Posts tagged: #sqlite

Why dismissed and expired toasts survive in wpndatabase.db, where SQLite leaves them (freeblocks, freelist, WAL frames) and how to recover them reliably.

Windows notification database field reference: Notification, NotificationHandler, HandlerAssets, WNSPushChannel, FILETIME times and toast XML payload.

What the Windows notification database records, where it lives, what it proves and where it stops: a practical guide to wpndatabase.db for DFIR.