IT Forensics – Windows

Forensic analysis of the Windows Notification Database – notifications as digital evidence

Windows stores a wide range of information about system and application notifications in the Notification Database. Depending on the version of Windows, this may include details of messages received, app notifications and time-based events.

Enquire without obligation

As part of a professional IT forensic investigation, these artefacts are never assessed in isolation. Only by correlating them with event logs, user profiles, registry data, app artefacts and other digital traces is it possible to carry out a reliable technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of the Windows Notification Database, chronological ordering of notifications, correlation with other Windows artefacts, and comprehensive documentation of all investigative steps.

Typical areas of application

•Incident Response
•Reconstruction of user activities
•Malware investigations
•Corporate Forensics
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the relevant databases and artefacts are analysed and cross-referenced with other digital evidence.

Why is the Notification Database important?

It can provide information on the chronological sequence of certain events and user interactions, thereby helping to reconstruct the facts of a case.

Frequently Asked Questions

What information might it contain?+
Depending on the version of Windows, these include, amongst other things, app and system notifications, as well as time-related information.
Are notifications stored permanently?+
Not necessarily. The scope and availability depend on the system configuration and usage.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Is the Notification Database sufficient on its own?+
No. It is always assessed in conjunction with other digital evidence.

🔗 Related topics

LanCologne – Windows Forensics in Cologne

LanCologne helps you carry out a legally admissible analysis of the Windows Notification Database and objectively reconstruct digital events.

Get in touch now