Windows Recall AI Snapshot Wipe

Microsoft's Recall AI continuously screenshots your screen and stores the data locally. Standard privacy tools don't touch it. REDACT Pro 5 locates, targets, and permanently destroys all Recall AI snapshot data, database records, and associated index files. One of the only tools that addresses this threat.

Target: %LOCALAPPDATA%\CoreAIPlatform.00\UKP

Live RAM Wipe

Most tools only wipe disk. REDACT Pro 5 also targets active system memory. Encryption keys, session tokens, password fragments, and decrypted file data sitting in RAM are overwritten before they can be captured by memory forensics tools. Critical for physical seizure scenarios where a live machine could be imaged.

Method: pagefile.sys + hibernation file + direct memory overwrite

BitLocker & VeraCrypt Header Destruction

Encrypted drives are still identifiable by their volume headers, which confirm encryption is in use. REDACT Pro 5 overwrites BitLocker metadata headers and VeraCrypt outer and hidden volume headers. Once destroyed, the drive cannot be identified as encrypted and the volume is permanently inaccessible — even to the original owner.

Supported: BitLocker, VeraCrypt, EFS key material

NTFS Change Journal & Shadow Copies

Windows quietly logs every file creation, modification, rename, and deletion in the NTFS Change Journal. Volume Shadow Copies preserve historical file states. Both are primary forensic evidence sources. REDACT Pro 5 purges the change journal, wipes its log data, and destroys VSS snapshots entirely.

Targets: $UsnJrnl, $LogFile, VSS snapshots, $MFT slack

Zero-Footprint Anti-Forensics Engine

REDACT Pro 5 does not merely delete — it actively deceives forensic analysis. NTFS File Cliff Masking hides file boundary artifacts. Registry LastWrite Timestamp Spoofing falsifies the modification history of registry keys. Transient Execution Splitting breaks the logical execution chain forensic tools use to reconstruct program activity.

Techniques: masking / spoofing / execution chain disruption

Windows System Artifact Purge

Windows retains execution evidence in Prefetch files, Shimcache, Amcache, BAM/DAM records, Jump Lists, LNK files, Shellbags, Thumbnail Cache, Windows Event Logs, UserAssist keys, MUICache, RecentDocs, and Taskbar pinned items. REDACT Pro 5 targets all of these systematically across all user profiles on the machine.

Covers: prefetch / shimcache / amcache / shellbags / event logs / LNK

USB Panic

Removing a pre-registered USB device instantly triggers full wipe. Insert to arm, remove to execute. No keystrokes required.

Login Failure

Wipe executes after a configurable number of failed Windows login attempts, protecting against brute-force physical access.

Dead Man's Switch

Requires periodic check-in. If the timer expires without confirmation, the wipe sequence initiates automatically.

VPN Disconnect

If the monitored VPN drops unexpectedly, REDACT immediately wipes to prevent exposure of unprotected traffic data.

WiFi Change

Wipe executes when the system connects to a non-whitelisted wireless network, preventing rogue hotspot exposure.

Time Window

Define active time windows. Outside those hours, any system activity triggers automatic sanitization.

Forensic Tool Detection

Monitors running processes and loaded drivers for known digital forensics tools including FTK, EnCase, Autopsy, Volatility, WinHex, and others. Detection of any recognized forensic utility triggers immediate wipe, even silently in the background.

Browser Artifacts

- Browsing history (all profiles)
- Cookies & session tokens
- Cached web content
- Download history
- Form autofill data
- Saved login credentials
- Session restore files
- IndexedDB / WebStorage
- Extension activity logs
- Favicons database

Windows System Traces

- Prefetch files (.pf)
- Shimcache / AppCompatCache
- Amcache.hve records
- BAM / DAM execution records
- Jump Lists (AutoDest/CustomDest)
- LNK / Shell Link artifacts
- Shellbags (BagMRU/Bags)
- Thumbnail cache (thumbs.db)
- UserAssist registry keys
- MUICache & RecentDocs

Registry Forensics

- Run / RunOnce keys
- TypedPaths (Explorer bar)
- ComDlg32 file open history
- WordWheelQuery (search terms)
- USBSTOR device history
- Network location history
- Last logged-in username
- OpenSavePidlMRU
- LastWrite timestamp spoofing
- RunMRU command history

Memory & Page Files

- pagefile.sys contents
- hiberfil.sys (hibernation)
- Crash dump files
- Minidump records
- Live RAM overwrite
- Swap file artifacts
- Memory-mapped file residue

NTFS & File System

- $UsnJrnl change journal
- $LogFile transaction log
- $MFT slack space
- Volume Shadow Copies (VSS)
- Alternate Data Streams (ADS)
- NTFS File Cliff residue
- Recycle Bin metadata
- Free space overwrite

AI, Encryption & Credentials

- Windows Recall AI snapshots
- Recall AI index database
- BitLocker volume headers
- VeraCrypt outer/hidden headers
- EFS certificate & private keys
- Windows Hello NGC store
- DPAPI master keys
- Credential Manager entries

1-Pass Quick — Single-pass zero overwrite for fast routine sanitization.
NIST SP 800-88 — U.S. National Institute of Standards and Technology media sanitization guideline. Recommended for government and enterprise environments.
HMG IS5 — UK government GCHQ/CESG standard. Single-pass with verification, used in British public sector data destruction.
AFSSI-5020 — U.S. Air Force System Security Instruction. Three-pass overwrite for classified material.
NAVSO P-5239-26 — U.S. Navy standard. Three-pass overwrite with complement pass, designed for MFM-encoded drives.
VSITR — German Federal Office for Information Security (BSI). Seven-pass overwrite with alternating patterns.
DoD 5220.22-M — U.S. Department of Defense standard. Seven-pass overwrite. Industry-standard benchmark.
Gutmann 35-Pass — Developed by cryptographer Peter Gutmann. 35 passes with complex pattern sequence. The most thorough overwrite method available.

01

Complete payment on eBay. Your order is confirmed instantly.

02

Receive your installer download link and lifetime license key via eBay message within 24 hours (usually much faster).

03

Download, install, and activate REDACT Pro 5. Yours permanently — no recurring fees or renewals.

Is this a subscription or a one-time purchase?

One-time purchase. You pay once and own the license permanently. No renewal fees, no subscriptions, no hidden charges.

How many devices does the license cover?

One device. The license is hardware-bound (HWID) to your specific machine at activation. If you need multi-device coverage, message the seller before purchasing.

Is REDACT Pro 5 different from the free open-source version?

Yes. The free version covers 285 artifact targets. Pro 5 extends this to 371 targets and adds the Auto-Trigger Self-Destruct Engine, which is exclusive to the paid release.

Does the wipe affect my installed programs or Windows itself?

No. REDACT Pro 5 targets forensic artifact files and system traces only. Your applications, personal files, and Windows itself are not affected unless you configure full-disk wipe mode.

Do I get updates after purchase?

Yes. Your license covers all future updates within the Pro 5 release line. Message the seller with your license key to receive updated versions.

Will this work on Windows 10 as well as Windows 11?

Yes. Fully compatible with Windows 10 and Windows 11 (64-bit). The Windows Recall AI wipe module activates only on systems where Recall is present (Windows 11 24H2 and later).

Whitepaper

Peter Gutmann Endorsed

Upstream Linux Merged