A while ago I wrote about how Windows would track screenshots in shell items and cache the content into a specific directory. While this blog post won’t be anything groundbreaking, I thought I’d share some fun findings about the new “Snipping Tool” on Windows 11.
“Snipping Tool” was briefly deprecated and replaced with “Snip and Sketch” on Windows 10, but then come Windows 11 we’re back to “Snipping Tool” again. If you press Windows+Shift+S or open “Snipping Tool” directly it will allow you to take a screenshot of a section of the screen.
The default settings show that any screenshot you take this way will be saved into the users “Pictures\Screenshots” directory. The filenames indicate they’re a screenshot but unfortunately there’s no embedded metadata inside.
Ok so that’s not really interesting, why would I want to talk about this?
Well, if you decide to turn this off, because you don’t want Windows to track your screenshots, then it will stop saving them into your Pictures directory and instead save them into the Snips directory shown below:
%LOCALAPPDATA%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState\Snips
I’m not sure how long these last for but definitely last a reboot. I’ll try remember to check back in a few days and see whether they lasted.
Something else to note – it’s one or the other – it either saves them in your Screenshots folder or the Snips folder but not both.
ThinkDFIR 
[…] ThinkDFIRCached screenshots on Windows 11 […]
LikeLike
Great writeup! I’ve also had some success finding screenshots in the thumbcaches, but of course the big caveat for that is the user has to be using thumbnail mode in explorer, or actually have viewed the screenshot.
LikeLike
Hi Phill, thanks for this post — it’s one of the very few write-ups on this artifact. You mentioned you weren’t sure how long these files last, so I thought I’d share what I found after experimenting on my own machine for a few days.
The retention rule appears to be: each time a new capture is taken, the app deletes any files in the Snips folder older than exactly 24 hours at that moment. In one test, a file aged 24h + 12s was deleted while one aged 23h 41m survived, so the threshold seems accurate to the second.
A few related observations:
Deletion is triggered only by taking a new capture (Win+Shift+S). Reboots, Disk Cleanup, and idle time did nothing on my machine — so if the user stops taking screenshots, the last 24 hours’ worth of captures just stays on disk indefinitely. That would explain why the files “survive a restart” and why the cleanup looks arbitrary: the retention is 24 hours, but the enforcement only happens on next use.
This was all with “Automatically save original screenshots” turned OFF, on Windows 11 (build 26200.8875), Snipping Tool updated June 2026. The behavior survived an app reset (Settings > Apps > Advanced options > Reset), so it doesn’t seem to be tied to any stored app state.
One caveat: this is based on observations from a single machine, so the exact retention window or trigger may differ on other builds/configurations. I’d be curious whether others can reproduce it.
Also, a small disclosure: I’m not a native English speaker, so I wrote this comment with the help of an LLM — apologies for any awkward phrasing, but the observations and experiments are my own.
LikeLike