this post was submitted on 04 Jun 2024
663 points (98.5% liked)

Technology

60110 readers
3526 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago
MODERATORS
L3s
[email protected]
[email protected]
L4s
enu
663
xaitax/TotalRecall: This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. (github.com)
submitted 6 months ago by [email protected] to c/technology
83 comments fedilink hide all child comments
 

this rootless Python script rips Windows Recall's screenshots and SQLite database of OCRed text and allows you to search them.

you are viewing a single comment's thread
view the rest of the comments
[–] BradleyUffner 21 points 6 months ago (2 children)

It IS encrypted. Not well, but it's encrypted.

[–] [email protected] 12 points 6 months ago (1 children)

I thought that it was encrypted if your home directory was encrypted? The impression that I got was that it was just a SQLite database stored in the clear. The user must certainly be able to make queries of that database in order for it to work, so even if it's hosted by a non-user service, malware running locally will still be able to exfiltrate the data.

[–] BradleyUffner 6 points 6 months ago

All true, which is what I meant by "not well" encrypted. It's technically encrypted, but for all practical purposes it might as well not be.

[–] [email protected] 1 points 6 months ago

Is it? I skimmed the GitHub source code and couldn't see anything involving encryption, but it's totally possible I missed something. Perhaps just accessing the database from python is enough to decrypt it.