Skip to content
NotificationPARSER

Glossary

wpndatabase.db

The per-user SQLite database where Windows 10 (1607+) and Windows 11 store the notifications apps send, with their content, sending app and times.

wpndatabase.db is the per-user SQLite database of the Windows Push Notification platform on Windows 10 (build 1607 and later) and Windows 11. It stores the toasts, tile updates and badges that apps send to the user, together with the app that sent each one and when it arrived and expires. It replaced the binary appdb.dat and lives in the same folder:

C:\Users\<user>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db
                                                             wpndatabase.db-wal
                                                             wpndatabase.db-shm

The main tables are Notification (one row per notification: Type, Payload, Tag, Group, ArrivalTime, ExpiryTime), NotificationHandler (one row per app that can notify), HandlerAssets and HandlerSettings (key / value details), WNSPushChannel (push channel URIs) and Metadata.

Why it matters in investigations

The database holds content written by Windows on behalf of other apps: chat and mail previews, antivirus alerts naming files, download notices and device prompts, each with a UTC FILETIME arrival time. It often outlives what it announced. It also lists every registered notification handler, including one that appeared during an incident.

Three practical points: the database runs in WAL mode, so the newest notifications are often only in wpndatabase.db-wal and both files must be collected together; the file is held open while the user is logged on, so live collection needs a shadow copy or a triage tool such as KAPE's WindowsNotificationsDB target; and dismissed or expired notifications are deleted but can often be recovered from free space.

Example

SELECT n.Type, n.ArrivalTime, h.PrimaryId, n.Payload
FROM Notification n
JOIN NotificationHandler h ON n.HandlerId = h.RecordId
ORDER BY n.ArrivalTime;

Run queries like this only on a copy: opening the file in a SQLite tool can checkpoint the WAL.

Drop the database and its WAL on the Windows Notification Parser, and start with the wpndatabase.db guide.