Skip to content
RDPCacheparser

Posts tagged: #kape

← Back to all posts
RDP Bitmap Cache Location and How to Acquire It
Where the RDP bitmap cache is stored per user, and how to collect it with PowerShell, KAPE RDPCache, Velociraptor or a disk image, without the usual gotchas.
rdp-bitmap-cacheacquisitionkapevelociraptor