A brief look at Windows telemetry: CIT aka Customer Interaction Tracker

This content was previously available at research.nccgroup.com/2022/04/12/a-brie...y-cit-aka-customer-interaction-tracker.

tl;dr

• Windows version up to at least version 7 contained a telemetry source called Customer Interaction Tracker

• The CIT database can be parsed to aid forensic investigation

• Finally, we also provide code to parse the CIT database yourself. We have implemented all of these findings into our investigation framework Dissect, which enables us to use them on all types of evidence data that we encounter

Introduction

About 2 years ago while I was working on a large compromise assessment, I had extra time available to do a little research. For a compromise assessment, we take a forensic snapshot of everything that is in scope. This includes various log or SIEM sources, but also includes a lot of host data. This host data can vary from full disk images, such as those from virtual machines, to smaller, forensically acquired, evidence packages. During this particular compromise assessment, we had host data from about 10,000 machines. An excellent opportunity for large scale data analysis, but also a huge set of data to test new parsers on, or find less common edge cases for existing parsers! During these assignments we generally also take some time to look for new and interesting pieces of data to analyse. We don’t often have access to such a large and varied dataset, so we take advantage of it while we can.