https://www.windowsnotificationparser.com/en/blog Latest from Blog en Tue, 29 Sep 2026 14:11:28 GMT https://www.windowsnotificationparser.com/en/blog/appdb-dat-legacy-windows-notifications https://www.windowsnotificationparser.com/en/blog/appdb-dat-legacy-windows-notifications What appdb.dat is, which Windows versions use it, how its fixed chunks hold toasts, tiles and badges, and what you can and cannot get out of it. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT https://www.windowsnotificationparser.com/en/blog/windows-notifications-incident-investigation https://www.windowsnotificationparser.com/en/blog/windows-notifications-incident-investigation A fictional walkthrough: what one user's notification database adds to an intrusion timeline — a download, an antivirus alert, a new app and a deleted chat message. Florian Amette Fri, 25 Sep 2026 00:00:00 GMT https://www.windowsnotificationparser.com/en/blog/analyze-wpndatabase-in-browser https://www.windowsnotificationparser.com/en/blog/analyze-wpndatabase-in-browser Step by step: open the Windows notification database and its -wal in a free browser-based parser, triage findings, recover deleted toasts and export CSV, JSON or Timesketch. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.windowsnotificationparser.com/en/blog/recover-deleted-windows-notifications https://www.windowsnotificationparser.com/en/blog/recover-deleted-windows-notifications Why dismissed and expired toasts survive in wpndatabase.db, where SQLite leaves them (freeblocks, freelist, WAL frames) and how to recover them without fooling yourself. Florian Amette Wed, 23 Sep 2026 00:00:00 GMT https://www.windowsnotificationparser.com/en/blog/wpndatabase-schema-tables-explained https://www.windowsnotificationparser.com/en/blog/wpndatabase-schema-tables-explained Field reference for the Windows notification database: Notification, NotificationHandler, HandlerAssets, WNSPushChannel, FILETIME times and the toast XML payload. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT https://www.windowsnotificationparser.com/en/blog/wpndatabase-location-acquisition https://www.windowsnotificationparser.com/en/blog/wpndatabase-location-acquisition Where the Windows notification database lives on Windows 10 and 11, and how to collect it with its -wal file from live systems, images, KAPE or Velociraptor. Florian Amette Mon, 21 Sep 2026 00:00:00 GMT https://www.windowsnotificationparser.com/en/blog/windows-notification-forensics-guide https://www.windowsnotificationparser.com/en/blog/windows-notification-forensics-guide What the Windows notification database records, where it lives, what it proves and where it stops: a practical guide to wpndatabase.db for DFIR. Florian Amette Sun, 20 Sep 2026 00:00:00 GMT