Forensic Analysis of Android Notifications' History

Mobile device notifications may reveal a lot about the device user. These pieces of information can indicate the user's recent actions, communication partners, and more. Therefore, notifications are an important yet underutilized source of evidence in digital investigations. In this study, the authors investigate the Android ‘Notification History’ feature. Available since Android 11, this feature tracks notifications and maintains a 24-hour notification history, if enabled by the user. The authors identified forensic artifacts associated with this feature, such as the protocol buffer files that include the recorded notifications and their contents, and demonstrated how these can be leveraged. Furthermore, since these files are not yet efficiently parsed by advanced commercial and open-source forensic tools, the authors developed relevant Python parsers to process and interpret these crucial forensic artifacts. These parsers were integrated into 'Android Logs Events And Protobuf Parser (ALEAPP)‘, an open-source forensic tool, thereby extending its capabilities.