Unusual files in my Cross Device Folder in my User Profile

Question

I just recently upgraded to windows 11. I noticed a folder in my user profile called cross device. Within that folder there is another folder called "saved searches" within that folder is another "document folder". I looked through this folder that had few files in it but some of them seemed unusual and sensitive files that were created using a PC several generations ago. Almost appeared that someone from outside was searching through my computer files and placing files that may contain sensitive information into this folder linked to my phone.

Answer 1

Hi Brian W,

I understand why it would feel alarming to see a new CrossDevice folder after upgrading to Windows 11, and then finding older “sensitive-looking” files inside it. The good news is: the folder itself is not proof of an external attacker, and besides the Q&A Assist's explanation, there are a few normal Windows features that relate to what you’re seeing.

The CrossDevice folder is associated with Windows “cross-device” features (e.g. Phone Link, Mobile devices...) that can surface content across your profiles. During an upgrade, Windows may migrate your data and rebuild meta-search/index, which can make older files appear in unexpected places. They can be from both your phone and PC.

At the same time, I totally understand if you want to be careful. It’s reasonable to treat this as a security concern until you verify there’s no compromise. Here's what you should do:

1 - Check if those files are real copies or just “search/index references”

• Right-click one of the “unusual” files > select Properties
• Confirm if its location is inside C:\Users\<you>\CrossDevice\...
• Is it a full-sized file or tiny metadata?
• Do Created/Modified dates match your phone/PC uses?

2 - Check if Phone Link / cross-device access is enabled

• Open Settings > Bluetooth & devices > Mobile devices
• Turn OFF Allow this PC to access your mobile devices
• Click your phone and Remove if you don't use it.

3 - Run a proper security check

• Open Windows Security > Virus & threat protection
• Run a Full scan > Microsoft Defender Offline scan (if available)

4 - Check your Microsoft account activity

• Visit https://account.microsoft.com/privacy and sign in.
• Change your Microsoft account password if you haven’t recently
• Enable two-factor authentication (2FA) and add multiple ways.
• Review sign-in activity and devices on your Microsoft account.

You can remove the files from CrossDevice, but note that those are actively syncing with your phone. Deleting them could affect how it appears in Phone Link contexts, so it’s safer to disable cross-device features first before cleaning.

I know this is unsettling, but based on how Windows 11 handles cross-device experiences and post-upgrade indexing/migration, this seems more like phone's hidden files resurfacing, than by a person manually browsing your files.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The CrossDevice and Saved Searches folders in the user profile are normal Windows features and do not by themselves indicate that someone is remotely searching the PC.

Key points:

1. What CrossDevice/Saved Searches are
   • Windows and some Microsoft apps can sync activity and search history across devices signed in with the same Microsoft account (PCs, phones, tablets).
   • The CrossDevice and Saved Searches locations are used by the system and apps to store search-related metadata or saved queries.
   • Old or “sensitive‑looking” filenames can appear there if they were part of past searches or indexed content from older backups, migrated profiles, or OneDrive content.
2. Why old/sensitive files might show up
   • During an upgrade to Windows 11, Windows can migrate user data, search index information, and profile content from the previous installation.
   • If older files were present on the device, on attached drives, or in cloud storage (such as OneDrive), Windows Search may index them and they can appear in saved searches or cross‑device activity lists.
   • This can give the impression that someone “collected” them, but it is typically automated indexing and sync.
3. How to check for actual compromise
   • Run a full scan with Windows Security (Microsoft Defender) and any reputable antimalware already installed.
   • Review installed apps and browser extensions and remove anything not recognized.
   • Check for unusual startup items (Task Manager → Startup) and scheduled tasks if there is any sign of unexpected behavior (pop‑ups, new apps, redirects, etc.).
   • Change the Microsoft account password and enable two‑factor authentication if not already enabled.
4. How to reduce or stop cross‑device activity
   • In Windows 11, open Settings → Privacy & security and review activity history, search permissions, and account sync settings.
   • Turn off features that sync activity or search history across devices if this behavior is not desired.
   • Files that are not needed in the Saved Searches subfolder can be moved or deleted like normal files (after confirming they are not needed by any application).

Based on the described behavior alone, the presence of these folders and files is consistent with normal Windows search and sync behavior after an upgrade, not direct evidence of someone manually placing files from outside.

---

References:

• Find lost files after upgrading Windows
• Retrieve files from the Windows.old folder after a Windows upgrade
• Seeing pictures that are not my photos in OneDrive