Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

RDP Cached Bitmap Extractor

This script parses RDP cache files selected by the user.

The RDP caching mechanism reduces the amount of data that needs to be sent to an RDP client. It does this by caching those parts of the screen that haven't changed since the display was last refreshed.

The script supports two types of cache file: those that have a *.bmc file-extension and those that have a name of the form Cachennnn.bin where nnnn is a 4-digit number. Both types of file are to be found in the following folder -

%localappdata%\Microsoft\Terminal Server Client\Cache

Cache-files store raw bitmaps in the form of tiles. The size of each tile can vary, but a common size is 64 x 64 pixels.

The colour-depth of tiles in a *.bmc file is typically 16 or 32-bits per pixel (bpp). Tiles in a Cachennnn.bin file have a colour depth of 32-bpp.

Notwithstanding the fact that cached tiles are quite small, recognizable content will usually be visible including pictures, file and folder names, icons and desktop wallpaper.

The script provides the option of creating a composite bitmap from two or more cached bitmaps having the same width, height and colour-depth, as read in sequence from a given cache file. This may allow the examiner to identify areas of the screen larger than a single tile.

When using this function, it's important to note that cached tiles representing a given screen-area may not be stored together. Even if they are, they're not guaranteed to be written from left to right, or from top to bottom. It is believed that the direction of the mouse-cursor is responsible for this in part at least.

Taking the direction issue into account, the script allows the examiner to control the direction in which cached tiles are written into each bitmap. Up to four options are available depending on the number of rows to be written (there is no point in writing a separate bitmap for each vertical direction if there is only a single row of tiles).

Interpreting RDP cached-bitmap tiles is not an exact science and the examiner should be aware of a high risk of misinterpretation. Taking this into account, he/she is advised to test the operation of the script against data cached during one of his/her own RDP sessions. That way the benefits/limitations of the script will be better understood.

Download Now



Version: 3.0.0
Tested with:
EnCase Forensic 8.05
Developer: Simon Key
Category: Artifact

3924 DOWNLOADS

YOU MAY ALSO LIKE

Artifact

WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key
9092 Downloads
App
Artifact

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key
745 Downloads
App
Artifact

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key
555 Downloads
App
Artifact

Windows Search Application Data Parser

This script parses data maintained by the Windows search function relating to recently-used applications and documents
By Simon Key
454 Downloads
App