a program existed, it says how it was used: how much network traffic it generated, how long it ran in the foreground, roughly how much battery it drew. Because collection is driven by the Diagnostic Policy Service rather than by Explorer, it isn't limited to programs you double-clicked, background processes and command-line tools show up too. That combination, presence plus a usage profile over time, is what makes SRUM valuable to forensic tools even when other execution traces have already been cleared.

Yes. PrivaZer detects and clears the SRUM database as part of a scan, and can target it on its own.

SRUDB.dat is normally kept open by the Diagnostic Policy Service while Windows runs. PrivaZer releases that lock and securely deletes the files in C:\Windows\System32\sru, SRUDB.dat and any companion files alongside it, overwriting them before removal so the old records cannot be pulled back with undelete or data-recovery tools. This happens directly, in the same session, no restart is needed. Administrator rights are required.

Yes. Uninstalling a program and deleting its files does not remove its SRUM history. The hourly records of its CPU, network, disk and energy usage can stay in the database for weeks, showing not just that the program existed but how it was actually used, long after every trace of the program itself is gone. Cleaning SRUM is what removes that leftover record.

Yes. SRUM is a diagnostic cache that Windows maintains for battery and network reporting, and it rebuilds automatically. Clearing it does not affect your installed programs, your files or system stability. The Diagnostic Policy Service keeps running (or restarts) as normal, so troubleshooting features that rely on it are not permanently affected.

Yes, and that's expected: the Diagnostic Policy Service resumes its hourly rollups as soon as you use the PC again. Cleaning removes the historical trail up to that point, so what an examiner could recover is only what happened since. Run PrivaZer periodically to keep that trail short.

All four show that software existed or ran, but each catches a different slice. SRUM is the only one with an hourly resource-usage profile, CPU, network, disk and energy, and the only one that isn't tied to a GUI launch. UserAssist logs GUI launches with a run count and focus time. Amcache is a hive file with rich per-program metadata including a SHA-1 hash. Shimcache mainly logs paths and last-modified dates. Cleaning only one leaves the other three intact.

For the others, see: Amcache, Shimcache og UserAssist.