SANS How To’s: SRUM-DUMP (System Resource Utilization Monitor) Tool

In this video Mark Baggett will show you how you can use a tool named SRUM-DUMP to capture critical DFIR (Digital Forensics and Incident Response) data like the dates and times processes were executed, which networks they used, how much data was transmitted and received, the Security Identifier of the user that launched the process and more. Then Mark will show you a tip that developers of forensics tools can use to convert binary flags into their associated text descriptions.