Series
RDP bitmap cache fundamentals
4 posts in this series. Read them in order or jump to any one.
- RDP Bitmap Cache Forensics: The Complete Guide
What the RDP bitmap cache is, where it lives, what its tiles can show about a remote session, how to date it, and how to parse bcache*.bmc and Cache*.bin files.
- RDP Bitmap Cache Location and How to Acquire It
Where the RDP bitmap cache is stored per user, and how to collect it with PowerShell, KAPE RDPCache, Velociraptor or a disk image, without the usual gotchas.
- bcache24.bmc and Cache0000.bin: RDP Cache File Format
Byte-level layout of the RDP bitmap cache: bcache*.bmc slots, 20-byte headers, interleaved RLE, pixel depths, slot remnants and the RDP8bmp Cache*.bin format.
- RDP Cache Parsers Compared: bmc-tools and Alternatives
bmc-tools, RdpCacheStitcher and RDP Bitmap Cache Parser side by side: what each does, where each fits in a case, and the honest limits of the browser tool.