NewApp Digest
search bot

Windows Recovery

The 200GB catch hiding in Windows 11's new recovery feature
Winsage
July 19, 2026

The 200GB catch hiding in Windows 11’s new recovery feature

Microsoft has introduced point-in-time restore for Windows 11 users, enhancing the traditional System Restore. This new recovery tool allows users to recover their PCs from software issues, problematic drivers, or faulty updates, even when Windows won’t boot. It uses the Volume Shadow Copy Service (VSS) to automatically generate restore points every 24 hours, which include both system and user files, unlike System Restore. Point-in-time restore manages storage by deleting restore points after 72 hours and integrates seamlessly into Windows Settings, being activated by default for volumes over 200GB. Users with smaller volumes must activate it manually. It also incorporates Reserved Storage to ensure restore points do not consume regular disk space. The feature is available on Windows 11 Home and Pro editions with the installation of the optional Preview Update KB5095093. Users can access point-in-time restore through Windows Settings under System > Recovery, and initiate recovery via the Windows Recovery Environment (Windows RE).
Windows 11 has more recovery options than ever, and here’s exactly when I would use each one to fix a broken PC
Winsage
July 16, 2026

Windows 11 has more recovery options than ever, and here’s exactly when I would use each one to fix a broken PC

Microsoft has enhanced Windows 11 with various recovery tools that allow users to address system issues without needing to perform a complete reinstall. Key features include: - Reset This PC: Offers two options: "Keep my files" (reinstalls Windows while retaining personal files) and "Remove everything" (wipes the computer before reinstalling). Users can choose between a Local reinstall or Cloud download. - Cloud Rebuild: Accessible via the Windows Recovery Environment (WinRE), it reformats the OS partition, downloads a fresh Windows image, and restores the original setup without relying on local recovery images. - Go Back (Rollback): Allows users to revert to a previous installation after an upgrade if issues arise, utilizing the Windows.old folder, but is time-sensitive (files purged after about ten days). - Uninstall Updates: Enables users to remove recent updates that may cause problems without a full system reset. - System Restore: Creates restore points to revert to a stable state without affecting personal files. - Startup Repair: A tool in WinRE that scans for and fixes common startup issues. - Safe Mode: Starts Windows with essential drivers and services to troubleshoot problems. - Quick Machine Recovery: Automatically connects to Microsoft's recovery service to download fixes if Windows fails to start due to a faulty update or driver. - Point-in-Time Restore: Automatically reverts the system to a previous working state when updates fail. Other tools include the Windows Recovery Environment (WinRE), Recovery Drive for bootable USB access, Command Prompt, Startup Settings, and the Windows Backup app for restoring settings and files. The legacy Backup and Restore (Windows 7) tool is still available for creating backups and full system images.
Microsoft's new Windows 11 recovery tool is the ultimate Undo button
Winsage
July 10, 2026

Microsoft’s new Windows 11 recovery tool is the ultimate Undo button

On July 19, 2024, at 12:09 AM EDT, 8.5 million Windows PCs, including devices from half of the Fortune 500 companies and the leading U.S. cybersecurity agency, experienced a catastrophic failure due to the Blue Screen of Death, leading to reboot loops. IT teams had to physically access each machine to resolve the issue by removing a problematic CrowdStrike file. CrowdStrike released an automated remediation tool three days later, on July 22. Microsoft pledged to improve Windows' resilience, introducing Quick Machine Recovery nearly a year later. Microsoft unveiled a new recovery feature called Point-in-time Restore, which allows users to revert their PCs to a previous state when functioning correctly. This feature generates daily snapshots of the entire system using the Volume Shadow Copy Service, retaining the three most recent snapshots and consuming minimal disk space (typically 2% of the system drive). Users can access the restore point through the Windows Recovery Environment after three failed startups, with the restoration process taking 30 to 45 minutes. Point-in-time Restore differs from System Restore, which creates less comprehensive snapshots and preserves document files. Point-in-time Restore is automatically enabled for systems with at least 200 GB drives in retail or OEM editions of Windows Home or Pro, while it must be manually activated for smaller drives. In Windows 11 Enterprise edition, it is disabled by default and may require administrative approval to activate. The feature intelligently manages disk usage, discarding older snapshots as needed, but users must enter a BitLocker recovery key if their system drive is encrypted. Users are warned about the risk of losing unsaved work when applying a restore snapshot, and reversing the operation is not straightforward.
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Tech Optimizer
July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.
Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs
Winsage
July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.
Windows 11's new Cloud Rebuild can fix your PC even when it won't boot
Winsage
July 8, 2026

Windows 11’s new Cloud Rebuild can fix your PC even when it won’t boot

Microsoft has introduced a new recovery feature for Windows 11 called Cloud Rebuild, aimed at simplifying the restoration of non-booting PCs without the need for physical recovery drives. Announced at the Ignite 2025 conference, it is available in the Windows 11 Insider Experimental Preview Build 26300.8772. Cloud Rebuild allows users to restore their PCs to a clean state by performing a full OS reinstall, downloading the necessary Windows image and drivers directly from Windows Update. This feature is designed for recovery scenarios and can be accessed even when the system is unresponsive. It may first attempt a Quick Machine Recovery, and if that fails, it will transition to a cloud-based reinstallation. To use Cloud Rebuild, users must navigate to Troubleshoot → Recovery and Uninstallation → Cloud Rebuild within the Windows Recovery Environment (WinRE), and it will erase all existing files on the computer. Currently, it is primarily aimed at system administrators, and users of Windows 11 Home may consider upgrading to Windows 11 Pro to utilize its features.
You can soon restore Windows 11 from scratch even if it can't boot up
Winsage
July 8, 2026

You can soon restore Windows 11 from scratch even if it can’t boot up

Microsoft is previewing a recovery tool called Cloud rebuild for Windows 11, allowing users to reinstall the operating system from scratch even if it is unresponsive. This feature provides a clean version of Windows, free from previous drivers and files, and automatically includes the latest updates. Unlike the existing "Reset this PC" feature, Cloud rebuild does not retain personal files, settings, or applications, necessitating independent restoration of these elements. Users can test Cloud rebuild with the latest Windows 11 insider build (Preview Build 26300.8772 or higher) by navigating to Settings > System > Recovery. The timeline for broader availability is uncertain and depends on testing feedback. Other recovery options include recovery drives, resets, Quick Machine Recovery, and a preview feature called Point-in-Time restore.
silver Android smartphone
Winsage
July 8, 2026

You can soon restore Windows 11 from scratch even if it can’t boot up

Microsoft is previewing a recovery tool called Cloud rebuild for Windows 11, which allows for a clean reinstallation of the operating system even if it fails to boot. This tool automatically downloads the latest updates and drivers, eliminating the need for manual installations after recovery. Unlike the existing "Reset this PC" feature, Cloud rebuild does not retain personal files, settings, or applications, requiring users to restore these independently. To use Cloud rebuild, users need the latest Windows 11 insider build (Preview Build 26300.8772 or higher) and must follow specific steps in the Windows Recovery Environment. The timeline for broader availability of Cloud rebuild is uncertain, depending on ongoing testing and feedback. Other recovery options in Windows 11 include recovery drives, reset functions, Quick Machine Recovery, and a testing feature called Point-in-Time restore.
Search