■■■■□ When you use Remote Desktop (RDP), Windows secretly takes screenshots of what you are doing.
It’s called the RDP Bitmap Cache.
To make the connection faster, Windows saves small tiles (images) of the remote screen to your hard drive in a bin file.
Even if the session is over and the remote server is destroyed… your laptop still holds the cache files.
Forensics teams use tools like BMCViewer to stitch those tiles back together.
They won’t just see logs but the literal email, document, or picture you were looking at.
𝕏 | IT Guy