Notification database (wpndatabase.db)

What it is

The Windows Push Notification (WPN) platform stores the notifications that apps raise (toasts, tiles and badges) so that Action Center / Notification Center can display them. Each user has a SQLite database, wpndatabase.db, introduced with Windows 10 version 1607. Earlier Windows 10 builds used a custom binary file, appdb.dat.

Notifications carry text that the user saw on screen: e-mail subjects and senders, chat message previews from Teams, Slack, WhatsApp or Signal, calendar reminders, download or security alerts. Because apps copy content into the notification, the database can hold message text that the app itself encrypts or has since deleted.

Location

The database runs in WAL mode: recent and recently deleted entries are frequently only in wpndatabase.db-wal (SQLite WAL).

What it proves

• Content displayed: the text (and sometimes image) of a notification shown to the user, such as a message preview or an e-mail subject.
• Source app: which application or service raised it (PrimaryId of the handler, for example an AppUserModelID).
• Timing: when the notification arrived and when it was due to expire.
• App presence: handler records show which apps registered for notifications on this profile.
• It does not prove the user read or clicked the notification, nor that the app was in the foreground.

Key fields

Other tables include HandlerAssets, NotificationData and TransientTable.

Timestamps

Retention and clearing

• Notifications are short-lived: rows are deleted after ExpiryTime or once the user acknowledges or dismisses them, so the live table often holds only recent items.
• Deleted rows can survive in wpndatabase.db-wal and in SQLite free pages until overwritten; carve them (file carving) and check volume shadow copies.
• Users can turn off notifications per app or globally, in which case no new rows are written for those apps.
• appdb.dat uses fixed chunks (about 256 by default) that are reused, so older entries are overwritten.

Collection

• KAPE target: WindowsNotificationsDB (collects wpndatabase.db* including WAL/SHM, and appdb.dat). PushNotification collects only wpndatabase.db and appdb.dat, without the WAL. Neither covers the system profile database or the wpnidm folder.
• Velociraptor (Windows.Triage.Targets): WindowsNotificationsDB.
• Built-in: the database is held open by the notification service; copy the three files together through a shadow copy (esentutl /y /vss copies any locked file, not only ESE databases).

esentutl.exe /y C:\Users\alice\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db /vss /d E:\case\Notifications\wpndatabase.db
esentutl.exe /y C:\Users\alice\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal /vss /d E:\case\Notifications\wpndatabase.db-wal
esentutl.exe /y C:\Users\alice\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-shm /vss /d E:\case\Notifications\wpndatabase.db-shm
robocopy C:\Users\alice\AppData\Local\Microsoft\Windows\Notifications\wpnidm E:\case\Notifications\wpnidm /E /COPY:DAT

Parsing tools

• SQLECmd (Eric Zimmerman): the WPNDatabase_Notifications map joins notifications to handlers and converts FILETIMEs.
• DB Browser for SQLite: open a working copy with the -wal beside it and read Payload as text.
• Velociraptor: Exchange artifact Windows.Forensics.NotificationsDatabase, or the Generic.Forensic.SQLiteHunter extra.
• Plaso: the windows_push_notification SQLite plugin adds notification and handler events to a super timeline.
• Legacy appdb.dat: Yogesh Khatri's Python script and 010 Editor template.

Investigation tips

• Search Payload for chat previews from Teams or messaging apps: it may hold message text the app has encrypted or wiped.
• Group by PrimaryId to list apps that notified the user, including remote-access tools, VPN clients or cloud storage apps you did not expect.
• Security alerts from Microsoft Defender or third-party tools shown as toasts confirm the user was warned; pair them with the Windows event logs.
• Always parse the WAL: a clean-looking table with a large -wal file often hides recently dismissed or deleted notifications.
• Convert ArrivalTime to UTC and place it on the Windows Timeline and session data to show the user was logged on at that moment.