If you're investigating a Windows endpoint and you're not checking wpndatabase.db, you're leaving evidence on the table. This artifact deserves a permanent spot in every Windows triage checklist.
The Windows Push Notification Database, wpndatabase.db, is an SQLite database used by Windows 10 and Windows 11 to manage and store system and application notifications.
Every time a toast notification slides out from the bottom-right corner of the screen, or a notification lands in the Action Center, Windows logs the details of that alert into this database. It's the operating system's own notification history, sitting quietly on disk.
C:\Users\<Username>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.dbIt's a standard SQLite database, so you don't need anything exotic to open it. DB Browser for SQLite and SQLiteStudio both work fine for manual inspection, and tools like Autopsy and Magnet AXIOM will parse it automatically as part of a full case load.
The database has several tables, but two matter most: Notification and NotificationHandler. Between them, you get:
Since wpndatabase.db is a standard SQLite file, you don't need specialized forensic software to open it.
For casework at scale, tools like Autopsy or Magnet AXIOM will parse this automatically and lay it out alongside your other artifacts, which saves you from digging through raw XML by hand.
It captures web-based apps. A lot of users run messaging apps through the browser instead of a native client: WhatsApp Web, Telegram Web, Discord in a tab. Web apps like these usually don't leave local chat logs on disk the way a native client would. But when a message comes in, the browser still fires a desktop notification, and Windows still logs it. wpndatabase.db ends up holding message content that exists nowhere else on the machine.
It recovers ephemeral or deleted data. A user can delete a message on their phone the second after reading it. Doesn't matter. If a notification already fired on the desktop, the text is sitting in this database, untouched by whatever the user did afterward on their device.
It logs system-level events. Malware detections, USB insertions, and other OS-level alerts get written here too. Even if someone wipes the Defender logs, the notification that Defender fired may still be sitting in the notification database.
For an artifact most people never think to check, that's a lot of coverage.
Picture an investigation where the suspect never installed a messaging app locally. They used the web version through their browser instead. There's no native chat database to pull, no local cache sitting in AppData for the app itself.
But the moment a new message arrived, the browser fired a desktop notification, and Windows logged it straight into wpndatabase.db, payload and all.
Querying the database recovered the exact notification text, including details that would otherwise have been lost the second the message was read or deleted. That single entry, pulled from a database most people never open, was enough to move the investigation forward.
This is where wpndatabase.db carries a case. No native client footprint, no local chat log to parse. Just a browser tab and a notification Windows was quietly logging the whole time.
If your triage process skips notification artifacts because they seem like a minor UX feature, it's time to reconsider. wpndatabase.db doesn't just tell you an app sent an alert. It can hand you the actual message content behind that alert, including passwords, filenames, and links that never touched a traditional log. On a machine where the suspect used web apps instead of native clients, this database might be the only record of what was actually said.
Check it early. It might be the artifact that breaks your case.