Notification History Store

Location

Common Names

Description

Android notification history retains recently dismissed or expired notifications, including the posting app, channel, timestamps, and text fragments depending on OS version and policy. On many devices the same state is visible through NotificationManager dumps in bugreports.

Forensic Value

Notification history can reveal evidence of MFA prompts, messaging previews, banking alerts, email subjects, download notifications, and security warnings that never persisted elsewhere on disk. It is particularly useful for reconstructing what the user saw around the time of compromise and for validating whether a malicious approval request, phish preview, or malware detection alert was presented to the device owner. This artifact often bridges gaps between application content and user awareness.

Tools Required

Collection Commands

adb shell dumpsys notification --noredact > notification_history_dump.txt

adb bugreport /forensics/bugreport.zip

Review SystemUI and bugreport artifacts for notification history content and channel metadata.

Collection Constraints

• •Availability depends on Android version, OEM build, encryption state, privilege level, and whether the collection was logical, rooted, or full-filesystem. OEM-specific builds may move or rename stores.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.
• •Notification retention is short and implementation details vary across Android releases and OEM SystemUI builds. In many cases bugreport or dumpsys output is the most reliable acquisition path.

MITRE ATT&CK Techniques

References