Author: Martin Brinkmann

When Microsoft announced the AI feature Recall in May, it felt confidence in its AI strategy. Recall, a feature that takes snapshots of the PC screen every five seconds, was designed to be the selling point for a new breed of PCs, that Microsoft calls Copilot+ PCs.

A lot depended on Recall. It was the first major AI feature that Microsoft designed exclusively for this new PC type.

The reveal and the days that followed turned out different. Recall was criticized left and right.

Core points were:

• Windows 11 activated Recall for users automatically and there was no opt-out option.
• The Recall database was not properly secured.

This would have made Recall one of the most lucrative target in computing history.

Tip: you can disable Recall in Windows 11 in several ways.

Microsoft announces changes to Recall

Today, Microsoft announced a series of changes to Recall that “improve privacy and security safeguards”.

• The setup experience is changed. Users need to make a decision now to activate Recall or keep it disabled.
• Windows Hello enrollment is required to enable Recall.
• Proof of presence is required before users may interact with Recall’s database.
• Additional security layers, including “just in time” decryption, is also enabled.

Closing words

Microsoft plans to ship the updated version of Recall on June 18th to Windows 11 Insider devices. By then, tinkerers will have another go at the feature to see if it is still possible to gain access to the database.

For a company that announced its new “security first” motto shortly before the reveal of Recall, feedback has been disastrous.

To end on a personal note. I still cannot find a use case for Recall. I do not see how it could help me improve my productivity on Windows PCs. Then again, I’m probably not the target audience for the feature.

What about you? Would you use the safer version of Recall?

TotalRecall is a new open source tool for Windows that can be used to run searches across the entire Recall database.

Recall is a new feature of Windows 11 that takes snapshots of the screen every five seconds. It stores them locally and makes them available for processing by the user.

Recall is enabled by default on supported systems. Users may disable Recall, but only after the initial setup. While that may change before public release, and Microsoft would do good to make the change, it is on by default right now.

The feature is officially available only for a batch of ARM64 devices at the time of writing, but it will expand to Intel and AMD hardware soon as well. Plus, there are tools available already to make it work on older ARM devices that do not have a NPU chip.

The data is protected, but unlocked once the user logs in. It is then accessible by the user, but also by System or Admin accounts. In other words, any process that runs as System or Admin may be used to access the data.

It does not take an Einstein to connect the dots here to spot the elephant in the room: malware and spyware will target Recall data. It reveals any activity of the user, with the exception of activity in certain private browsing windows.

Forget tracking, you get a clear picture of a user’s likes, dislikes, webpages, apps, games, documents, financial transactions, online banking, private and public messages on forums and chats, and much more, when you gain access to that data.

TotalRecall

TotalRecall is a third-party tool that makes the data searchable via the command line. Run a search for password, and the tool runs a query to return any user activity associated with the term password.

It saves the search results to a text document on the system. This file provides details on the “captured windows, images, and search results”.

You can limit the search to a specific data range or run it across the entire data.

Here is what the tool does:

TotalRecall copies the databases and screenshots and then parses the database for potentially interesting artifacts. You can define dates to limit the extraction as well as search for strings (that were extracted via Recall OCR) of interest. There is no rocket science behind all this. It’s very basic SQLite parsing.

Closing Words

Microsoft, probably, did not expect to receive that much backlash for Recall. It is anyone’s guess whether Microsoft is going to make adjustments to Recall.

Windows 11 users who buy a laptop that is Recall capable, may want to strongly consider turning it off. While it may be a useful tool in very specific work scenarios, the chance of Recall turning into a nightmare for many Windows users is a real one.