Skip to content
RDPCacheparser

Series

Investigating with the RDP bitmap cache

3 posts in this series. Read them in order or jump to any one.

  1. How to Analyze the RDP Bitmap Cache in Your Browser

    Step-by-step: load bcache*.bmc and Cache*.bin files into a free in-browser parser, triage tiles, build a collage, rebuild a screen and export the evidence.

  2. Reconstructing RDP Screens from Bitmap Cache Tiles

    Why an RDP cache collage lines up in places and drifts in others, how to pick the collage width, and how to rebuild a screen tile by tile on a canvas.

  3. RDP Lateral Movement Forensics: Source Host Artifacts

    Which artifacts on the RDP source host show where a user connected and when, and how to use them to date and attribute what the bitmap cache shows.

All posts in this series

How to Analyze the RDP Bitmap Cache in Your Browser
Step-by-step: load bcache*.bmc and Cache*.bin files into a free in-browser parser, triage tiles, build a collage, rebuild a screen and export the evidence.
rdp-bitmap-cachetoolshow-todfir
Reconstructing RDP Screens from Bitmap Cache Tiles
Why an RDP cache collage lines up in places and drifts in others, how to pick the collage width, and how to rebuild a screen tile by tile on a canvas.
rdp-bitmap-cachereconstructioncollagedfir
RDP Lateral Movement Forensics: Source Host Artifacts
Which artifacts on the RDP source host show where a user connected and when, and how to use them to date and attribute what the bitmap cache shows.
lateral-movementrdp-bitmap-cacheevent-logsregistry