Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
818
Views
Topic starter
09/03/2018 2:18 pm
Hi,
I was able to get 6k bitmaps from Cache0000.bin. Well this is nice, but can I somehow automatically group them? Otherwise it is a pain to reconstruct them.
Bitmaps were extracted by "RDP Bitmap Cache parser" from github.
Thanks
13/03/2018 9:33 am
Hi Chris,
I think Simon Key over at Guidance Software had written an EnScript to achieve a satisfactory result in minimal time.
I don't know if you're using EnCase or not but it's worth heading over to their customer forums and looking for it, or alternatively trying to get hold of Simon direct.
Cheers,