Skip to content
NotificationPARSER

Series

Investigating with Windows notifications

3 posts in this series. Read them in order or jump to any one.

  1. How to Analyze wpndatabase.db in Your Browser

    Step by step: open the Windows notification database and its -wal in a free browser-based parser, triage findings, recover deleted toasts and export CSV, JSON or Timesketch.

  2. Recovering Deleted Windows Notifications

    Why dismissed and expired toasts survive in wpndatabase.db, where SQLite leaves them (freeblocks, freelist, WAL frames) and how to recover them without fooling yourself.

  3. Windows Notifications in an Incident Investigation

    A fictional walkthrough: what one user's notification database adds to an intrusion timeline — a download, an antivirus alert, a new app and a deleted chat message.

All posts in this series

How to Analyze wpndatabase.db in Your Browser
Step by step: open the Windows notification database and its -wal in a free browser-based parser, triage findings, recover deleted toasts and export CSV, JSON or Timesketch.
windows-notificationswpndatabasetoolsdfir

Recovering Deleted Windows Notifications
Why dismissed and expired toasts survive in wpndatabase.db, where SQLite leaves them (freeblocks, freelist, WAL frames) and how to recover them without fooling yourself.
windows-notificationswpndatabasesqliterecovery

Windows Notifications in an Incident Investigation
A fictional walkthrough: what one user's notification database adds to an intrusion timeline — a download, an antivirus alert, a new app and a deleted chat message.
windows-notificationswpndatabaseinvestigationdfir