Observed arrival · 2026-09-30
RDP Cache Parser turns bitmap scraps into remote-screen evidence
A browser-based DFIR tool decodes legacy RDP bitmap-cache files and lets investigators browse tiles, assemble collages, and reconstruct screens.
- For
- DFIR investigators examining Windows RDP connection artifacts
- Worth noticing
- It accepts whole folders and ZIP triage collections, including KAPE and Velociraptor exports, while preserving profile paths.
Field notes
Users can supply individual files, a folder, or a ZIP; the page names legacy bcache*.bmc and Cache0000.bin collections and accepts KAPE and Velociraptor triage output. Its acquisition guide walks through copying each Windows profile’s Terminal Server Client cache, with PowerShell commands and disk-image export instructions. The interface also offers a synthetic-cache sample described as a fictional intrusion, allowing a dry run without using case material.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue