A while ago I wrote about how Windows would track screenshots in shell items and cache the content into a specific directory. While this blog post won’t be anything groundbreaking, I thought I’d share some fun findings about the new “Snipping Tool” on Windows 11.
“Snipping Tool” was briefly deprecated and replaced with “Snip and Sketch” on Windows 10, but then come Windows 11 we’re back to “Snipping Tool” again. If you press Windows+Shift+S or open “Snipping Tool” directly it will allow you to take a screenshot of a section of the screen.

The default settings show that any screenshot you take this way will be saved into the users “Pictures\Screenshots” directory. The filenames indicate they’re a screenshot but unfortunately there’s no embedded metadata inside.
Ok so that’s not really interesting, why would I want to talk about this?
Well, if you decide to turn this off, because you don’t want Windows to track your screenshots, then it will stop saving them into your Pictures directory and instead save them into the Snips directory shown below:
%LOCALAPPDATA%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState\Snips

I’m not sure how long these last for but definitely last a reboot. I’ll try remember to check back in a few days and see whether they lasted.
Something else to note – it’s one or the other – it either saves them in your Screenshots folder or the Snips folder but not both.
[…] ThinkDFIRCached screenshots on Windows 11 […]
LikeLike
Great writeup! I’ve also had some success finding screenshots in the thumbcaches, but of course the big caveat for that is the user has to be using thumbnail mode in explorer, or actually have viewed the screenshot.
LikeLike