Home > Products > Windows Passwords > Reset Windows Password > Screenshots > Remote Desktop > Remote Desktop image cache
Analyze Remote Desktop cached images
11.06.2024
OneNote password recovery v3.4
Support for Microsoft Office 365
17.04.2024
Reset Windows Password v14.2
Telegram data recovery, Photo Database and Media Player investigation tools, and some more
12.04.2024
Office password recovery tools
Resetting VBA passwords
01.03.2024
New blog post
Dumping the history of users' IP addresses in Windows

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Reset Windows Password: Remote Desktop cached images


Image caching of the Remote Desktop Protocol in Windows allows to improve the performance of remote connections by storing a copy of the remote desktop screen on the client device. This enables the RDP client to quickly redraw the screen without having to transfer each pixel over the network every time the remote screen updates.

When a remote session is established, the RDP client receives an initial full-screen update from the server and saves it in its cache in memory. It then receives subsequent updates from the remote desktop as delta updates, which describe the changes made to the screen since the last update. This technique drastically improves the responsiveness and speed of remote desktop connections, especially in cases where the network connection has limited bandwidth or high latency.

The contents of the memory cache is then saved to ".bmc" and ".bin" files in the following folder:
C:\Users\\AppData\Local\Microsoft\Terminal Server Client\Cache
The binary structure of the ".bmc" and ".bin" files is not publicly documented by Microsoft.

The bitmap cache files consist of tiles, usually 64 x 64 pixels, with each tile representing a portion of the remote screen. Some tiles of the cache are saved from memory to the ".bin" files, so they are available even after the remote session has ended.

To reconstruct the original image of the remote screen or at least a portion of it, you can use the drag-and-drop operations in the program to swap the tiles. However, it may need a bit of elbow grease.

 

Selecting Remote Desktop user

Remote Desktop image cache location

Select the user account to search for the remote desktop cached.


 

View Remote Desktop image cache

Remote Desktop image cache
 

Viewing and editing the RDP cache. Use the drag-and-drop to swap any two tiles. If you want to save the entire bitmap, a separate tile, or all tiles, select the appropriate item from the context menu.