Skip to main content

Your Windows 11 screenshots may not be as private as you thought

When you capture a screenshot and crop out sensitive information, it’s still possible to recover a portion of the image that was supposedly removed in some circumstances.

This isn’t the first time redacted documents have turned out to have left hidden data intact and readable with the right tools and knowledge. A recent bug in Google’s Markup tool for the Pixel phone, humorously dubbed the “Acropalypse,” shows this issue might be surprisingly common.

In a comment on the tweet about the Pixel bug, Chris Blume shared a similar discovery about the Windows Snipping Tool. A PNG image that requires 198 bytes grows to a much larger 4.7kB file when saved over an existing image. When saved as a new file, it increases by only 56 bytes, probably adding some metadata.

I've got a fun one for you all to look at.

I opened a 198 byte PNG with Microsoft's Snipping Tool, chose "Save As" to overwrite a different PNG file (no editing), and saves a 4,762 byte file with all that extra after the PNG IEND chunk.

Sounds similar :D

— Chris Blume (@ProgramMax) March 21, 2023

The implication is that Windows Snipping Tool overwrites files without reallocating storage. Instead, the new image data overwrites the existing file, followed by an end-of-file marker, and the rest of the old content remains.

While this might not sound like a common occurrence, consider the scenario Bleeping Computer described. You take a screenshot with the Windows Snipping Tool and save it. Realizing some sensitive data is visible, you crop it out and save over the original file.

In a Windows File Explorer preview pane and the Photos app, it looks like the crop is successful. In truth, the file size will be the same as that of the uncropped version, and parts of the old image are still there.

It isn’t easy to see the old data, but not that hard if you are looking for it and have some developer tools or a specialized app made to take advantage of this vulnerability.

Microsoft is aware of the issue and is currently investigating. In the meantime, you can protect yourself by cropping with the Photos app or other Windows photo editor. You can keep using the Snipping Tool safely if you save cropped screenshots as new files instead of overwriting existing data.

Editors' Recommendations

Alan Truly
Computing Writer
Alan is a Computing Writer living in Nova Scotia, Canada. A tech-enthusiast since his youth, Alan stays current on what is…
The Windows 11 Android app dream is dead
A photo of the TikTok app running on a Windows 11 laptop

Microsoft first brought over the option to run Android apps natively in Windows 11 in 2021, but the dream is coming to an end after just a few years. Today, the company quietly updated its documentation for the Windows Subsystem for Android (WSA) to indicate that it will be ending support for the feature on March 5, 2025. Amazon has also published updated guidance for the same issue about its Amazon App Store on Windows 11, which powers the WSA.

What's causing this change is unknown, as Microsoft did not dive into specific details. Left to speculate, we can assume it's due to either lack of use or licensing issues, but until we hear more, it's left ambiguous.

Read more
Microsoft may fix the most frustrating thing about Windows updates
Windows 11 updates are moving to once a year.

Most Windows users will agree that one of the most annoying things about the operating system is the updates. While Windows Updates are necessary, they often tend to come up at the worst possible time, interrupting work and gaming sessions with persistent reminders that the system needs to reboot. Microsoft might be fixing that problem in the upcoming Windows 11 24H2 build, but it's still too early to bid farewell to those ill-timed reboots.

As spotted in the latest Windows 11 Insider Preview Build 26058, Microsoft is testing "hot patching" for some Windows 11 updates. Hot patching refers to a dynamic method of updating that often doesn't change the software version and may not even need a restart. In the context of Windows 11, it's pretty straightforward -- Windows will install the update, and you won't have to reboot your system.

Read more
A new Windows 11 hardware system requirement may be incoming
A man sits, using a laptop running the Windows 11 operating system.

Microsoft appears to finally be putting its foot down on how far back it's willing to go when it comes to supporting older hardware. As of the upcoming Windows 11 24H2 build, Microsoft will require that your processor supports the POPCNT instruction. If you're wondering what that is and whether this will affect you, you're not alone.

This new addition was spotted by Bob Pony on X (formerly Twitter). According to the user, if the CPU doesn't support the POPCNT instruction or it's disabled, Windows won't work at all. Multiple system files now require this instruction, starting with the Windows 11 kernel. Long story short -- no POPCNT, no Windows 11 24H2.

Read more