Skip to content
NotificationPARSER

Posts tagged: #wpndatabase

← Back to all posts

Windows Notifications in an Incident Investigation
A fictional walkthrough: what one user's notification database adds to an intrusion timeline — a download, an antivirus alert, a new app and a deleted chat message.
windows-notificationswpndatabaseinvestigationdfir

How to Analyze wpndatabase.db in Your Browser
Step by step: open the Windows notification database and its -wal in a free browser-based parser, triage findings, recover deleted toasts and export CSV, JSON or Timesketch.
windows-notificationswpndatabasetoolsdfir

Recovering Deleted Windows Notifications
Why dismissed and expired toasts survive in wpndatabase.db, where SQLite leaves them (freeblocks, freelist, WAL frames) and how to recover them without fooling yourself.
windows-notificationswpndatabasesqliterecovery

wpndatabase.db Tables and Columns Explained
Field reference for the Windows notification database: Notification, NotificationHandler, HandlerAssets, WNSPushChannel, FILETIME times and the toast XML payload.
windows-notificationswpndatabasesqlitereference

wpndatabase.db Location and Acquisition
Where the Windows notification database lives on Windows 10 and 11, and how to collect it with its -wal file from live systems, images, KAPE or Velociraptor.
windows-notificationswpndatabaseacquisitiondfir

Windows Notification Forensics: The wpndatabase.db Guide
What the Windows notification database records, where it lives, what it proves and where it stops: a practical guide to wpndatabase.db for DFIR.
windows-notificationswpndatabasedfirsqlite