[jeoc7IDoph]

When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.
It’s called the RDP Bitmap Cache.
To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.
Even if the session is over and the remote server is destroyed... your laptop still holds the cache files.
Forensics teams use tools like BMCViewer to stitch those tiles back together.
They won't just see logs but the literal email, document, or picture you were looking at.

[Raijin]

Wow that is frightening. Thanks for the tip.

[loadman]

When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.
It’s called the RDP Bitmap Cache.
To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.
Even if the session is over and the remote server is destroyed... your laptop still holds the cache files.
Forensics teams use tools like BMCViewer to stitch those tiles back together.
They won't just see logs but the literal email, document, or picture you were looking at.

Not really. It’s not full screenshots, just small reusable tiles

Reconstruction is:

Incomplete

If cache is cleared or disabled → nothing useful remains

Disable bitmap caching:

RDP settings → Experience → uncheck Persistent bitmap caching

[Trillium]

Good Day Guys,

@jeoc7IDoph

Thank you so much for supporting Security to keep HF a more secure place!

For all users which want to keep their Privacy you can find and delete these RDP BITMAP CACHE FILES if you move to follow Windows Folder Directory:

Windows 7 and later: C:\Users\<username>\AppData\Local\Microsoft\Terminal Server Client\Cache\

Pre-Windows 7: C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Terminal Server Client\Cache\

Best Regards

[Mastercarder]

That's kinda true but not in the way you think.

[cookiez123]

Is there a way to disable or automatically clear the bitmap cache, or is it something you'd have to manually wipe each time?

[Trillium]

Is there a way to disable or automatically clear the bitmap cache, or is it something you'd have to manually wipe each time?

Good Day cookiez123, here is a Batch Script which clean that RDP BITMAP CACHE FOLDER:

Code

cd "%localappdata%\Microsoft\Terminal Server Client\Cache"
del /F /Q *.*

The code is for Windows 7 and later versions of Windows including Windows 10 / 11! Save this code with Windows Notepad to "Anyname.bat" after you run that file the RDP BITMAP CACHE FOLDER is empty!

If you want run the created file automaticly then you can put this file into the Windows Startup Folder.

If you want complete disable that Windows store in the RDP BITMAP CACHE FOLDER the files then you can also do that via the registry:

1.) Open the Windows Registry with "regedit"

2.) Move to follow Windows Registry Entry:

Code

HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default

3.) Do Right Click - New - Create a new DWORD - 32 BIT Value with follow name "BitmapCachePersistEnable" and set the value to "0"

4.) After that it's disabled that Windows save files to the RDP BITMAP CACHE FOLDER.

The Coder 'Trillium' is not responsible for your use of this code - I provide you with the code in good faith!

If you should have any questions then you can let me know anytime!

[Jamika]

That's new information to me; it's the first time I've heard that. Maybe I should start cleaning the device regularly.

[Trillium]

That's new information to me; it's the first time I've heard that. Maybe I should start cleaning the device regularly.

Yes that would be no bad idea also it would be not bad to try also programs which optimize your Windows System for example for delete temp space, checking registry etc.

[DAL-SHA]

Interesting ! Thanks for the heads up sir ! ✌✌

[StemCell]

Interesting read, thanks