CTF Support
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. CTF Support
  2. /
  3. Forensics
  4. /
  5. Logs & System Artifacts
  6. /
  7. RDP Bitmap Cache
Edit page

RDP Bitmap Cache

Introduction

When a user connects to another system using Remote Desktop Protocol (RDP), Windows caches small bitmap fragments of the remote desktop to speed up subsequent sessions. These fragments can reveal partial or complete images of the remote desktop.

Tools

Tool Purpose
BMC-Tools Extract and reconstruct bitmaps from RDP Bitmap Cache

Location 

C:\Users\<username>\AppData\Local\Microsoft\Terminal Server Client\Cache\

Common file patterns 

bcache*.bmc
cache0000.bin
cache0001.bin

Recover images using BMC-Tools 

./bmc-tools.py -s Cache -d Output