Security researcher Alexander Hagenah released TotalRecall Reloaded, a tool that exploits weaknesses in Microsoft's Copilot+ Recall feature to access encrypted local screenshots and user data without requiring administrator privileges. Hagenah, who authored the original TotalRecall tool that captured Recall information on Windows PCs, created the updated version to expose additional vulnerabilities in the feature's security architecture.

Recall is a Copilot+ feature that tracks PC usage through periodic screenshots to help users recall past activity. Microsoft delayed the Recall rollout by almost a year and overhauled its security after the original version stored screenshots and a database of all user activity in unencrypted files on users' disks. Under the revised design, all locally stored Recall data is encrypted and viewable only with Windows Hello authentication, and the feature is turned off by default on supported PCs. Recall now also detects and excludes sensitive information, including financial data, from its database.

According to the TotalRecall GitHub page, once a user authenticates, the system passes Recall data to the AIXHost.exe process, which does not have the same security protections as Recall itself. TotalRecall Reloaded injects a DLL into AIXHost.exe using an executable file, a step that does not require administrator privileges. The tool runs in the background and waits for the user to open Recall and authenticate using Windows Hello.

"The tool doesn't bypass that. It makes the user do it, silently rides along when the user does it, or waits for the user to do it," Hagenah wrote on the project's GitHub page. After authentication, the tool intercepts screenshots, OCR text, and metadata that Recall sends to AIXHost.exe, and it continues to do so even after the Recall session closes. Once the user is authenticated, the tool can access both new and previously recorded Recall data.

The tool can also grab the most recent Recall screenshot, capture select metadata about the Recall database, and delete the user's entire Recall database — all without Windows Hello authentication. Anyone with access to a PC and the Windows Hello fallback PIN can access the Recall database and its contents, which could include emails, messages, web activity, and other stored content.

Hagenah reported his findings to Microsoft's Security Response Center on March 6. On April 3, Microsoft classified the issue as "not a vulnerability." A Microsoft spokesperson said the authorization period has a timeout and anti-hammering protection that limit the impact of malicious queries.

Some applications have taken independent steps to keep their content out of the Recall database. The Signal Messenger app on Windows forces Recall to ignore it by default by using a flag intended to keep DRM-protected content out of the database. The AdGuard ad blocker and the Brave browser have implemented similar workarounds.