recovery Archives

Winsage

July 10, 2026

Microsoft’s new Windows 11 recovery tool is the ultimate Undo button

On July 19, 2024, at 12:09 AM EDT, 8.5 million Windows PCs, including devices from half of the Fortune 500 companies and the leading U.S. cybersecurity agency, experienced a catastrophic failure due to the Blue Screen of Death, leading to reboot loops. IT teams had to physically access each machine to resolve the issue by removing a problematic CrowdStrike file. CrowdStrike released an automated remediation tool three days later, on July 22. Microsoft pledged to improve Windows' resilience, introducing Quick Machine Recovery nearly a year later. Microsoft unveiled a new recovery feature called Point-in-time Restore, which allows users to revert their PCs to a previous state when functioning correctly. This feature generates daily snapshots of the entire system using the Volume Shadow Copy Service, retaining the three most recent snapshots and consuming minimal disk space (typically 2% of the system drive). Users can access the restore point through the Windows Recovery Environment after three failed startups, with the restoration process taking 30 to 45 minutes. Point-in-time Restore differs from System Restore, which creates less comprehensive snapshots and preserves document files. Point-in-time Restore is automatically enabled for systems with at least 200 GB drives in retail or OEM editions of Windows Home or Pro, while it must be manually activated for smaller drives. In Windows 11 Enterprise edition, it is disabled by default and may require administrative approval to activate. The feature intelligently manages disk usage, discarding older snapshots as needed, but users must enter a BitLocker recovery key if their system drive is encrypted. Users are warned about the risk of losing unsaved work when applying a restore snapshot, and reversing the operation is not straightforward.

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

Winsage

July 9, 2026

Microsoft shares new Windows 11 Update install strategy every admin and user must know

Windows 10 and 11 updates can cause significant issues for users, including high disk space consumption, disruptions to desktop UI functionalities, and potential lockouts via BitLocker recovery. These problems often lead to delays in installing new patches by IT administrators and users, which can expose systems to vulnerabilities. Microsoft has raised concerns about this cautious approach, emphasizing that AI is changing the cybersecurity landscape by enabling faster identification and exploitation of vulnerabilities. To address this, Microsoft recommends moving away from broad deployment delays and adopting staged rollout strategies, using deployment rings to validate patches on a limited number of devices before wider distribution. Additionally, Microsoft has introduced technologies like Windows Autopatch and Hotpatching to automate and streamline the update process while maintaining security. The company advocates for expediting update validation to better protect systems in an evolving threat environment.

Winsage

July 8, 2026

Windows 11’s new Cloud Rebuild can fix your PC even when it won’t boot

Microsoft has introduced a new recovery feature for Windows 11 called Cloud Rebuild, aimed at simplifying the restoration of non-booting PCs without the need for physical recovery drives. Announced at the Ignite 2025 conference, it is available in the Windows 11 Insider Experimental Preview Build 26300.8772. Cloud Rebuild allows users to restore their PCs to a clean state by performing a full OS reinstall, downloading the necessary Windows image and drivers directly from Windows Update. This feature is designed for recovery scenarios and can be accessed even when the system is unresponsive. It may first attempt a Quick Machine Recovery, and if that fails, it will transition to a cloud-based reinstallation. To use Cloud Rebuild, users must navigate to Troubleshoot → Recovery and Uninstallation → Cloud Rebuild within the Windows Recovery Environment (WinRE), and it will erase all existing files on the computer. Currently, it is primarily aimed at system administrators, and users of Windows 11 Home may consider upgrading to Windows 11 Pro to utilize its features.

Winsage

July 8, 2026

Valve releases drivers, notes to make Windows work on Steam hardware, but refuses to support it — tells users it doesn’t offer support for ‘Windows on Steam Hardware,’ gaming company provides resources ‘as is’

Valve has launched a resource page for Windows drivers compatible with its hardware, including the Steam Deck LCD, Steam Deck OLED, and Steam Machine, facilitating the installation of Windows 11 on these devices. The drivers cover essential components such as the APU, graphics, SD card reader, Wi-Fi, Bluetooth, and audio. Users can revert to SteamOS if needed, with recovery instructions provided. The Steam Machine is noted for its high price and lack of subsidies from Valve, which complicates the company's ability to offer discounts. While SteamOS offers a streamlined experience, Valve is working to enhance its compatibility with more hardware. The lack of dual-boot capabilities in SteamOS limits gamers who need specific anti-cheat software, though Valve is exploring this feature without a set release date.

Winsage

July 8, 2026

Windows 11 cleanup is finally simple with this powerful open‑source tool that strips bloat, boosts speed, and gives you real control

Windows 11 includes built-in tools like Storage Sense, Temporary Files settings, and Storage Recommendations for managing storage. BleachBit is a free, open-source cleanup utility for Windows 11 that removes temporary files, caches, logs, and browsing data without ads. Users can download it via a standard installer or a portable version, with installation possible through the command line. BleachBit features a "Preview" option to estimate storage recovery before deletion and offers recommended cleanup options such as temporary files, logs, and the Recycle Bin. It includes a file shredder for securely deleting sensitive files and can wipe free disk space, although this is not recommended for regular maintenance. BleachBit does not have a Registry cleaner, which can prevent potential system issues. While it does not directly speed up Windows 11, it can free up storage space and resolve some cache-related issues. Users comfortable with Windows 11's built-in tools may not need BleachBit, but it offers greater control for those wanting to manage browser data and temporary files more effectively.

Winsage

July 8, 2026

You can soon restore Windows 11 from scratch even if it can’t boot up

Microsoft is previewing a recovery tool called Cloud rebuild for Windows 11, allowing users to reinstall the operating system from scratch even if it is unresponsive. This feature provides a clean version of Windows, free from previous drivers and files, and automatically includes the latest updates. Unlike the existing "Reset this PC" feature, Cloud rebuild does not retain personal files, settings, or applications, necessitating independent restoration of these elements. Users can test Cloud rebuild with the latest Windows 11 insider build (Preview Build 26300.8772 or higher) by navigating to Settings > System > Recovery. The timeline for broader availability is uncertain and depends on testing feedback. Other recovery options include recovery drives, resets, Quick Machine Recovery, and a preview feature called Point-in-Time restore.

Winsage

July 8, 2026

You can soon restore Windows 11 from scratch even if it can’t boot up

Microsoft is previewing a recovery tool called Cloud rebuild for Windows 11, which allows for a clean reinstallation of the operating system even if it fails to boot. This tool automatically downloads the latest updates and drivers, eliminating the need for manual installations after recovery. Unlike the existing "Reset this PC" feature, Cloud rebuild does not retain personal files, settings, or applications, requiring users to restore these independently. To use Cloud rebuild, users need the latest Windows 11 insider build (Preview Build 26300.8772 or higher) and must follow specific steps in the Windows Recovery Environment. The timeline for broader availability of Cloud rebuild is uncertain, depending on ongoing testing and feedback. Other recovery options in Windows 11 include recovery drives, reset functions, Quick Machine Recovery, and a testing feature called Point-in-Time restore.

Winsage

July 7, 2026

Valve shares Windows drivers for Steam Machine and says an official dual-boot wizard will ship “once it’s complete”

Valve's Steam Machine combines console and PC gaming experiences, running on SteamOS but allowing users to install alternative operating systems like Windows. Valve has released official drivers for essential hardware components to support Windows installation, though they do not provide technical support for users who choose this option. Installing Windows requires wiping SteamOS, as dual-booting is not supported. Users can access the boot menu by powering off the device and restarting while pressing the Escape key. An internet connection via Ethernet is necessary during Windows setup, as Wi-Fi functionality will only be restored after installing the wireless drivers.