±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35868
New Yesterday: 3 Visitors: 138

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Remote Desktop Cache Files

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

minime2k9
Senior Member
 

Remote Desktop Cache Files

Post Posted: Oct 30, 17 11:08

I've got a case where remote desktop has been used.
I've located some cachexxxx.bin files in the "Terminal Server Client\Cache folder and the bcache24.bmc files are empty.

I'm trying to extract the images from the cachexxx.bin files. I've tried using the BMC phython script and Bitmapcacheviewer, but as the BMC files are empty I get nothing back.

Has anyone had any luck with just the cache files?  
 
  

hommy0
Senior Member
 

Re: Remote Desktop Cache Files

Post Posted: Oct 30, 17 12:54

I'm not sure if this will help, available from the Guidance Software website. It mentions that it can be used to extract images from the files with *.bmc and *.bin extension.

www.guidancesoftware.c...-Extractor

Regards  
 
  

minime2k9
Senior Member
 

Re: Remote Desktop Cache Files

Post Posted: Oct 30, 17 13:45

Thanks, I'll try that.
Just need to find my Encase dongle....  
 
  

minime2k9
Senior Member
 

Re: Remote Desktop Cache Files

Post Posted: Oct 30, 17 14:02

Yeah that seemed to work, thanks!  
 

Page 1 of 1