Windows 10 Notifications Blog

Investigating Windows 10 Notifications

20/05/2022 Friday

Windows notifications were first introduced on Windows 8 and continued with Windows 10. The feature provides real-time notifications of a variety of events such as email alerts, apps updates, security alerts, reminders, and other app specific notifications. Windows notifications are usually displayed at the bottom right side of the screen and can be viewed through the “Action Center” icon.

Digital Forensics Value of Windows 10 Notifications Artifacts

Notifications on Windows can hold useful data. Through these notifications we can retrieve valuable details such as the text or content of the notification that was displayed to the user, the date and time when the notification was received, notification expiration date, and other details. This feature enables investigators to track and recover events on the user device even if the source has been deleted.

Location of Windows 10 Notifications Artifacts

On Windows 10 (Anniversary update onwards), notifications are stored at: C:\Users\$username\AppData\Local\Microsoft\Windows\Notifications
Microsoft also stores information about the notifications in NTUSER.DAT registry hive at: Software\Microsoft\Windows\CurrentVersion\PushNotifications

Structure of Windows 10 Notifications Artifacts

The structure of the file containing Windows Notifications artifacts is an SQLite database. The file contains multiple tables recording various notifications and each user account has its own database instance.

Analyzing Windows 10 Notifications Artifacts with ArtiFast Windows

This section will discuss how to use ArtiFast Windows to analyze Windows 10 Notifications on Windows machines and what kind of digital forensic insights we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifacts Selection phase, you can select Windows 10 Notifications Artifacts:

Artifast can analyze Windows 10 Notifications, Thumbnails, Handler, Handler Settings and Backed Up Info. For demonstration purposes, all the artifacts have been chosen; however, you have the option to select one or more artifacts.

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via "Artifact View" or "Timeline View," with indexing, filtering, and searching capabilities. Below is a detailed description of the Windows 10 Notifications Artifacts in ArtiFast software.

Windows 10 Notifications Artifact

This artifact contains information related to user notifications. The details you can view include:

Arrival Date/Time - The date and time when the notification was received.
Expiration Date/Time - The date and time when the notification expires.
Boot Date/Time - The date and time when system boot occurred.
Payload - The content of the notification.
Payload Type - Indicates the type of the notification content.
Handler ID - The ID of the notification handler (which app created the notification).
Activity ID - The ID of the notification activity.
Notification ID - The ID of the notification.
Type - The notification type (badge, tile, toast and raw push notification).
Group - Indicates notification group.
Tag - Notification tag.
Data Version - Notification data version.
Boot ID - Notification boot ID.
Expires On Reboot - Indicates whether the notification expires on reboot.

Windows 10 Notifications BackedUp Info Artifact

This artifact contains backed up information about the notifications. The details you can view include:

Last Write Date/Time - The notification backup entry last write date and time.
Channel Created Date/Time - The date and time when the notification push channel was created.
Channel Expiration Date/Time - The date and time when the notification push channel expires.
Event Name - Indicates Windows notification event name.
Channel ID - Notification push channel ID.
Setting - This attribute is related to Setting Key attribute in Windows 10 Notifications Handler Settings artifact.
Application Type - This attribute is related to Handler Type attribute in Windows 10 Notifications Handler artifact.
Notification ID - The ID of the notification.
Channel URI - Notification push channel URI.

Windows 10 Notifications Handler Artifact

This artifact contains information related to the notification handler. The details you can view include:

Created Date/Time - The date and time when the notification was created.
Event Name - Notification event name.
Handler Type - Notification handler type (app:system, immersive and desktop).
Record ID - Notification record ID.
Service ID - Notification service ID.
Primary ID - Indicates the app which created the notification.
Parent ID - Notification parent ID.
Modified Date/Time - The date and time when the notification entry was modified.

Windows 10 Notifications Handler Settings Artifact

This artifact contains handler settings. The details you can view include:

Handler ID - Notification handler ID.
Channel ID - Notification push channel ID.
Setting Key - Notification settings key (badge, tickle, tile, toast, internet, cloud, storage, audio, VoIP, etc.).
Channel Expiration Date/Time - The date and time when the notification push channel will expire.
Channel Created Date/Time - The date and time when the notification push channel was created.

Windows 10 Notifications Thumbnails Artifact

This artifact contains information related to notifications thumbnails. The details you can view include:

Last Write Date/Time -The notification entry last write date and time.
File Extension - Indicates the extension of the notification thumbnail file.
File Size - Indicates the size of the notification thumbnail file.
AUM ID - The application user model ID.
Local Path - The local path to the notification thumbnail file.
Notification Count - Notification count.
File Name - The name of the notification thumbnail file.
Expiration Date/Time - The date and time when the notification entry expires.
URL - The URL for the notification thumbnail.