Parsing Windows 10 Notifications
Windows 10 features notifications, called Toast notifications, which pop up in the bottom right of the screen. These can be set up for a number of different requirements, but are on by default for news relating to application updates and security.
It is possible for users to set up notifications to remind themselves of tasks, as well as events and email alerts. In this chapter, we will look at the usefulness of Windows 10 notifications in forensic investigations, and how to parse them.
Getting ready
Details of notifications are stored in the following location:
\Users\Username\AppData\Local\Microsoft\Windows\Notifications
The name of the database will differ depending on the build version of Windows 10 installed on the machine. From Anniversary onwards, they are stored in wpndatabase.db; before that, they can be found in appdb.dat.
How to do it...
The steps to be followed for parsing Windows 10 notifications are as follows:
- Download a SQLite manager if you do not...
