Remote Desktop Cache Files
I've got a case where remote desktop has been used.
I've located some cachexxxx.bin files in the "Terminal Server Client\Cache folder and the bcache24.bmc files are empty.
I'm trying to extract the images from the cachexxx.bin files. I've tried using the BMC phython script and Bitmapcacheviewer, but as the BMC files are empty I get nothing back.
Has anyone had any luck with just the cache files?
I'm not sure if this will help, available from the Guidance Software website. It mentions that it can be used to extract images from the files with *.bmc and *.bin extension.
Thanks, I'll try that.
Just need to find my Encase dongle….
Yeah that seemed to work, thanks!