Commercial RDS often includes features beyond the visualisation of a remote user’s desktop, such as integrated voice communication, increased security and auditing, and access management. The controlling of a computer system without the need for physical access has a wide range of applications, including technical support and administering hard-to-reach devices. The results are returned and rendered for the controlling user.
Inputs, such as mouse and keyboard events, are sent via this connection and executed on the remote environment. Remote Desktop Software (RDS) allows users access to the desktop environment of a remote machine, usually via a network connection.
To illustrate the value of our findings we publish a Python module for Autopsy that automatically locates, processes and visualises key TeamViewer artefacts for an Investigator. We also highlight a potential privacy concern due to inadequate uninstallation processes. This paper shows that with suitable evidence, an Investigator can identify which machines have performed remote control or been controlled, transferred files and have been remotely rebooted, among other events. As a market-leading solution for Windows, TeamViewer is an impactful starting point to demonstrate that such software is forensically-valuable to explore. Despite its importance and prevalence, forensic research into RDS is minimal. RDS complicates a Forensic Investigation as any person with remote access privileges or knowledge of bypassing them could be responsible for an action. With an unprecedented shift to remote working due to the COVID-19 Pandemic, more people are working on home devices without enterprise IT support and therefore reliant upon this software to collaborate and keep their systems available and secure. Operations are sent to the remote machine and executed as if performed by a local user. Remote Desktop Software (RDS) enables the controlling of a computer system without the need for physical access.
0 kommentar(er)
