Observed arrival · 2026-09-30
Windows Notification Parser
A free browser-based tool for examining Windows notification database files, including their write-ahead logs and older appdb.dat files.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- DFIR investigators examining Windows notification artifacts
- Worth noticing
- Its sample database is explicitly synthetic, and the acquisition guide includes collection paths for KAPE and Velociraptor.
Field notes
The acquisition guide gives a PowerShell method that creates a shadow copy before copying notification databases and their WAL files, so the files come from the same point in time. It also describes KAPE and Velociraptor collection routes. The included sample is identified as synthetic, with a fictional svc_backup account on FIN-WKS-07 and one deleted notification.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue