DFIRHub

WindowsTelemetryDiagnosticsLegacy

Legacy Windows Telemetry and Diagnostics files (*.rbs)

  • Windows
  • 2 paths
  • events*.rbs
  • Version 1
  • Andrew Rathbun and Josh Mitchell

Paths on disk

2 paths

Notes

These .rbs files should simply be opened in a text editor as they are effectively JSON files. These are very similar, if not, identical, to the JSON payloads included in EventTranscript.db

These files were present in Windows 10 between versions 1507 and 1809. 1709 is when EventTranscript.db came into play.

This Target should grab the following files:

events00.rbs

events01.rbs

events10.rbs

events11.rbs

Events_Normal.rbs

Events_NormalCritical.rbs

Events_CostDeferred.rbs

Events_Realtime.rbs

References

2 links