You open the Recall timeline expecting yesterday’s work, and instead you get an error: snapshots could not be decrypted, the store is corrupted, or the timeline simply refuses to load. Everything looks normal in Settings, your PIN works fine at the lock screen, and yet Recall behaves as though its own memory has been locked away. This is the snapshot encryption layer failing, and it sits one level below the Hello prompt: the identity check passes, but the actual decryption of stored snapshots does not.

The trigger is often something you did days ago without thinking twice. Changing your PIN, switching between a local and Microsoft account, pausing BitLocker during a disk operation, or cloning the drive to a new SSD can all invalidate the keys Recall stored alongside its snapshots. Because these keys live in the TPM and are bound to your specific user profile, even a small change can orphan the entire store. Users who encrypt their drives sometimes blame BitLocker first, and our guide to Recall and BitLocker problems separates which layer is actually at fault.

Before tearing anything down, it helps to know that Recall keeps two things: the encrypted snapshot files themselves, and a separate key binding that says which identity may open them. Most encryption errors are the second item breaking, not the first, which means the snapshots are usually still recoverable. Check your sensitive-info filtering settings too if specific snapshots seem missing rather than unreadable, since filtered content never enters the store. Below, we diagnose the key layer first and only rebuild the store as a last resort.

Why this happens

  • Hello container replaced without re-binding Recall: changing or removing your PIN creates a new TPM container, but Recall’s store may still reference the old one, so decryption fails even though the lock screen accepts the new PIN.
  • BitLocker suspended or re-encrypted: pausing BitLocker for firmware updates or re-encrypting the drive can alter the platform key state that the TPM exposes, confusing the key hierarchy Recall relies on.
  • User profile moved or renamed: snapshots are encrypted per profile. Migrating to a new user account, or a profile rebuild after corruption, leaves the old store orphaned under an identity that no longer exists.
  • Disk cloned or SSD replaced: moving Windows to a new drive changes hardware identifiers that the TPM binding references. The snapshots copied over fine, but the keys no longer match the machine.
  • Snapshot database corrupted by a crash: a forced shutdown while Recall is writing can damage the encrypted database file itself, producing corruption errors that no key repair can fix.
  • Third-party encryption or security software: some endpoint protection tools hook disk or TPM access in ways that interfere with Recall’s decryption calls, especially after their own updates.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Re-enroll Windows Hello to refresh the key container

When the encryption error appeared shortly after a PIN change, the fix is usually to give Windows a completely clean Hello container. Removing and re-adding the PIN forces the TPM to generate fresh key material, and Recall can then re-bind to it in a later step.

  1. Go to Settings, Accounts, Sign-in options, then PIN (Windows Hello), and click Remove.
  2. Restart the laptop so the TPM fully clears the old container.
  3. Return to Sign-in options, click Add, and create a new PIN.
  4. Sign out and back in with the new PIN to confirm the container is stable.
  5. Open Recall; if the error changed or cleared, the container was the problem and Fix 4 will finish the job.

Fix 2: Check BitLocker and drive encryption state

A BitLocker volume stuck in a suspended or partially encrypted state can disturb the TPM key hierarchy. This fix takes two minutes and rules out the whole disk-encryption layer before you touch Recall itself.

  1. Open File Explorer, right-click the C: drive, and check whether BitLocker shows as on, off, or suspended.
  2. If suspended, click Resume protection and let it finish before testing Recall.
  3. Open an elevated Command Prompt and run manage-bde -status C: to confirm the conversion status reads Fully Encrypted or Fully Decrypted, with no errors.
  4. If you recently decrypted and re-encrypted the drive, restart once more so the TPM re-seals its keys cleanly.
  5. Open Recall and check whether the decryption error persists.

Fix 3: Verify the TPM is healthy

Recall’s encryption ultimately anchors in the Trusted Platform Module. A TPM that Windows cannot talk to, or one running ancient firmware, will break every key operation above it, including Recall’s.

  1. Press Win + R, type tpm.msc, and press Enter to open the TPM console.
  2. Confirm the status reads ready for use. If it shows an error, note the exact message.
  3. In the TPM console’s Action menu, try Clear TPM only as a last resort here; first check for a firmware update from your laptop maker instead.
  4. Visit your manufacturer’s support page for TPM or BIOS firmware updates and install them. HP’s support portal lists firmware by model, for example.
  5. After any firmware update, re-enroll your Hello PIN using Fix 1, then test Recall again.

Fix 4: Re-bind Recall’s data protection to the current identity

This is the core repair for most encryption errors: it tells Recall to drop its stale key association and create a fresh one against your current Hello container. Existing snapshots often survive this step.

  1. Open Settings, Privacy and security, then Recall and snapshots.
  2. Turn Recall off, wait about a minute, then turn it back on.
  3. Complete the Windows Hello verification when prompted; this creates the new binding.
  4. Open the timeline and test snapshots from before the error appeared.
  5. If old snapshots now open, the binding was stale and you are done; if they fail, continue to Fix 5.

Fix 5: Reset the snapshot store when the database is corrupted

When the encrypted database file itself is damaged, no key repair will help. Resetting the store deletes all snapshots and lets Recall rebuild from scratch, so treat this as the last resort after Fix 4 has failed.

  1. In Settings, Privacy and security, Recall and snapshots, click Delete snapshots and confirm.
  2. Toggle Recall off and on once more to force a clean store initialization.
  3. Complete Hello verification when asked.
  4. Use the laptop normally for an hour so Recall captures fresh snapshots.
  5. Open the timeline and confirm new snapshots save and open without errors.

Fix 6: Update Windows, pause security software, and re-test

Both Recall’s encryption stack and third-party security tools receive frequent updates, and mismatched versions cause exactly these symptoms. A fully patched system with security software temporarily out of the way isolates the real cause.

  1. Go to Settings, Windows Update, and install all pending updates, including optional driver updates.
  2. Temporarily disable any third-party antivirus or endpoint protection, then test Recall; re-enable the software immediately after.
  3. If Recall works with the software disabled, check that vendor’s support site for a Recall or TPM compatibility update before leaving it off.
  4. Microsoft’s official Windows support page documents current Recall requirements; confirm your build still qualifies.
  5. As a final check, re-enroll the Hello PIN once more and verify the timeline across several days of snapshots.

Closing

Snapshot encryption errors feel alarming because they suggest your data is gone, but in most cases the snapshots are intact and only the key binding broke. Work the list in order: refresh the Hello container, rule out BitLocker and TPM trouble, re-bind Recall’s data protection, and only reset the store when the database itself is damaged. Once the timeline opens cleanly again, keep the system updated so the encryption stack stays healthy. Two unrelated quirks worth knowing about on the same machine: Live Captions can misbehave in the Netflix app , and the Copilot app sometimes vanishes from the taskbar after updates; both have quick fixes if you run into them.

Frequently asked questions

What does a Recall snapshot encryption error actually mean?
It means Windows cannot decrypt the stored snapshots with your current identity. The usual causes are a changed Hello PIN container, a BitLocker state change, a moved user profile, or a corrupted snapshot database, and each one has a specific repair path in this guide.
Will fixing encryption errors delete my existing snapshots?
Not necessarily. Re-enrolling Hello or re-binding data protection often recovers the existing store. Only the full store reset in Fix 5 deletes snapshots, so try the earlier fixes first if the history matters to you.
Does BitLocker have to be on for Recall encryption to work?
BitLocker and Recall encryption are separate layers. Recall encrypts its snapshots with Windows Hello regardless of BitLocker, but a suspended or changed BitLocker state can still confuse the underlying key storage, so check it during diagnosis.
Can someone read my snapshots by removing my hard drive?
No. Recall snapshots are encrypted and bound to your device’s TPM and your Hello identity. Pulling the drive and reading it elsewhere yields only encrypted data that cannot be decrypted without both.