Skip to content
NotificationPARSER

Glossary

Toast notification

A pop-up notification shown by Windows on behalf of an app, kept in the notification center and in wpndatabase.db until it expires or is dismissed.

A toast is the notification type users see most: a small window that slides in at the corner of the screen with the app's name, a title, a few lines of text and optional images, buttons or a reply box. After it disappears from the screen, it stays in the notification center until the user dismisses it or it expires. Apps raise toasts locally or through the Windows Push Notification Services over a WNS push channel.

The content of a toast is defined in XML following Microsoft's toast content schema. In wpndatabase.db, a toast is a Notification row with Type = toast: its XML is in the Payload column, its sender in HandlerId, and its arrival and expiry times in ArrivalTime and ExpiryTime, both FILETIME values in UTC. Tag and Group are labels the app chooses to replace or remove its own toasts; chat apps often put a message or thread id there.

Why it matters in investigations

Toasts are written by Windows on behalf of other apps, so they keep a copy of what the user was shown even after the source disappears: a deleted chat message, a quarantined file, a moved download. Typical finds are message previews, antivirus alerts naming a file path, download notices, removable-drive prompts and sign-in prompts, each with a precise UTC time. A toast proves the system received the notification, not that the user read it, and its absence proves nothing.

Example

In the site's fictional sample, a browser toast at 10:02:04 UTC reads "Download complete: tools.zip". Its time can be matched against the file's $MFT times, browser history and the Zone.Identifier stream.

Load the sample in the Windows Notification Parser and follow the incident walkthrough to see toasts in a timeline.