This very simple tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots.
On May 20th 2024 [Microsoft announced its new Copilot+ PCs](https://blogs.microsoft.com/blog/2024/05/20/introducing-copilot-pcs/) running on ARM architecture.
To run or use this feature, you need to have one of the new Copilot+ PCs running on ARM. Some of them can be found [here](https://www.microsoft.com/en-us/windows/copilot-plus-pcs?r=1#shop)
### How can I play with it if it's not released yet?
Some smart folks released [AmperageKit](https://github.com/thebookisclosed/AmperageKit), which shows how you can either emulate such an ARM machine locally or spin one up on Azure. I opted for the latter.
## Technical Details
> Earlier this month, Microsoft’s CEO emailed all their staff saying
> “If you’re faced with the tradeoff between security and another
> priority, your answer is clear: **Do security**.”
So, do they? Not quite. Windows Recall stores everything locally in an unencrypted SQLite database, and the screenshots are simply saved in a folder on your PC. Here’s where you can find them:
TotalRecall copies the databases and screenshots and then parses the database for potentially interesting artifacts. You can define dates to limit the extraction as well as search for strings (that were extracted via Recall OCR) of interest. There is no rocket science behind all this. It's very basic SQLite parsing.
- TotalRecall copies the `ukg.db` database and the `ImageStore` folder to a specified extraction folder. This ensures the original data remains intact while you explore the extracted data.
2.**Database Parsing**:
- It parses the SQLite database to extract potentially interesting artifacts, such as window titles, timestamps, and image tokens. The tool looks for entries that match the criteria you specify (e.g., date range, search terms).
3.**Screenshot Management**:
- TotalRecall renames the image files in the `ImageStore` folder with a `.jpg` extension if they don't already have one. This makes it easier to view and manage the screenshots.
4.**Search Functionality**:
- You can search for specific terms within the database, leveraging the Optical Character Recognition (OCR) capabilities of Windows Recall. This means you can find text that appeared on your screen, even if it was within an image.
5.**Output Generation**:
- The tool generates a summary of the extracted data, including counts of captured windows and images taken. It also creates a detailed report in a text file, listing all the captured data and search results.
### Key Features
- **Date Filtering**:
- Specify start and end dates to limit the extraction to a particular time frame.
- **Text Search**:
- Search for specific text within the captured data, making it easy to find relevant information.
- **Comprehensive Reports**:
- Generate detailed reports summarizing the captured windows, images, and search results, all stored in a `TotalRecall.txt` file for easy reference.
TotalRecall provides a straightforward way to explore the data collected by Windows Recall. It's no rocket science whatsoever.
- **Permission Fix**: Added the `modify_permissions` function to ensure the script has the necessary permissions to access and manipulate files within the target directories, using the `icacls` command. Thank you [James Forshaw](https://x.com/tiraniddo).
Kevin Beaumont ([@GossiTheDog](https://x.com/GossiTheDog)) wrote a [very good article](https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e) about the Recall disaster as well with a spot-on FAQ - bare in mind all of this will likely change for the final release as we have [learned yesterday](https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/).
