Windows Recall Is a Screenshot Database Attackers Would Love

Windows Recall silently captures your screen every few seconds into a local database. Here's the real threat model and how to audit it before it becomes an infostealer's jackpot.

Windows Recall is Microsoft's AI-powered "photographic memory" for the OS: it periodically screenshots your desktop, runs OCR over every frame, and indexes the extracted text into a local database so you can search your past activity in natural language. On the surface it is a productivity feature. From a security engineer's chair, it is a continuously-growing, plaintext-searchable archive of everything a user has looked at — banking portals, password managers mid-copy, private Slack threads, one-time codes, customer PII — sitting on the endpoint disk. If you run Windows fleets, Recall belongs on your threat model whether or not you enabled it on purpose.

Why this is a security problem, not a privacy footnote

The uncomfortable truth is that Recall lowers the value of every other control you have. You can enforce TLS everywhere, mask secrets in logs, and set aggressive session timeouts — and Recall will still have snapshotted the cleartext of that secret the moment it rendered on screen. It collapses ephemeral, in-memory data into durable, on-disk data.

Infostealer amplification. Commodity stealers (RedLine, Lumma, and their successors) already grab browser cookies and crypto wallets. A Recall index is a far richer target: a single database exfiltration can yield months of OCR'd credentials and internal documents.
Insider and post-compromise reach. Any process running as the user — or an attacker who has achieved that — can read the store. It turns a low-privilege foothold into a comprehensive intelligence haul without touching a single protected API.
Discovery risk. The screenshots and OCR text live under the user profile. If disk encryption is off or a backup leaks, so does the Recall archive.

How Recall actually stores data

Recall keeps its artifacts inside the user's profile, roughly under:

%LOCALAPPDATA%\CoreAIPlatform.00\UKP\{GUID}\
  ├─ ImageStore\        ← the raw screenshots (WebP)
  └─ ukg.db             ← SQLite index with OCR'd text

Microsoft has hardened this over time — the store is meant to be encrypted at rest and gated behind Windows Hello / VBS-backed enclaves, and Recall is opt-in on Copilot+ PCs. That is genuine progress. But "encrypted while the machine is locked" does nothing against malware running as the logged-in user, which is precisely the state most infostealers operate in. Defense-in-depth means you should not assume the enclave saves you.

What to audit on every endpoint

Treat Recall like any other data-at-rest surface. The questions you want answered per machine:

Is Recall enabled at all, and does that match policy?
Is the underlying disk encrypted (BitLocker) so the store isn't readable from an offline/stolen drive?
Is the OS build one that ships the current, hardened Recall — or an older, weaker implementation?
Does the Recall store exist and how large has it grown (i.e., how much history is exposed)?

Quick manual check

The two policy knobs live in the registry. On a managed fleet you should be enforcing these via GPO/Intune, but here's how to read the effective state:

# Disable Recall via policy (both hives cover per-machine + per-user)
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis
reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" /v DisableAIDataAnalysis

# Is the on-disk store present, and how big?
Get-ChildItem "$env:LOCALAPPDATA\CoreAIPlatform.00\UKP" -Recurse -ErrorAction SilentlyContinue |
  Measure-Object -Property Length -Sum

A value of 1 for DisableAIDataAnalysis means Recall data capture is off by policy. If the key is absent and the store directory is growing, the feature is live.

Hardening guidance

Decide deliberately. For most corporate endpoints — especially any that touch regulated data — disable Recall by policy rather than trusting per-user opt-in choices.
If you keep it, require the prerequisites: BitLocker on, Windows Hello enrolled, VBS/memory integrity enabled, and the latest OS build. Recall's protections assume all of those.
Filter sensitive apps. Recall can be told to exclude specific apps and private browsing; add your password manager, RDP clients, and finance apps to the exclusion list.
Watch the store as an exfil target. Any process reading ukg.db that isn't a Windows AI component is worth an alert.

Where WinSentinel fits

Manually running registry queries and directory scans across even a dozen machines is exactly the kind of drift-prone work that gets skipped. On a single machine, WinSentinel's free audit already inspects your encryption posture, VBS/memory integrity, and endpoint data-at-rest exposure across all 33 modules with no limits — so you can confirm Recall's prerequisites (BitLocker, memory integrity) are actually in place and flag whether the store exists locally.

For organizations, WinSentinel Pro turns that into fleet-wide answers: the central node rolls up which of your 50 or 500 endpoints have Recall enabled, which are missing the disk-encryption prerequisite, and alerts you when a machine drifts out of policy — a laptop where someone re-enabled Recall, or a new hire's device that shipped with it on. That's the difference between hoping a group policy stuck and knowing it did.

Recall isn't uniquely evil — it's just an unusually honest example of a broader pattern: convenience features that quietly turn transient data into durable, exfiltratable data. Audit it the way you'd audit any new store of secrets, because that's exactly what it is.

Bottom line

Don't panic-delete, and don't ignore. Put Recall on your inventory, decide its fate by policy instead of by default, verify the encryption and integrity prerequisites are real, and keep an eye on the store as an exfiltration target. A feature that remembers everything you've seen deserves the same scrutiny as the password vault sitting next to it.