Windows forensics Engine

PowerShell Script to facilitate the processing of SRUM data for on-the-fly forensics and if needed threat hunting

A new method to extract System Resource Utilization Management (SRUM) forensic artifacts.

SRUM forensics: prove whether a human was at the keyboard. Parse SRUDB.dat on Linux/macOS. Detect malware, exfiltration, and automated execution. Single static Rust binary.