Jump Lists — Recent File/App Usage

Jump Lists are among the most underutilized forensic artifacts in Windows investigations. They record which files a user opened, which application opened them, and when — with full target file paths, timestamps, and volume serial numbers embedded in LNK stream data. Even after files are deleted and Recycle Bin is emptied, Jump Lists retain the evidence of access.

What Are Jump Lists?

Jump Lists were introduced in Windows 7 as a taskbar feature allowing users to right-click a pinned application and see recently or frequently accessed files. Behind the user interface, Windows maintains two parallel stores of this data: AutomaticDestinations (system-managed) and CustomDestinations (application-managed). Both persist as files on disk and contain rich forensic metadata that survives application closure, file deletion, and system reboots.

Each Jump List file is identified by a 16-character hexadecimal AppID that maps to a specific application. For example, 5f7b5f1e01b83767 maps to Notepad, 1b4dd67f29cb1962 maps to Windows Explorer pinned items, and 12dc1ea8e34b5a6 maps to Microsoft Paint. The AppID is derived from a hash of the application’s path, meaning the same application installed at different paths will produce different AppIDs.

AutomaticDestinations files are OLE Compound File Binary Format (MS-CFB) containers. Each stream within the compound file is a complete LNK (shell link) structure containing the target file path, file size, MAC timestamps (Modified, Accessed, Created), volume information, and in many cases the NetBIOS name of the machine where the target file resides. This means every entry in a Jump List is effectively a full LNK file with all associated metadata.

Location & Format

OLE Compound File Structure

Each AutomaticDestinations file is an OLE Compound File (the same container format used by older Microsoft Office documents). Inside the compound file, each stream is named with a hexadecimal number (e.g., 1, 2, 3, ..., up to DestList). Each numbered stream contains a complete LNK binary structure. The DestList stream is a header structure that contains metadata about each entry: an entry counter, last-access timestamps, pin status, and an access count that records how many times the user opened that particular file through the application.

Common AppID Mappings

Embedded LNK Data

Each stream within an AutomaticDestinations file contains a complete Windows Shell Link (.lnk) binary structure as defined by the MS-SHLLINK specification. This means each Jump List entry contains the same metadata as a standalone LNK shortcut file:

• Target file path — Full path to the file that was opened, including UNC paths for network shares (e.g., \\FILESERVER01\Projects\Q4-Report.xlsx)
• MAC timestamps — Created, Modified, and Accessed timestamps of the target file at the time it was accessed (these are snapshots, not live values)
• File size — Size of the target file at time of access
• Volume serial number — Serial number of the volume where the target file resided, identifying specific drives including removable media
• Volume label and type — Drive label (e.g., “USB_BACKUP”) and type (fixed, removable, network)
• NetBIOS name — Machine name where the target file resides (for network paths)
• Distributed Link Tracking data — Machine ID, volume GUID, and file object ID used by the Distributed Link Tracking service

DestList Stream Metadata

The DestList stream within each AutomaticDestinations file contains per-entry metadata that does not exist in standalone LNK files:

What It Reveals

Jump Lists answer investigative questions that are difficult or impossible to answer with other artifacts alone:

• Which files did a user open with a specific application? — Each AppID maps to one application. The Jump List for that AppID contains every file the user opened through it.
• When was a file last accessed through a specific application? — The DestList Last Recorded Access timestamp provides per-file, per-application access times.
• How many times was a specific file opened? — The DestList Access Count field tracks repeated opens of the same file.
• Did the user access files on removable media? — Volume serial numbers and volume types in the embedded LNK data identify USB drives, external hard drives, and other removable storage — even after the media is disconnected.
• Did the user access files on network shares? — UNC paths and NetBIOS names in the LNK data prove access to specific network resources.
• What were the file’s timestamps at the time of access? — The embedded MAC timestamps are snapshots, allowing investigators to compare file state across multiple access events.
• Was a specific application ever used? — The existence of a Jump List file for an AppID proves the application was used to open files, even if the application has since been uninstalled.
• What was the original filename and path of a deleted file? — Jump List entries retain the full original path after the target file is deleted from disk and even after the Recycle Bin is emptied.

Forensic Use Cases

1. Insider Threat — Unauthorized File Access

An employee under investigation for intellectual property theft claims they never accessed engineering design files. The Jump List for Microsoft Word shows 14 entries pointing to \\ENGSERVER\Designs\{project}\*.docx files with access counts between 2 and 7 each. The DestList timestamps show access concentrated between 21:00 and 23:00 over a two-week period — outside normal working hours. The employee’s browser history and $UsnJrnl have been cleared, but Jump Lists were not targeted.

2. Data Staging on Removable Media

During an IP theft investigation, an employee claims they never used a USB drive at their workstation. The Jump List for WinRAR contains 8 entries pointing to F:\Staging\*.zip with volume type Removable and volume serial number 4A2B-1F8C. The same serial number appears in SYSTEM\MountedDevices mapping to a SanDisk Cruzer device. The Jump List proves both USB usage and the specific files archived to the removable drive.

3. Malware Delivery via Document

A user received a phishing email with a malicious document attachment. The document has been deleted and the email purged from the mailbox. The Jump List for Microsoft Word contains an entry for C:\Users\{user}\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\{hash}\Invoice_Q4_2026.docm. This path is the Outlook temporary attachment cache, proving the document was opened from an email attachment. The embedded MAC timestamps establish precisely when the document was opened, correlating with the malware execution timeline from other artifacts.

4. Remote Desktop Session Reconstruction

The Jump List for mstsc.exe (Remote Desktop Client, AppID bc0c37e84e063727) records every RDP target the user connected to. Each entry contains the server hostname or IP address. In a lateral movement investigation, this proves which internal systems an attacker accessed via RDP, with timestamps and access counts, even after the RDP history in the registry (HKCU\Software\Microsoft\Terminal Server Client) has been cleared.

5. Deleted Application Usage

A user installed a portable file transfer tool, used it to move files, then deleted the application entirely. No Prefetch entry exists because the application was run fewer than the Prefetch threshold, and the executable is gone. However, the Jump List file for the application’s AppID still exists in AutomaticDestinations, containing entries for every file the application accessed. The application’s AppID can be calculated from its known path using the CRC-64 algorithm documented in Jump List research.

Acquisition Methods

Live System — Direct Copy

:: Copy AutomaticDestinations for a specific user
robocopy "C:\Users\jdoe\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" "C:\Evidence\JumpLists\Auto" /COPYALL /E

:: Copy CustomDestinations
robocopy "C:\Users\jdoe\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "C:\Evidence\JumpLists\Custom" /COPYALL /E

:: Collect for ALL user profiles at once
for /d %u in (C:\Users\*) do (
    robocopy "%u\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" "C:\Evidence\JumpLists\%~nu\Auto" /COPYALL /E
    robocopy "%u\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "C:\Evidence\JumpLists\%~nu\Custom" /COPYALL /E
)

Live System — KAPE Collection

:: KAPE target for Jump Lists
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target JumpLists

:: Velociraptor VQL query for Jump Lists
:: Artifact: Windows.KapeFiles.Targets with target "JumpLists"
:: Or: SELECT * FROM glob(globs="C:/Users/*/AppData/Roaming/Microsoft/Windows/Recent/*Destinations/*")

Forensic Image — Direct Extraction

# Mount the forensic image (read-only)
mount -o ro,noexec,nodev /dev/sdb1 /mnt/evidence

# Extract AutomaticDestinations for all users
find /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/ \
    -name "*.automaticDestinations-ms" -exec cp {} /analysis/jumplists/auto/ \;

# Extract CustomDestinations
find /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent/CustomDestinations/ \
    -name "*.customDestinations-ms" -exec cp {} /analysis/jumplists/custom/ \;

Parsing Tools & Analysis

Parsing with JLECmd

:: Parse all AutomaticDestinations files to CSV
JLECmd.exe -d C:\Evidence\JumpLists\Auto --csv C:\Analysis\JumpLists -q

:: Parse a single Jump List file with verbose output
JLECmd.exe -f C:\Evidence\JumpLists\Auto\5f7b5f1e01b83767.automaticDestinations-ms --csv C:\Analysis\

:: Parse CustomDestinations
JLECmd.exe -d C:\Evidence\JumpLists\Custom --csv C:\Analysis\JumpLists_Custom -q

:: Output columns include:
::   SourceFile, AppId, AppIdDescription, DestListVersion,
::   EntryNumber, CreationTime, LastModified, Hostname,
::   TargetCreated, TargetModified, TargetAccessed,
::   FileSize, RelativePath, WorkingDirectory, Arguments,
::   DriveType, VolumeSerialNumber, VolumeName, LocalPath,
::   NetworkPath, InteractionCount

Analysis Script — Identifying Removable Media Access

import pandas as pd

df = pd.read_csv('/analysis/JumpLists/JLECmd_AutomaticDestinations_Output.csv')

# Filter for removable media access
removable = df[df['DriveType'] == 'Removable'].copy()

# Group by volume serial number to identify distinct USB devices
usb_summary = removable.groupby('VolumeSerialNumber').agg(
    VolumeName=('VolumeName', 'first'),
    FileCount=('LocalPath', 'nunique'),
    FirstAccess=('TargetCreated', 'min'),
    LastAccess=('LastModified', 'max'),
    Applications=('AppIdDescription', lambda x: ', '.join(x.unique()))
).sort_values('LastAccess', ascending=False)

print(usb_summary.to_string())

Sample Output

VolumeSerialNumber  VolumeName    FileCount  FirstAccess          LastAccess           Applications
4A2B-1F8C           SANDISK_USB   23         2026-01-15 09:12     2026-03-18 22:41     WinRAR, Windows Explorer, Notepad++
8C3D-7E1A           BACKUP_HDD    7          2026-02-20 14:30     2026-03-01 11:15     Windows Explorer, 7-Zip
1122-AABB           (none)        3          2026-03-10 16:45     2026-03-10 17:02     Windows Explorer

Retention & Persistence

Anti-Forensics Resilience

Jump Lists occupy an intermediate position in anti-forensics resilience. They are more resilient than browser history and Recycle Bin entries, but less resilient than SRUM.db because some cleanup tools do target the Recent directory.

MITRE ATT&CK Detection Mapping

Jump List data provides evidentiary support for detecting the following MITRE ATT&CK techniques:

Related Artifacts & Cross-References

Corroborating Artifacts

References

1. Eric Zimmerman, “JLECmd — Jump List Explorer Command Line” — https://ericzimmerman.github.io/
2. Microsoft, “[MS-SHLLINK]: Shell Link Binary File Format” — https://learn.microsoft.com
3. Harlan Carvey, “Windows Forensic Analysis Toolkit, 4th Edition” — Jump Lists chapter
4. SANS Institute, “Jump List Forensics” — https://www.sans.org/blog/
5. 13Cubed, “Windows Jump Lists for DFIR” — https://www.13cubed.com/blog
6. ForensicArtifacts.com, “Jump Lists Artifact Definition” — https://github.com/ForensicArtifacts/artifacts
7. Microsoft, “[MS-CFB]: Compound File Binary File Format” — https://learn.microsoft.com