A Digital Forensic View of Windows 10 Notifications

Abstract

Windows Push Notifications (WPN) is a relevant part of Windows 10 interaction with the user. It is comprised of badges, tiles and toasts. Important and meaningful data can be conveyed by notifications, namely by so-called toasts that can popup with information regarding a new incoming email or a recent message from a social network. In this paper, we analyze the Windows 10 Notification systems from a digital forensic perspective, focusing on the main forensic artifacts conveyed by WPN. We also briefly analyze Windows 11 first release’s WPN system, observing that internal data structures are practically identical to Windows 10. We provide an open source Python 3 command line application to parse and extract data from the Windows Push Notification SQLite3 database, and a Jython module that allows the well-known Autopsy digital forensic software to interact with the application and thus to also parse and process Windows Push Notifications forensic artifacts. From our study, we observe that forensic data provided by WPN are scarce, although they still need to be considered, namely if traditional Windows forensic artifacts are not available. Furthermore, toasts are clearly WPN’s most relevant source of forensic data.

Digital Forensics Security for Communications Transmission by Encrypting and Decrypting Characteristics with One-Time Key Authorization

“…By utilizing the deliverables identity-based broadcast encryption system, the KP-ABE approach creates a constant cypher text size. This makes it possible to express the access strategy with any form of repetitive access structure [10]. The amount of bilinear pairing is regarded as constant while cypher text size is self-governing to the number of cypher text attributes.…”

Cloud Forensic Artefacts: Digital Forensics Registry Artefacts discovered from Cloud Storage Application

“…Some cloud service providers such as OneDrive, Azure, Google Drive, Alibaba, and IBM Cloud are well-known cloud storage applications that offer a variety of security options to protect user's data as well as user privacy [20]. OneDrive may be given high priority [21]. After OneDrive, the use of Google Drive should be considered a high priority if there is a possibility that an issue would arise regarding the safety of any reputable organization's email communications.…”