Glossary
RDP bitmap cache
Files written by the Remote Desktop client that store small bitmaps of what the remote screen displayed, kept on the host the user connected from.
The RDP bitmap cache is the on-disk part of the Remote Desktop client's bitmap cache. To avoid downloading the same screen pieces twice, mstsc.exe keeps bitmaps it has received and, with persistent bitmap caching enabled, writes them to C:\Users\<user>\AppData\Local\Microsoft\Terminal Server Client\Cache\.
The files hold thousands of small tiles of the remote screen, without timestamps or screen positions. Because they sit on the source host, they can document what was done on a target that was later cleaned. See the RDP bitmap cache forensics guide.