Notification payload XML

The payload is the XML document an app hands to Windows to describe a notification. In wpndatabase.db it is stored in the Payload column of the Notification table (as XML when PayloadType is Xml), and in appdb.dat it sits in fixed XML slots. The root element depends on the notification type: <toast>, <tile> or <badge>.

A toast follows Microsoft's toast content schema: a <visual> element with a <binding> holding <text> and <image> elements, and optional <actions> with <action> buttons and <input> boxes. The launch attribute carries arguments defined by the app. Tiles use <tile> with several bindings, one per tile size, that usually repeat the same text; a badge is a single <badge value="…"/>.

Why it matters in investigations

The payload is the content the user saw. The <text> lines hold the title and body, which for chat and mail apps means the sender and the first lines of a message. The launch and action arguments often contain an item id, a conversation id or a URL, which links the toast back to the app's own data. <image src> values reference a remote URL or a local app file. The payload survives even when the message or file it announced has been deleted, and because it is distinctive XML, it is also the anchor used to recover deleted rows.

Example

A fictional chat toast, as it could appear in the Payload column:

<toast launch="action=openThread&amp;threadId=4471">
  <visual>
    <binding template="ToastGeneric">
      <text>Mara K.</text>
      <text>Transfer done?</text>
    </binding>
  </visual>
  <actions>
    <input id="reply" type="text" placeHolderContent="Type a reply"/>
    <action content="Reply" arguments="reply:4471" activationType="background"/>
  </actions>
</toast>

The Windows Notification Parser renders each payload as a readable card and shows the raw XML; wpndatabase.db tables and columns explained lists the fields worth reading.

Why it matters in investigations

Example

Related terms