View past notifications in Windows 10 and 11?

Question

New with Windows 10 seems to be the Notification Area. Now, I've seen a few notifications (in the Action Center). The problem is that I haven't understood any of them (actively using computers for 30 years now), and once I click them they are gone. Is there any way to view these past user notifications so I can try and make some sense out of them?

Answer 1

^{tldr; No there's not.}

The action center is the same as found on the Microsoft Phones running Windows 10 Mobile. These actions (notifications) are meant to be displayed to the user until they take action. There are two ways a user can interact with an action:

1. Dismiss the notification (clears the action)
2. Select the notification (respond to the action)

Once one of these interactions takes place, the notification and therefore the action is no longer displayed. No history is maintained of these notifications and cannot be retrieved. This is done on purpose as that history could (and most likely would) become very large.

If you are worried that the notification has system-wide consequences it could be worth looking into the System logs instead; here separate messages about system events are stored.

---

Update: It appears that some applications will additionally add events into the event viewer. This can be done by:

1. Open Event Viewer
2. Expand Applications and Services Logs
3. Drill down to the app or service you are interested in, e.g. for Windows Defender you might go to: Microsoft -> Windows -> Windows Defender -> Operational log.
4. Review the log and look for the notification you were interested in.

This is NOT the notification history, but additional information provided by the application and as such, there's no guarantee that the notification was logged. It also requires that a user knows which application whose notification they're looking for.

Answer 2

I've found one way to view past notifications, though only very recent ones. In Windows 10, the notifications are stored in \Users\<username>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db as an SQLite database. E.g. using DB Browser for SQLite, it is possible to view the "Notification" table in it, whose "Payload" column contains the notification texts.

Now, this database doesn't actually seem to store notification history, and dismissed notifications are immediately deleted, but there is a trick: since it is an SQLite database with write-ahead logging (WAL), it may be possible to view an earlier version of the database with the relevant notification.

For example, say I accidentally dismissed a notification without being able to read it. In the aforementioned directory, there exists wpndatabase.db file, last modified two hours ago, and wpndatabase.db-wal file, last modified just now. If I copy both files to a different directory and then open wpndatabase.db in DB Browser for SQLite, I will view the latest version of the database, with the relevant notification gone. However, if I copy only the wpndatabase.db file and open it, I will view the snapshot from two hours ago, before I dismissed the notification, so I will be able to view it.

This is the easiest scenario. What if I dismissed the notification hours/days ago, earlier than wpndatabase.db last modified time? Then this means changes will have been incorporated into the database file and it is not possible to view that notification anymore. Conversely, what if both the arrival and dismissal of the notification happened later than wpndatabase.db last modified time? Then the wpndatabase.db file alone will not have it, but it should still be contained in the log at wpndatabase.db-wal. So you need to apply only the first part of the log to the database, before the deletion. I haven't looked at how to do this or if it is easily doable just using DB Browser for SQLite, but I am sure it is in principle possible to do since the .db-wal file is just a log of changes.

Answer 3

You can use a paid Notification Logger app from the Microsoft Store to view past notifications history. I'm the author of this app.

Answer 4

The accepted answer may have been correct at the time, but it is no longer accurate. As mentioned in this answer, Windows stores notifications in an SQLite database. This means there's a good chance you can find the associated write-ahead log file, usually located at %LOCALAPPDATA%\Microsoft\Windows\Notifications\wpndatabase.db-wal.

If you have access to the WAL file, you can upload it to a web app that can open WAL files, such as https://filext.com/file-extension/SQLITE-WAL. While I wouldn't recommend using this site for sensitive data, it's a quick way to view the contents. You can then perform a text search on the readable bytes of the file.

For more advanced analysis, consider using specialized tools like WAL-parser-sqlite, Forensic Toolkit for SQLite, and Belkasoft X.