What Is the SRU Database: Windows' Secret Activity Log

Where it lives and what it writes down

The System Resource Usage Monitor writes everything into SRUDB.dat — an Extensible Storage Engine database, the same Jet-family engine that powers Exchange and Active Directory. For every process, Windows records slices of CPU time, bytes read and written, network traffic per interface and session timestamps, grouped into hourly and daily buckets. The folder C:\Windows\System32\SRU is locked down to SYSTEM and Administrators, so ordinary apps and browser tabs can't peek inside. History rolls on for roughly a month, sometimes longer depending on build and workload. Nothing about this is exotic: it's the data source for screens most people open every week.

Task Manager's "App history" tab, the "Data usage" page in Settings and the per-app battery usage report all read from this one database. That's the honest framing: an accounting system first, a privacy question second. Windows needs usage stats to tell you what drained your battery — SRU is simply where they live.

• SRUDB.dat in C:\Windows\System32\SRU — an ESE database, readable only with admin rights
• CPU time per application, in hourly and daily slices
• Disk bytes read and written by each program
• Network traffic per app and per network interface
• App session events with timestamps, including apps later uninstalled
• Roughly a month of rolling history on a typical build

Who reads it — including people you didn't invite

For forensic examiners SRU is a gift: given a disk image, they reconstruct which programs ran, when and how intensively for the last several weeks. "It stays local" is true but incomplete — local files are exactly what a thief, a curious technician or anyone with five minutes and a live USB is after. Malware needs admin rights to read it, which competent malware frequently has.

What deleting it actually buys you

You can clear the SRU folder — simplest from the recovery environment, because the files are locked while Windows runs — and Windows will calmly rebuild the database from scratch. The reward is reset statistics: App history and Data usage start from zero, and nothing else changes. Collection isn't stopped, the PC isn't faster, and the dozens of other activity artifacts Windows keeps remain untouched. If you're selling the machine, only a wipe with a clean install is an honest answer, not database surgery. For the machine you keep, full-disk encryption such as BitLocker is the real protection — it makes the entire disk unreadable offline, SRU included.

Questions and Answers

Read next