Windows Recall (Copilot+ PC snapshots)

What it is

Recall is a Windows 11 feature for Copilot+ PCs (devices with a neural processing unit) that periodically captures snapshots of the screen, extracts text with on-device OCR and indexes it so the user can search "what they saw". From a forensic point of view it is a self-built screen recording with a searchable text index, which is why it drew heavy privacy criticism.

The feature changed substantially between its first preview and the released version, and still evolves. Read everything below as version-dependent:

• June 2024 preview: researchers showed the store was a plain SQLite database plus image files readable by any process running as the user. Microsoft pulled the release.
• Reworked release (Insider builds from late 2024, general availability on Copilot+ PCs in 2025): Recall is opt-in, can be removed as a Windows feature, requires Windows Hello to view, and Microsoft states snapshots and the index are encrypted with keys protected by a Virtualization-based Security (VBS) enclave.

Location

Verify the layout on the build you are examining; paths and file names may have changed in the encrypted release.

What it proves

• Proves (when readable) what was displayed on screen at capture time: the app, window title, visible text and, for browsers, often the URL.
• Can show content that exists nowhere else: messages in ephemeral chats, documents viewed in a browser, remote session screens.
• It does not prove the user read or interacted with what was on screen.
• Snapshot gaps prove nothing: Recall skips private browsing, filtered apps and sites, content flagged as sensitive, DRM-protected content, and pauses on user request.
• The absence of a store usually means Recall was never enabled, not that it was wiped.

Key fields

Preview-build ukg.db tables as described in public research (names and schema may differ in later builds):

Timestamps

Retention and clearing

• Storage is bounded by a user-configurable allocation and, in the released version, a maximum snapshot age; oldest snapshots are removed first.
• Users can delete a time range or everything from Recall settings, and disabling or removing the feature deletes the store.
• On managed commercial devices Recall is disabled by default and controlled by policy; record the policy values as part of your findings.

Collection

Treat Recall as volatile and user-gated: if it matters, plan collection on the live system in the user's session.

# Is Recall present and enabled?
Dism /Online /Get-FeatureInfo /FeatureName:Recall
reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"
# Copy the store (content may be encrypted)
robocopy "$env:LOCALAPPDATA\CoreAIPlatform.00" E:\case\recall /E /COPY:DAT /DCOPY:T

Document legal authority before collecting: Recall content is a screen history and can capture third-party and privileged material.

Parsing tools

• DB Browser for SQLite / sqlite3: query ukg.db from preview-era stores directly.
• TotalRecall (Alex Hagenah, open source): extracts and reports preview-era Recall stores; check its notes for support of the encrypted release.
• KAPE / Velociraptor: collect the folder with a custom target if your build of the target library lacks one.

Investigation tips

• First establish status: Copilot+ hardware, feature installed, opt-in done, policy state. Most enterprise endpoints will have no Recall data.
• For released builds, assume content is not readable from a dead-box image. Access, where lawful, typically requires the live, unlocked user session and Windows Hello.
• When readable, search the OCR text for keywords and pivot to the matching screenshot, then confirm with conventional artifacts (browser history, SRUM, Windows Timeline).
• Attackers with user-level access to a preview-era store could harvest passwords and messages from it; in intrusion cases on such systems, treat the store as potentially exfiltrated.