This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots.
This very simple tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots.
On May 20th 2024 Microsoft announced its new Copilot+ PCs running on ARM architecture.
With this, they also announced Windows Copilot+ Recall which will be released on June 18th 2024.
Retrace your steps with Recall Search across time to find the content you need. Then, re-engage with it. With Recall, you have an explorable timeline of your PC’s past. Just describe how you remember it and Recall will retrieve the moment you saw it. Any photo, link, or message can be a fresh point to continue from. As you use your PC, Recall takes snapshots of your screen. Snapshots are taken every five seconds while content on the screen is different from the previous snapshot. Your snapshots are then locally stored and locally analyzed on your PC. Recall’s analysis allows you to search for content, including both images and text, using natural language. Trying to remember the name of the Korean restaurant your friend Alice mentioned? Just ask Recall and it retrieves both text and visual matches for your search, automatically sorted by how closely the results match your search. Recall can even take you back to the exact location of the item you saw.
To run or use this feature, you need to have one of the new Copilot+ PCs running on ARM. Some of them can be found here
Some smart folks released AmperageKit, which shows how you can either emulate such an ARM machine locally or spin one up on Azure. I opted for the latter.
Earlier this month, Microsoft’s CEO emailed all their staff saying “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security.”
So, do they? Not quite. Windows Recall stores everything locally in an unencrypted SQLite database, and the screenshots are simply saved in a folder on your PC. Here’s where you can find them:
C:\Users\$USER\AppData\Local\CoreAIPlatform.00\UKP\{GUID}
The images are all stored in the following subfolder
.\ImageStore\
The database, ukg.db
, is relatively straightforward in its structure, but it holds a wealth of information.
So what does the tool do?
TotalRecall copies the databases and screenshots and then parses the database for potentially interesting artifacts. You can define dates to limit the extraction as well as search for strings (that were extracted via Recall OCR) of interest. There is no rocket science behind all this. It's very basic SQLite parsing.
$ totalrecall.py -h
usage: totalrecall.py [-h] [--from_date FROM_DATE] [--to_date TO_DATE] [--search SEARCH]
Extract and display Windows Recall data.
options:
-h, --help show this help message and exit
--from_date FROM_DATE The start date in YYYY-MM-DD format.
--to_date TO_DATE The end date in YYYY-MM-DD format.
--search SEARCH Search term for text recognition data.
$ totalrecall.py --search password --from_date 2024-06-04 --to_date 2024-06-05
___________ __ .__ __________ .__ .__
\__ ___/____/ |______ | |\______ \ ____ ____ _____ | | | |
| | / _ \ __\__ \ | | | _// __ \_/ ___\\__ \ | | | |
| |( <_> ) | / __ \| |_| | \ ___/\ \___ / __ \| |_| |__
|____| \____/|__| (____ /____/____|_ /\___ >\___ >____ /____/____/
\/ \/ \/ \/
v0.3 / Alexander Hagenah / @xaitax / [email protected]
✅ Permissions modified for C:\Users\alex\AppData\Local\CoreAIPlatform.00\UKP and all its subdirectories and files
📁 Recall folder found: C:\Users\alex\AppData\Local\CoreAIPlatform.00\UKP\{D87DDB65-90BE-4399-BB1B-5BEB0B1D12CB}
🟢 Windows Recall feature found. Do you want to proceed with the extraction? (yes/no): yes
📂 Creating extraction folder: C:\Users\alex\Downloads\TotalRecall\2024-06-06-21-02_Recall_Extraction
🪟 Captured Windows: 166
📸 Images Taken: 46
🔍 Search results for 'password': 32
📄 Summary of the extraction is available in the file:
C:\Users\alex\Downloads\TotalRecall\2024-06-06-21-02_Recall_Extraction\TotalRecall.txt
📂 Full extraction folder path:
C:\Users\alex\Downloads\TotalRecall\2024-06-06-21-02_Recall_Extraction
Data Extraction:
ukg.db
database and the ImageStore
folder to a specified extraction folder. This ensures the original data remains intact while you explore the extracted data.Database Parsing:
Screenshot Management:
ImageStore
folder with a .jpg
extension if they don't already have one. This makes it easier to view and manage the screenshots.Search Functionality:
Output Generation:
Date Filtering:
Text Search:
Comprehensive Reports:
TotalRecall.txt
file for easy reference.TotalRecall provides a straightforward way to explore the data collected by Windows Recall. It's no rocket science whatsoever.
modify_permissions
function to ensure the script has the necessary permissions to access and manipulate files within the target directories, using the icacls
command. Thank you James Forshaw.Kevin Beaumont (@GossiTheDog) wrote a very good article about the Recall disaster as well with a spot-on FAQ - bare in mind all of this will likely change for the final release as we have learned yesterday.