用于诊断的Windows遥测的取证分析
Forensic analysis of the Windows telemetry for diagnostics
摘要：
遥测是从远程设备自动感测和收集数据。它通常用于为用户提供更好的服务。Microsoft使用遥测技术定期收集有关Windows系统的信息，并帮助改善用户体验和修复潜在问题。Windows遥测服务通过在本地系统上创建RBS文件来可靠地传输和管理遥测数据，这些文件可以在数字取证调查中提供有用的信息。结合从传统Windows取证中获得的信息，调查人员可以对来自各种工件的证据有更大的信心。可以获取计算机硬件序列号、外部存储设备的连接记录、执行过程的跟踪等仅对实时系统可以确认的信息。此信息包含在为Windows遥测创建的RBS文件中。本文介绍了如何获取RBS文件遥测，并分析了这些RBS文件的数据结构，它能够确定Windows操作系统已收集的信息类型。我们还讨论了可靠性和新颖性，通过比较传统的文物与RBS文件，这可能是有用的数字取证调查。
英文摘要：
Telemetry is the automated sensing and collection of data from a remote device. It is often used to provide better services for users. Microsoft uses telemetry to periodically collect information about Windows systems and to help improve user experience and fix potential issues. Windows telemetry service functions by creating RBS files on the local system to reliably transfer and manage the telemetry data, and these files can provide useful information in a digital forensic investigation. Combined with the information derived from traditional Windows forensics, investigators can have greater confidence in the evidence derived from various artifacts. It is possible to acquire information that can be confirmed only for live systems, such as the computer hardware serial number, the connection records for external storage devices, and traces of executed processes. This information is included in the RBS files that are created for use in Windows telemetry. In this paper, we introduced how to acquire RBS files telemetry and analyzed the data structure of these RBS files, which are able to determine the types of information that Windows OS have been collected. We also discussed the reliability and the novelty by comparing the conventional artifacts with the RBS files, which could be useful in digital forensic investigation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
