+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: The Lounge (https://hackforums.net/forumdisplay.php?fid=25)
+---- Thread: Let me blow your mind real quick (/showthread.php?tid=6327553)
Let me blow your mind real quick - jeoc7IDoph - Jun 24, 2026
When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.
It’s called the RDP Bitmap Cache.
To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.
Even if the session is over and the remote server is destroyed... your laptop still holds the cache files.
Forensics teams use tools like BMCViewer to stitch those tiles back together.
They won't just see logs but the literal email, document, or picture you were looking at.
RE: Let me blow your mind real quick - Raijin - Jun 25, 2026
Wow that is frightening. Thanks for the tip.
RE: Let me blow your mind real quick - loadman - Jun 26, 2026
(Jun 24, 2026 02:17 PM)jeoc7IDoph Wrote: When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.
It’s called the RDP Bitmap Cache.
To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.
Even if the session is over and the remote server is destroyed... your laptop still holds the cache files.
Forensics teams use tools like BMCViewer to stitch those tiles back together.
They won't just see logs but the literal email, document, or picture you were looking at.
Not really. It’s not full screenshots, just small reusable tiles
Reconstruction is:
Incomplete
If cache is cleared or disabled → nothing useful remains
Disable bitmap caching:
RDP settings → Experience → uncheck Persistent bitmap caching
RE: Let me blow your mind real quick - Trillium - Jun 28, 2026
Good Day Guys,
@jeoc7IDoph
Thank you so much for supporting Security to keep HF a more secure place!
For all users which want to keep their Privacy you can find and delete these RDP BITMAP CACHE FILES if you move to follow Windows Folder Directory:
Windows 7 and later: C:\Users\<username>\AppData\Local\Microsoft\Terminal Server Client\Cache\
Pre-Windows 7: C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Terminal Server Client\Cache\
Best Regards
RE: Let me blow your mind real quick - Mastercarder - Jun 28, 2026
That's kinda true but not in the way you think.
RE: Let me blow your mind real quick - cookiez123 - Jun 28, 2026
Is there a way to disable or automatically clear the bitmap cache, or is it something you'd have to manually wipe each time?
RE: Let me blow your mind real quick - Trillium - Jun 29, 2026
(Jun 28, 2026 07:36 AM)cookiez123 Wrote: Is there a way to disable or automatically clear the bitmap cache, or is it something you'd have to manually wipe each time?
Good Day cookiez123, here is a Batch Script which clean that RDP BITMAP CACHE FOLDER:
Code
cd "%localappdata%\Microsoft\Terminal Server Client\Cache"
del /F /Q *.*The code is for Windows 7 and later versions of Windows including Windows 10 / 11! Save this code with Windows Notepad to "Anyname.bat" after you run that file the RDP BITMAP CACHE FOLDER is empty!
If you want run the created file automaticly then you can put this file into the Windows Startup Folder.
If you want complete disable that Windows store in the RDP BITMAP CACHE FOLDER the files then you can also do that via the registry:
1.) Open the Windows Registry with "regedit"
2.) Move to follow Windows Registry Entry:
Code
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default3.) Do Right Click - New - Create a new DWORD - 32 BIT Value with follow name "BitmapCachePersistEnable" and set the value to "0"
4.) After that it's disabled that Windows save files to the RDP BITMAP CACHE FOLDER.
The Coder 'Trillium' is not responsible for your use of this code - I provide you with the code in good faith!
If you should have any questions then you can let me know anytime!
RE: Let me blow your mind real quick - Jamika - Jun 29, 2026
That's new information to me; it's the first time I've heard that. Maybe I should start cleaning the device regularly.
RE: Let me blow your mind real quick - Trillium - Jul 5, 2026
(Jun 29, 2026 10:41 AM)Jamika Wrote: That's new information to me; it's the first time I've heard that. Maybe I should start cleaning the device regularly.
Yes that would be no bad idea also it would be not bad to try also programs which optimize your Windows System for example for delete temp space, checking registry etc.
RE: Let me blow your mind real quick - DAL-SHA - Jul 5, 2026
Interesting ! Thanks for the heads up sir ! ✌✌
RE: Let me blow your mind real quick - StemCell - Jul 5, 2026
Interesting read, thanks