Skip to content
RDPCacheparser

Posts tagged: #velociraptor

← Back to all posts
RDP Bitmap Cache Location and How to Acquire It
Where the RDP bitmap cache is stored for each user, and how to collect it with PowerShell, KAPE RDPCache, Velociraptor or from a disk image, without the usual gotchas.
rdp-bitmap-cacheacquisitionkapevelociraptor