ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: DT035
  • Created: 31st May 2024
  • Updated: 31st May 2024
  • Contributor: The ITM Team

RDP Bitmap Cache

Persistent bitmap caching within remote desktop protocol allows the client to cache images locally, which can be pieced together using tools to identify cached images taken from the RDP session.

This artifact is located in C:\Users\<user>\AppData\local\microsoft\Terminal Server Client\Cache.