Putting Together the RDPiece
Explore the intricacies of ransomware investigations and the often-overlooked RDP Bitmap Cache artifact in this 35-minute conference talk from OSDFCon 2020. Learn how to piece together crucial information about attacker activities, even after cleanup attempts, using the RDPiece tool. Gain insights into extracting and analyzing RDP Bitmap Cache data, understanding its significance in digital forensics, and leveraging PowerShell scripts for efficient investigation. Discover how this underutilized artifact can provide answers to key questions about system access, data exfiltration, and attacker behavior. Benefit from Brian Moran's extensive experience in digital forensics and incident response as he shares his expertise on this evolving field.