Forensic analysis of the Windows telemetry for diagnostics

by   Jaehyeok Han, et al.

Telemetry is the automated sensing and collection of data from a remote device. It is often used to provide better services for users. Microsoft uses telemetry to periodically collect information about Windows systems and to help improve user experience and fix potential issues. Windows telemetry service functions by creating RBS files on the local system to reliably transfer and manage the telemetry data, and these files can provide useful information in a digital forensic investigation. Combined with the information derived from traditional Windows forensics, investigators can have greater confidence in the evidence derived from various artifacts. It is possible to acquire information that can be confirmed only for live systems, such as the computer hardware serial number, the connection records for external storage devices, and traces of executed processes. This information is included in the RBS files that are created for use in Windows telemetry. In this paper, we introduced how to acquire RBS files telemetry and analyzed the data structure of these RBS files, which are able to determine the types of information that Windows OS have been collected. We also discussed the reliability and the novelty by comparing the conventional artifacts with the RBS files, which could be useful in digital forensic investigation.


page 1

page 2

page 3

page 4


Ubuntu One Investigation: Detecting Evidences on Client Machines

STorage as a Service (STaaS) cloud services has been adopted by both ind...

Towards a standardised strategy to collect and distribute application software artifacts

Reference sets contain known content that are used to identify relevant ...

Hierarchical Bloom Filter Trees for Approximate Matching

Bytewise approximate matching algorithms have in recent years shown sign...

An Inverse Approach to Windows' Resource-Based Permission Mechanism for Access Permission Vulnerability Detection

In organizations, employees work with information stored in files accord...

Technical Report: Selective Imaging of File System Data on Live Systems

In contrast to the common habit of taking full bitwise copies of storage...

Cloud Storage Forensic: hubiC as a Case-Study

In today society where we live in a world of constant connectivity, many...

A Revision Control System for Image Editing in Collaborative Multimedia Design

Revision control is a vital component in the collaborative development o...

Please sign up or login with your details

Forgot password? Click here to reset