Join Us!

Remote Desktop Cach...
 
Notifications
Clear all

Remote Desktop Cache Files  

  RSS
minime2k9
(@minime2k9)
Active Member

I've got a case where remote desktop has been used.
I've located some cachexxxx.bin files in the "Terminal Server Client\Cache folder and the bcache24.bmc files are empty.

I'm trying to extract the images from the cachexxx.bin files. I've tried using the BMC phython script and Bitmapcacheviewer, but as the BMC files are empty I get nothing back.

Has anyone had any luck with just the cache files?

Quote
Posted : 30/10/2017 10:08 am
hommy0
(@hommy0)
Member

I'm not sure if this will help, available from the Guidance Software website. It mentions that it can be used to extract images from the files with *.bmc and *.bin extension.

https://www.guidancesoftware.com/app/RDP-Cached-Bitmap-Extractor

Regards

ReplyQuote
Posted : 30/10/2017 11:54 am
minime2k9
(@minime2k9)
Active Member

Thanks, I'll try that.
Just need to find my Encase dongleā€¦.

ReplyQuote
Posted : 30/10/2017 12:45 pm
minime2k9
(@minime2k9)
Active Member

Yeah that seemed to work, thanks!

ReplyQuote
Posted : 30/10/2017 1:02 pm
Share: