Microsoft Recall and the Screenshot Database Nobody Asked to Encrypt

When Microsoft unveiled Recall for Copilot+ PCs in May 2024, the pitch was seductive: your computer would periodically screenshot everything you did, so you could later search your own activity in plain language. The security community's reaction was swift and unanimous, and it centred on how those screenshots were stored.

Recall works by capturing frequent snapshots of the screen, extracting the text, and making the whole timeline searchable. In the original design, researchers found that the snapshots and their extracted text sat in a local, unencrypted SQLite database — readable by any app or attacker with access to the user's account. Security researcher Kevin Beaumont, who examined it closely, characterised it bluntly as building a keylogger-like record into the operating system.

Why the storage model was the whole problem

A searchable history of everything on your screen is, by definition, a database of your passwords typed in the clear, your private messages, your banking pages, your medical searches. Storing that unencrypted means any malware running as the user — the exact privilege level commodity infostealers already achieve — could copy the entire record. Researchers demonstrated how trivially the data could be pulled, and the point landed.

A redesign under scrutiny

Facing sustained criticism — and enquiries from the UK's data regulator, the ICO — Microsoft delayed Recall and re-architected it. The revised feature is off by default and opt-in; it requires Windows Hello authentication to open; it encrypts the database; and it decrypts snapshots only "just in time" when the authenticated user actually accesses them. Those are the right controls, and it is worth acknowledging Microsoft changed course substantively rather than shipping the original.

The episode is best read not as a single vulnerability — there is no CVE here — but as a design-governance failure caught before mass deployment. The capability was built first and the threat model applied second, in public, after researchers supplied it. For any team building AI features that hoover up user context, that ordering is the cautionary tale.

The strongest part of the criticism was not that Recall could theoretically be abused, but that it changed the cost of an existing attack. Infostealer malware and opportunistic account compromise are commodity threats, and what they can steal is bounded by what sits accessible on the machine. Recall, as first designed, dramatically raised that ceiling — turning a routine, low-privilege compromise into access to a searchable record of everything the victim had done, said, and typed. Security is often about not making the worst realistic day worse, and the original Recall did precisely that. The redesign — off by default, authentication-gated, just-in-time decryption, encryption at rest — is a template worth studying, and none of it is exotic. These are the controls that should have been in the first design review, applied before a capability this powerful was built rather than after researchers forced the conversation.

What defenders should take away

• Design the data-at-rest threat model first. Before a feature captures sensitive context, decide how it is encrypted, gated, and minimised — not after launch.
• Default to off for high-impact capture. Opt-in, authenticated access, and short retention should be the starting position for anything that records the screen.
• Assume account-level malware. "Only readable by the user" is not a control when the threat you actually face runs as the user.
• Inventory context-capturing AI features. Recall-style tooling, on managed and unmanaged devices, creates concentrated troves you must know about to govern.

Recall's redesign shows the system working: researchers pushed, a vendor rebuilt. But it only worked because people looked hard before the feature was everywhere. On your own fleet, the equivalent first move is knowing which AI features are quietly recording user activity — because you cannot defend what you have not discovered.