Series
Windows notification fundamentals
4 posts in this series. Read them in order or jump to any one.
- Windows Notification Forensics: The wpndatabase.db Guide
What the Windows notification database records, where it lives, what it proves and where it stops: a practical guide to wpndatabase.db for DFIR.
- wpndatabase.db Location and Acquisition
Where the Windows notification database lives on Windows 10 and 11, and how to collect it with its -wal file from live systems, images, KAPE or Velociraptor.
- wpndatabase.db Tables and Columns Explained
Field reference for the Windows notification database: Notification, NotificationHandler, HandlerAssets, WNSPushChannel, FILETIME times and the toast XML payload.
- appdb.dat: the Legacy Windows Notification Store
What appdb.dat is, which Windows versions use it, how its fixed chunks hold toasts, tiles and badges, and what you can and cannot get out of it.