https://www.rdpcacheparser.com/en/blog Latest from Blog en Tue, 29 Sep 2026 16:31:05 GMT https://www.rdpcacheparser.com/en/blog/analyze-rdp-bitmap-cache-in-browser https://www.rdpcacheparser.com/en/blog/analyze-rdp-bitmap-cache-in-browser Step-by-step: load bcache*.bmc and Cache*.bin files into a free in-browser parser, triage tiles, build a collage, rebuild a screen and export the evidence. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT https://www.rdpcacheparser.com/en/blog/rdp-lateral-movement-source-host-artifacts https://www.rdpcacheparser.com/en/blog/rdp-lateral-movement-source-host-artifacts Which artifacts on the RDP source host show where a user connected and when, and how to use them to date and attribute what the bitmap cache shows. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.rdpcacheparser.com/en/blog/reconstruct-rdp-screens-from-cache-tiles https://www.rdpcacheparser.com/en/blog/reconstruct-rdp-screens-from-cache-tiles Why an RDP cache collage lines up in places and drifts in others, how to pick the collage width, and how to rebuild a screen tile by tile on a canvas. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT https://www.rdpcacheparser.com/en/blog/rdp-cache-parsers-compared https://www.rdpcacheparser.com/en/blog/rdp-cache-parsers-compared bmc-tools, RdpCacheStitcher and RDP Bitmap Cache Parser side by side: what each does, where each fits in a case, and the honest limits of the browser tool. Florian Amette Sun, 20 Sep 2026 00:00:00 GMT https://www.rdpcacheparser.com/en/blog/bmc-bin-rdp-cache-file-format https://www.rdpcacheparser.com/en/blog/bmc-bin-rdp-cache-file-format Byte-level layout of the RDP bitmap cache: bcache*.bmc slots and 20-byte headers, interleaved RLE, pixel depths, slot remnants, and the RDP8bmp Cache*.bin format. Florian Amette Fri, 18 Sep 2026 00:00:00 GMT https://www.rdpcacheparser.com/en/blog/rdp-bitmap-cache-location-acquisition https://www.rdpcacheparser.com/en/blog/rdp-bitmap-cache-location-acquisition Where the RDP bitmap cache is stored for each user, and how to collect it with PowerShell, KAPE RDPCache, Velociraptor or from a disk image, without the usual gotchas. Florian Amette Wed, 16 Sep 2026 00:00:00 GMT https://www.rdpcacheparser.com/en/blog/rdp-bitmap-cache-forensics-guide https://www.rdpcacheparser.com/en/blog/rdp-bitmap-cache-forensics-guide What the RDP bitmap cache is, where it lives, what its tiles can show about a remote session, how to date it, and how to parse bcache*.bmc and Cache*.bin files. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT