Skip to content
NotificationPARSER

Glossary

appdb.dat

The undocumented binary notification store of Windows 8.x and Windows 10 before build 1607, replaced by wpndatabase.db.

appdb.dat is the notification store that Windows 8.x and Windows 10 builds before 1607 used before Microsoft moved to the SQLite database wpndatabase.db. It sits in the same folder, %LOCALAPPDATA%\Microsoft\Windows\Notifications\, and starts with the four-byte signature DNPW. Microsoft has never documented it: everything known about its layout comes from reverse engineering, first published by Yogesh Khatri in 2016 and later turned into a complete structure definition by the Dissect project.

The known version 3 layout (Windows 10) is a fixed-size file of 256 chunks. Each chunk holds an in-use flag, a WNS push URI, one badge, five tile slots and twenty toast slots. Every tile and toast slot carries an id, FILETIME arrival and expiry times, stored names and the notification's XML. Version 1 (Windows 8) uses a different layout.

Why it matters in investigations

Older images, and systems upgraded from early Windows 10 builds, may still hold an appdb.dat, sometimes next to a wpndatabase.db. Its toasts use the same payload XML as the modern database, so message previews, download notices and security alerts read the same way. Two limits matter: a chunk does not name the app that owns it, and there is no SQLite free space to carve, so deleted entries survive only in slots that have not been reused.

Example

Offset 0x00000  44 4E 50 57 03 00 00 00 ...   "DNPW", version 3
Chunk size      0x23810 bytes (145,424)
File size       256 x 0x23810 = 37,228,544 bytes

A complete file is therefore a little over 37 MB whatever it contains. A shorter file is probably truncated, which the parser reports as a warning.

Open an appdb.dat in the Windows Notification Parser (version 3, best effort) and read appdb.dat, the legacy notification store for the full structure.