Password Recovery Software

Reset Windows Password: Remote Desktop cached images

Image caching of the Remote Desktop Protocol in Windows allows to improve the performance of remote connections by storing a copy of the remote desktop screen on the client device. This enables the RDP client to quickly redraw the screen without having to transfer each pixel over the network every time the remote screen updates.

When a remote session is established, the RDP client receives an initial full-screen update from the server and saves it in its cache in memory. It then receives subsequent updates from the remote desktop as delta updates, which describe the changes made to the screen since the last update. This technique drastically improves the responsiveness and speed of remote desktop connections, especially in cases where the network connection has limited bandwidth or high latency.

The contents of the memory cache is then saved to ".bmc" and ".bin" files in the following folder:
C:\Users\\AppData\Local\Microsoft\Terminal Server Client\Cache
The binary structure of the ".bmc" and ".bin" files is not publicly documented by Microsoft.

The bitmap cache files consist of tiles, usually 64 x 64 pixels, with each tile representing a portion of the remote screen. Some tiles of the cache are saved from memory to the ".bin" files, so they are available even after the remote session has ended.

To reconstruct the original image of the remote screen or at least a portion of it, you can use the drag-and-drop operations in the program to swap the tiles. However, it may need a bit of elbow grease.

 

Selecting Remote Desktop user

View Remote Desktop image cache

Viewing and editing the RDP cache. Use the drag-and-drop to swap any two tiles. If you want to save the entire bitmap, a separate tile, or all tiles, select the appropriate item from the context menu.