srum-long-term-energy-usages

Retrieves long-term energy usage history from a Windows SRUM (System Resource Usage Monitor) database file.

Command properties

Item	Description
Command type	Driver query
Required permission	Local file read permission
License usage	Counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

srum-long-term-energy-usages [zipcharset=STR] [zippath=STR] FILE_PATH

Options

zipcharset=STR: Character encoding for ZIP entry names (Default: utf-8)
zippath=STR: ZIP file path. If specified, the SRUDB.dat file inside the ZIP file is queried.

Target

FILE_PATH: Path to the SRUDB.dat file. Wildcards (*) can be used to specify multiple files. If zippath is specified, enter the path inside the ZIP file. On Windows, this file is located at C:\Windows\System32\sru\SRUDB.dat.

Output fields

Field	Type	Description
_time	timestamp	Record timestamp
_file	string	Source file name
app_id	integer	App ID (SruDbIdMapTable index)
app_name	string	App name
sid	string	SID of the account that ran the program
user_id	integer	Account ID (SruDbIdMapTable index)
auto_inc_id	integer	Auto-increment ID
active_ac_time	integer	Active time while connected to AC power (seconds)
active_dc_time	integer	Active time while on battery power (seconds)
active_discharge_time	integer	Battery discharge active time (seconds)
active_energy	integer	Energy usage in active state (mWh)
cs_ac_time	integer	Connected Standby time while connected to AC power (seconds)
cs_dc_time	integer	Connected Standby time while on battery power (seconds)
cs_discharge_time	integer	Battery discharge time during Connected Standby (seconds)
cs_energy	integer	Energy usage in Connected Standby state (mWh)
cycle_count	integer	Battery charge cycle count
designed_capacity	integer	Battery designed capacity (mWh)
full_charged_capacity	integer	Battery full charge capacity (mWh). Less than or equal to the designed capacity.
configuration_hash	long	System configuration hash value

Error codes

Parse errors

N/A

Runtime errors

N/A

Description

The srum-long-term-energy-usages command retrieves long-term energy usage history from the {FEE4E14F-02A9-4550-B5CE-5FA2DA202E37}LT table of the Windows SRUM database. This table is a long-term aggregated version of the short-term energy usage table queried by the srum-energy-usages command, and includes detailed power state energy usage information such as AC power connection time, battery power usage time, and Connected Standby time.

The command first reads the SruDbIdMapTable to map app IDs and user IDs to their actual names and SIDs. CamelCase column names in the ESE database are automatically converted to snake_case.

Examples

Retrieve long-term energy usage from SRUDB.dat
```
srum-long-term-energy-usages C:\Windows\System32\sru\SRUDB.dat
```
Retrieves all long-term energy usage records from the SRUM database.
Query SRUDB.dat inside a ZIP file
```
srum-long-term-energy-usages zippath=D:\evidence\sru.zip SRUDB.dat
```
Retrieves long-term energy usage history from the SRUDB.dat file contained in the ZIP file.
Analyze battery degradation
```
srum-long-term-energy-usages C:\Windows\System32\sru\SRUDB.dat
| fields _time, designed_capacity, full_charged_capacity, cycle_count
| sort _time
```
Retrieves changes in battery full charge capacity compared to the designed capacity and the cycle count in chronological order to analyze battery degradation trends.