DEV Community

Cover image for Cybersecurity 101 : Windows Notifications
hexfloor
hexfloor

Posted on

Cybersecurity 101 : Windows Notifications

#cybersecurity #systemdesign #productivity #architecture

Introduction

So imagine you are focused on your cappuccino-frappuccino doing something very important on you win laptop and then have a cringe attack due to the unknown Phone Link notification :

Complete linking devices
Your PC and mobile device are almost linked.
Click here to continue linking devices.
via Phone Link

Then you switch off bluetooth, wifi, laptop - and you are right.
What to do next ?

Basic checks

Settings -> Bluetooth & devices -> Mobile devices
Settings -> Accounts -> Email & accounts
Inspect recent notifications in Event Viewer

eventvwr.msc
Enter fullscreen mode Exit fullscreen mode 
Applications and Services Logs
 └ Microsoft
    └ Windows
       └ Notifications
Enter fullscreen mode Exit fullscreen mode 
Applications and Services Logs
 └ Microsoft
    └ Windows
       └ Shell-Core
Enter fullscreen mode Exit fullscreen mode

Digital forensics

Windows stores toast notifications in a local database,
hence you need to install sqlite

Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Windows\Notifications"
Enter fullscreen mode Exit fullscreen mode

output :

    Directory: C:\Users\$USERNAME\AppData\Local\Microsoft\Windows\Notifications


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         1/1/2026    0:00 AM                wpnidm
-a----         1/1/2026    0:00 AM        1000000 wpndatabase.db
-a----         1/1/2026    0:00 AM          10000 wpndatabase.db-shm
-a----         1/1/2026    0:00 AM        1000000 wpndatabase.db-wal
Enter fullscreen mode Exit fullscreen mode

wpndatabase.db is a SQLite database.
connect to the database :

sqlite3 "$env:LOCALAPPDATA\Microsoft\Windows\Notifications\wpndatabase.db"
Enter fullscreen mode Exit fullscreen mode

query the Notification table

.headers on
.mode column

SELECT
    Notification.Id,
    Notification.HandlerId,
    Notification.Type,
    Notification.ArrivalTime,
    Notification.Payload
FROM Notification
LIMIT 20;
Enter fullscreen mode Exit fullscreen mode

Then you will have something like :

Id: [REDACTED]
HandlerId: [REDACTED]
Type: toast
ArrivalTime: [REDACTED]

Payload:
<?xml version="1.0"?>
<toast activationType="protocol"
       launch="ms-phone:fre/?cid=[REDACTED]&ref=FreIncompleteToast&reason=IncompleteNotificationsToast">

  <visual>
    <binding template="ToastGeneric">
      <text hint-maxLines="1">Complete linking devices</text>
      <text>Your PC and mobile device are almost linked</text>
    </binding>
  </visual>

</toast>
Enter fullscreen mode Exit fullscreen mode

From here you may see the following :

  • ms-phone: = Phone Link protocol handler
  • fre = First Run Experience
  • IncompleteNotificationsToast = setup reminder system

So Windows is doing this:

“Phone Link is installed, but setup is not completed -> show reminder toast”

Bingo.
❌ No external device was involved
❌ No pairing request happened
❌ No phone initiated anything
This was:
✔ A local Windows notification
✔ Generated by Phone Link app (Microsoft.YourPhone)
✔ Triggered by onboarding logic (FRE = First Run Experience)

Post Mortem

If you don't need it - remove it.
Whether it's Phone Link or any other application.
Settings -> Apps -> Installed apps -> Phone Link -> Advanced options -> Background permissions -> Off

Get-AppxPackage Microsoft.YourPhone | Remove-AppxPackage
Enter fullscreen mode Exit fullscreen mode

That was year 2026 and we had Claude Mythos and at the same time shell scripting, SQL and XML. Interesting time to live.

J’y penserai demain.
Bon vent!

Top comments (0)