Series
RDP bitmap cache fundamentals
4 posts in this series. Read them in order or jump to any one.
- RDP Bitmap Cache Forensics: The Complete Guide
What the RDP bitmap cache is, where it lives, what its tiles can show about a remote session, how to date it, and how to parse bcache*.bmc and Cache*.bin files.
- RDP Bitmap Cache Location and How to Acquire It
Where the RDP bitmap cache is stored for each user, and how to collect it with PowerShell, KAPE RDPCache, Velociraptor or from a disk image, without the usual gotchas.
- bcache24.bmc and Cache0000.bin: RDP Cache File Format
Byte-level layout of the RDP bitmap cache: bcache*.bmc slots and 20-byte headers, interleaved RLE, pixel depths, slot remnants, and the RDP8bmp Cache*.bin format.
- RDP Cache Parsers Compared: bmc-tools and Alternatives
bmc-tools, RdpCacheStitcher and RDP Bitmap Cache Parser side by side: what each does, where each fits in a case, and the honest limits of the browser tool.