RDP Bitmap Cache Cheat Sheet

What it is

To save bandwidth, the Remote Desktop client (mstsc.exe) caches small bitmap tiles of the remote screen on the client machine and reuses them instead of downloading them again. With persistent bitmap caching enabled (the default "Persistent bitmap caching" option of the client), those tiles are written to disk in the user's profile. Reassembled, they show pieces of what the user saw on the remote host: windows, command prompts, file names, tools.

Location

Windows version	Path	Files
XP	`C:\Documents and Settings\<user>\Local Settings\Application Data\Microsoft\Terminal Server Client\Cache\`	`bcache*.bmc`
Vista / 7	`C:\Users\<user>\AppData\Local\Microsoft\Terminal Server Client\Cache\`	`bcache*.bmc` and/or `Cache000N.bin` depending on client version
8 / 10 / 11	`C:\Users\<user>\AppData\Local\Microsoft\Terminal Server Client\Cache\`	`Cache0000.bin`, `Cache0001.bin`…

The cache is per user on the source of the RDP connection, not on the server.

What it proves

The user of this profile had RDP sessions with graphical content, and the tiles show what was displayed: remote desktops, open windows, typed commands, folder listings, dialog boxes.
Combined with the source-side RDP connection artifacts, it links a user to activity on a remote system.
It does not identify the remote host by itself, and tiles are not ordered by time; reconstruction is partial.

Key fields

Element	Meaning
Tile	Bitmap, typically up to 64 × 64 pixels
Cache file order	Tiles are stored in cache order; `bmc-tools` can also output a "collage" of all tiles
File name (`Cache000N.bin`)	Separate cache files, often one per recent connection or cache generation

Timestamps

Timestamp	Set when	Format	Pitfalls
Cache file $SI created / modified	Cache file created / last written by the client	NTFS, UTC	Approximates when sessions happened; no per-tile time
RDP client events (1024, 1102)	Connection attempts	UTC	Use them to date the sessions the tiles came from

Retention and clearing

The cache has a size limit; older tiles are overwritten as new sessions add content.
Disabling persistent bitmap caching (client option or bitmapcachepersistenable:i:0 in an .rdp file) prevents it; clearing the folder removes it.
Deleted cache files can sometimes be recovered from unallocated space or shadow copies.

Collection

KAPE target: RDPCache
Velociraptor (Windows.Triage.Targets): RDPCache; Windows.Forensics.RDPCache extracts tiles on live endpoints.
Built-in:

robocopy "C:\Users\bob\AppData\Local\Microsoft\Terminal Server Client\Cache" E:\case\rdpcache /COPY:DAT

Parsing tools

bmc-tools (ANSSI, open source): extracts tiles from .bmc and .bin files, with an option to produce a collage (bmc-tools.py -s <cache> -d <out> -b).
RdpCacheStitcher (BSI, open source): helps rebuild screens by placing tiles on a canvas.
Velociraptor: Windows.Forensics.RDPCache.

Investigation tips

Scan the collage first: command prompts, PowerShell windows, file explorers and remote tools are easy to spot even in fragments.
Text in tiles (server names, user names, IP addresses) helps identify the remote host when the client registry keys were cleared.
Correlate with the source-side registry keys and RDPClient events to decide which session each cache file belongs to.
An attacker's jump host often holds the richest cache: collect it early, before new sessions overwrite tiles.

RDP bitmap cache

Tools