Hello Reader,
I had stopped thinking about the Windows 10 notifications database since I last saw Yogesh Kahtri blog post about it here. I was reviewing a file list produced by an opposing party in a litigation we are working and suddenly saw a directory full of notification images and got curious again.
Since Yogesh first blogged about it the location of the Notification data has changed and it is now located here:
\Users\\AppData\Local\Microsoft\Windows\Notifications
Pictures pushed to the system and displayed in start menu tiles or notifications are stored here:
\Users\\AppData\Local\Microsoft\Windows\Notifications\wpnidm
And the database is now a SQLite database named wpndatabase.db which you can open up with any SQLite tool. I am using Navicat for SQLite because its one of my favorites.
When I did I found the database I went looking to see which table contained the data that I would think is interesting and found a table named Notification, here is the schema:
There are three fields here you should pay attention to the first is the HandlerID which will tell you which program created the notification, you find the name associated in the NotificationHandler table.
The second field is the Payload field, this is the actual contents of the Notification, I was looking through here to see if there was something interesting and found all the Notifications that Outlook had been popping up as I was getting new emails. Here is an example:
Caesars Total Rewards
Win big in August with the play by TR app! Download now!
<http://click.email.caesars-marketing.com/open.aspx?>
Download and log in to be rewarded. View this email with images. <http://view.email.caesar...
I had stopped thinking about the Windows 10 notifications database since I last saw Yogesh Kahtri blog post about it here. I was reviewing a file list produced by an opposing party in a litigation we are working and suddenly saw a directory full of notification images and got curious again.
Since Yogesh first blogged about it the location of the Notification data has changed and it is now located here:
\Users\
Pictures pushed to the system and displayed in start menu tiles or notifications are stored here:
\Users\
And the database is now a SQLite database named wpndatabase.db which you can open up with any SQLite tool. I am using Navicat for SQLite because its one of my favorites.
When I did I found the database I went looking to see which table contained the data that I would think is interesting and found a table named Notification, here is the schema:
There are three fields here you should pay attention to the first is the HandlerID which will tell you which program created the notification, you find the name associated in the NotificationHandler table.
The second field is the Payload field, this is the actual contents of the Notification, I was looking through here to see if there was something interesting and found all the Notifications that Outlook had been popping up as I was getting new emails. Here is an example:
Download and log in to be rewarded. View this email with images. <http://view.email.caesar...
Within the text tags you can see the contents of the new mail notification I received from Outlook.
The last fields to look at are the ExpiryTime and ArrivalTime which record when the notification was received (ArrivalTime) and when it will be deleted from the database (ExpiryTime). These are stored in decimal but if you convert them to Hex you can convert them back to a readable time using the Windows FileTime BigEndian option in Dcode.
So there you go, we can recover the sender, subject and first lines of an email in the notification database even if the email has been purged from the system otherwise. I am going to look further into this to see if there is any other Notifications of interest.
Also Read: Daily Blog #439
Post a Comment