Notification Center

Overview

macOS Notification Center stores a history of delivered notifications in a SQLite database. Each notification record includes the delivering application, notification title, subtitle, body text, and delivery timestamp. Notifications from messaging apps, email clients, calendar alerts, and system events are all recorded, providing an independent timeline of application activity and user alerts.

Forensic Significance

File Locations

Database Schema

record table

app table

Notification Data BLOB

The data column contains a binary plist with notification content:

Key Fields for Analysis

Basic Notification History

SELECT
    a.identifier AS app,
    datetime(r.delivered_date + 978307200, 'unixepoch') AS delivered,
    r.presented
FROM record r
JOIN app a ON r.app_id = a.app_id
ORDER BY r.delivered_date DESC
LIMIT 50;

Extract Notification Content

The data blob requires binary plist parsing:

import sqlite3
import plistlib

conn = sqlite3.connect('db')
cursor = conn.execute("""
    SELECT a.identifier, r.delivered_date, r.data
    FROM record r JOIN app a ON r.app_id = a.app_id
    ORDER BY r.delivered_date DESC LIMIT 20
""")

for app, ts, data in cursor:
    try:
        plist = plistlib.loads(data)
        title = plist.get('titl', plist.get('title', ''))
        body = plist.get('body', '')
        print(f"{app}: {title} - {body}")
    except:
        pass

Timestamps

Notification Center uses Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC).

Analysis Notes

• Message previews: Notifications from Messages, WhatsApp, Slack, and other messaging apps often include message preview text. This content may persist in the notification database even after the original message is deleted.
• Email subject lines: Mail.app notifications include email subjects and sender names, providing an email activity timeline independent of the Envelope Index.
• Notification preferences: The com.apple.ncprefs.plist file reveals which apps the user has configured for notifications and their alert style, indicating which apps the user actively monitors.
• Retention: Notification records are periodically pruned. The retention period varies by macOS version and notification volume.
• Binary plist content: The notification data column requires binary plist parsing. Not all fields are present in every notification.
• App identification: The identifier field in the app table maps to application bundle IDs, enabling identification of the source application.

Version Differences

Tool Support

References

• macOS Notification Center Forensics (Kieczkowska)
• SANS FOR518: Mac and iOS Forensic Analysis