Telemetry data is stored in: "%ProgramData%\Microsoft\Diagnosis\Events_*.rbs" The paper describes the format of these files, and what data can be obtained from

Telemetry data is stored in: "%ProgramData%\Microsoft\Diagnosis\Events_*.rbs" The paper describes the format of these files, and what data can be obtained from them, including a comparison with other sources of similar information. Recorded data includes: (1) Windows version, registration details, installed and uninstalled programs; (2) hardware devices with serial numbers; (3) process execution data (at Enhanced or Full levels only, data might not include processes that only ran briefly); (4) partition table and boot timestamps (when the system was powered on and off). In the analyzed examples the data was available for roughly the past three months.