:py:mod:`dissect.target.plugins.os.windows.sru` =============================================== .. py:module:: dissect.target.plugins.os.windows.sru Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.target.plugins.os.windows.sru.SRUPlugin Functions ~~~~~~~~~ .. autoapisummary:: :nosignatures: dissect.target.plugins.os.windows.sru.transform_app_id Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.target.plugins.os.windows.sru.NetworkDataRecord dissect.target.plugins.os.windows.sru.NetworkConnectivityRecord dissect.target.plugins.os.windows.sru.EnergyEstimatorRecord dissect.target.plugins.os.windows.sru.EnergyUsageRecord dissect.target.plugins.os.windows.sru.EnergyUsageLTRecord dissect.target.plugins.os.windows.sru.ApplicationRecord dissect.target.plugins.os.windows.sru.PushNotificationRecord dissect.target.plugins.os.windows.sru.ApplicationTimelineRecord dissect.target.plugins.os.windows.sru.VfuRecord dissect.target.plugins.os.windows.sru.SdpVolumeProviderRecord dissect.target.plugins.os.windows.sru.SdpPhysicalDiskProviderRecord dissect.target.plugins.os.windows.sru.SdpCpuProviderRecord dissect.target.plugins.os.windows.sru.SdpNetworkProviderRecord dissect.target.plugins.os.windows.sru.SRURecord dissect.target.plugins.os.windows.sru.FIELD_MAPPINGS dissect.target.plugins.os.windows.sru.TRANSFORMS .. py:data:: NetworkDataRecord .. py:data:: NetworkConnectivityRecord .. py:data:: EnergyEstimatorRecord .. py:data:: EnergyUsageRecord .. py:data:: EnergyUsageLTRecord .. py:data:: ApplicationRecord .. py:data:: PushNotificationRecord .. py:data:: ApplicationTimelineRecord .. py:data:: VfuRecord .. py:data:: SdpVolumeProviderRecord .. py:data:: SdpPhysicalDiskProviderRecord .. py:data:: SdpCpuProviderRecord .. py:data:: SdpNetworkProviderRecord .. py:data:: SRURecord .. py:data:: FIELD_MAPPINGS .. py:function:: transform_app_id(value: Optional[Union[bytes, str]]) -> Optional[str] .. py:data:: TRANSFORMS .. py:class:: SRUPlugin(target) Bases: :py:obj:`dissect.target.plugin.Plugin` Return all available SRUM data stored in the SRUDB.dat. The System Resource Usage Monitor (SRUM) stores its information in a SRUDB.dat file. As the names suggests, it contains data about resource usage, such as network and memory usage by applications. .. rubric:: References - https://docs.microsoft.com/en-us/sql/relational-databases/performance-monitor/monitor-resource-usage-system-monitor?view=sql-server-ver15 - https://blog.1234n6.com/2019/01/ .. py:attribute:: __namespace__ :value: 'sru' .. py:method:: check_compatible() -> None Perform a compatibility check with the target. This function should return ``None`` if the plugin is compatible with the current target (``self.target``). For example, check if a certain file exists. Otherwise it should raise an ``UnsupportedPluginError``. :raises UnsupportedPluginError: If the plugin could not be loaded. .. py:method:: read_records(table_name: str, record_type: SRURecord) -> Iterator[SRURecord] .. py:method:: network_data() -> Iterator[NetworkDataRecord] Return the contents of Windows Network Data Usage Monitor table from the SRUDB.dat file. Gives insight into the network usage of the system. .. py:method:: network_connectivity() -> Iterator[NetworkConnectivityRecord] Return the contents of Windows Network Connectivity Usage Monitor table from the SRUDB.dat file. Gives insight into the network connectivity usage of the system. .. py:method:: energy_estimator() -> Iterator[EnergyEstimatorRecord] Return the contents of Energy Estimator table from the SRUDB.dat file. .. py:method:: energy_usage() -> Iterator[EnergyUsageRecord] Return the contents of Energy Usage Provider table from the SRUDB.dat file. Gives insight into the energy usage of the system. .. py:method:: energy_usage_lt() -> Iterator[EnergyUsageLTRecord] Return the contents of Energy Usage Provider Long Term table from the SRUDB.dat file. Gives insight into the energy usage of the system looking over the long term. .. py:method:: application() -> Iterator[ApplicationRecord] Return the contents of Application Resource Usage table from the SRUDB.dat file. Gives insights into the resource usage of applications on the system. .. py:method:: push_notification() -> Iterator[PushNotificationRecord] Return the contents of Windows Push Notification Data table from the SRUDB.dat file. Gives insight into the notification usage of the system. .. py:method:: application_timeline() -> Iterator[ApplicationTimelineRecord] Return the contents of App Timeline Provider table from the SRUDB.dat file. .. py:method:: vfu() -> Iterator[VfuRecord] Return the contents of vfuprov table from the SRUDB.dat file. .. py:method:: sdp_volume_provider() -> Iterator[SdpVolumeProviderRecord] Return the contents of SDP Volume Provider table from the SRUDB.dat file. .. py:method:: sdp_physical_disk_provider() -> Iterator[SdpPhysicalDiskProviderRecord] Return the contents of SDP Physical Disk Provider table from the SRUDB.dat file. .. py:method:: sdp_cpu_provider() -> Iterator[SdpCpuProviderRecord] Return the contents of SDP CPU Provider table from the SRUDB.dat file. .. py:method:: sdp_network_provider() -> Iterator[SdpNetworkProviderRecord] Return the contents of SDP Network Provider table from the SRUDB.dat file.