“TotalRecall Reloaded” tool finds a side entrance to Windows 11’s Recall database

Microsoft's introduction of Copilot+ PCs two years ago promised innovative features leveraging the capabilities of neural processing units (NPUs) in modern laptops. These NPUs were intended to enhance privacy and security by enabling certain AI functionalities to operate locally instead of relying on cloud services. A key feature of this initiative was Recall, designed to monitor and capture screenshots of users' PC activities to aid memory recall. However, the initial implementation of Recall raised significant privacy concerns. It stored user activity and screenshots in unencrypted files, leaving sensitive data exposed to anyone with access to the device, whether local or remote. Following scrutiny from journalists and security experts who highlighted these vulnerabilities, Microsoft postponed the Recall feature's launch for nearly a year to address these security issues. The revamped Recall now includes encryption for all locally stored data, requiring Windows Hello authentication for access. It also improved its ability to identify and exclude sensitive information, such as financial data, from its records. Additionally, the feature is set to be disabled by default on compatible PCs. Despite these enhancements, security researcher Alexander Hagenah, who originally developed the “TotalRecall” tool, has released an updated version called “TotalRecall Reloaded.” This new tool aims to identify further vulnerabilities within Recall, signaling that while improvements have been made, the feature still poses potential risks to user security and privacy.