Parsing Windows 10 Notifications

Windows 10 features notifications, called Toast notifications, which pop up in the bottom right of the screen. These can be set up for a number of different requirements, but are on by default for news relating to application updates and security.

It is possible for users to set up notifications to remind themselves of tasks, as well as events and email alerts. In this chapter, we will look at the usefulness of Windows 10 notifications in forensic investigations, and how to parse them.

Getting ready

Details of notifications are stored in the following location:

\Users\Username\AppData\Local\Microsoft\Windows\Notifications

The name of the database will differ depending on the build version of...