<SYSTEMDRIVE>:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\<APP_ID>.automaticDestinations-ms
CustomDestinations:
<SYSTEMDRIVE>:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\<APP_ID>.customDestinations-ms
Overview
Introduced in Windows 7
, Jumplists
are linked to a taskbar user
experience-enhancing feature that allows users to “jump” to files, folders
or others elements by right-clicking on open applications in the Windows
taskbar
. The Windows Explorer
’s Quick Access
feature also stores entries
in Jumplists
.
Two forms of Jumplists
are created:
-
automatic entries for recently accessed items, stored in
*.automaticDestinations-ms
files. -
custom entries in
*.customDestinations-ms
files for items manually “pinned” elements (by users or the applications themselves) to theWindows taskbar
or an application’sJumplist
.
Each application AutomaticDestinations
and CustomDestinations
JumpLists
information are thus stored in two unique and separated files, of different
format:
-
AutomaticDestinations
JumpLists
files are stored asAUTOMATICDESTINATIONS-MS
file, in theMS OLE Structured Storage
format. This file format notably contains aDestList
stream that acts as aMost Recent Used (MRU)
list ofshortcut files (.LNK)
. Each entry in an applicationAutomaticDestinations
JumpList
is stored as an entry in theDestList
stream, composed of metadata and aLNK
-like structure. -
CustomDestinations
JumpLists
are stored asCUSTOMDESTINATIONS-MS
file, also assimilable to a series ofshortcut files
.
Applications may handle Jumplists
differently, with different entries being
created / updated on different actions by specific applications.
Information of interest
As JumpLists
are linked to an application, through an AppId
, knowledge of
the application that was used to open the files can be deducted if the
application associated to the AppId
is known. A number of AppId
are
documented in
EricZimmerman
‘s JumpList
GitHub repository.
JumpLists
hold information similar in nature to shortcut files
for each
file referenced in an application’s AutomaticDestinations
/
CustomDestinations
JumpLists
:
-
the target file’s absolute path, size and attributes (hidden, read-only, etc.).
-
the target file
Modified, Access, and Birth
timestamps, updated whenever the file is “jumped” to. -
the number of times the target file was “jumped” to.
-
Whether the target file was stored locally or on a remote network share through the specification of a
LocalPath
orNetworkPath
. -
For
AutomaticDestinations
JumpLists
(only), each entry is also associated with two additional timestamps: the created and last modified timestamps of the entry in theDestList
stream. The last modified timestamp is updated whenever the entry is interacted with (file opened,RDP
session established, etc.). The created timestamp does not however appear to be reliable. -
Occasionally information on the volume that stored the target file: drive type (fixed vs removable storage media), serial number, and label / name if any.
-
Occasionally information on the host on which the shortcut file is present: system’s NetBIOS hostname and MAC address.
The timestamps of the AutomaticDestinations
and CustomDestinations
JumpList
files themselves can be an indicator of when the application
associated with the JumpList
file was interacted with, depending on how the
application handles and makes use of JumpLists
:
-
The birth timestamp of the
JumpList
files can be an indicator of when the application was first executed (by the user associated with theJumpList
files), if the application automatically populatesJumpList
items upon its first launch. -
The last write timestamp is an indicator of when the
AutomaticDestinations
orCustomDestinations
JumpLists
were last updated. For applications that automatically and regularly update theirJumpLists
, this can be an indicator of when the application was last used (by the user associated with theJumpList
files).
Specific applications may define custom JumpLists
entries that store
information of forensic interest. For example, the Google Chrome
and
Microsoft Edge
web browsers store the recently closed tabs in their
respective CustomDestinations
JumpLists
.
Remote Desktop Connection mstsc.exe
Remote desktop connections made using the Windows built-in
Microsoft Terminal Server Client
client (mstsc.exe
)
will generate an entry in the AutomaticDestinations
JumpList
. An entry is
only created / updated if the RDP
session was successfully authenticated and
established (even if Network Level Authentication (NLA)
is disabled). The
entries will be associated with the application identifier 1bc392b8e104a00e
.
The DestList
last modified timestamp indicates the last time the connection
with the remote host was successfully established.
The arguments in the entry for a given connections will reference the remote
host by hostname or IP address (/v:"<HOSTNAME | IP>"
) or the RDP File
used
for the connection ("<PATH>\<FILE>.rdp"
).
Tool(s)
Eric Zimmerman’s JumpListExplorer
and JLECmd
tools can be used to
process JumpLists
files.
Associated KAPE
compound module: JLECmd
.
# Parses the specified JumpLists file.
JLECmd.exe [-q --csv <CSV_DIRECTORY_OUTPUT>] -f <JUMPLIST_FILE>
# Recursively retrieves and parses the JumpLists files in the specified directory.
JLECmd.exe [-q --csv <CSV_DIRECTORY_OUTPUT>] -d <C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent\ | C:\ | DIRECTORY>
References
View on GitHub