RDP Bitmap Cache
| Format | RDP Bitmap Cache |
|---|---|
| Short name | RDP cache |
| Category | media |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Persistent bitmap cache of the Windows Remote Desktop client, stored in the user profile (Terminal Server Client cache folder) as bcache*.bmc (older clients) or Cache????.bin files ('RDP8bmp' header, RDP 8 and later). The files contain small bitmap tiles (typically 64×64 pixels) of the remote screen; reassembled, they can show fragments of what a user saw during RDP sessions, such as windows, file names or typed text, on the connecting system.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 52 44 50 38 62 6D 70 00 | RDP8bmp. | Header 'RDP8bmp' of Cache????.bin files (bcache*.bmc files have no signature) |
Known extensions
.bmc
References
- bmc-tools — RDP Bitmap Cache parser (ANSSI) https://github.com/ANSSI-FR/bmc-tools
Cite this entry
Crush Format Reference, “RDP Bitmap Cache”. https://kalink0.github.io/crush-forensics/formats/rdp-cache/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction