Blog

Notes on Windows Jump List forensics.

• The AutomaticDestinations-ms File Format Explained

  A byte-level reference for the automaticDestinations-ms file format: OLE Compound File container, numbered LNK streams, and the DestList stream.

  2026-05-25

• How to Clear or Delete Windows Jump Lists

  Three ways to clear, delete, or disable Windows Jump Lists on Windows 10 and 11 — and what each method leaves behind forensically.

  2026-05-25

• The CustomDestinations-ms File Format Explained

  A technical reference for the customDestinations-ms format: how applications build it via ICustomDestinationList and how to parse its concatenated LNK payloads.

  2026-05-25

• Jump List Forensics: A Practical DFIR Walkthrough

  A reproducible DFIR workflow for Jump Lists: target paths, access timestamps, originating hostnames, AppID-to-app mapping, and report-grade citations.

  2026-05-25

• Jump List Parser Tools Compared (2026)

  An honest DFIR comparison of JLECmd, Jumplist Explorer, Jumplist-Browser, and an in-browser Jump List Parser.

  2026-05-25

• What Is a Windows Jump List? A Beginner's Guide

  A Windows Jump List is a per-application list of recently and frequently used items, surfaced from the Start Menu and taskbar since Windows 7.

  2026-05-25

• Where Windows Stores Jump List Files (Win 7, 10, 11)

  The exact on-disk paths for AutomaticDestinations and CustomDestinations Jump List artifacts on Windows 7, 10, and 11.

  2026-05-25

• Understanding Windows Jump Lists

  What Windows Jump List artifacts are, where they live on disk, and why they matter for digital forensics and incident response.

  2026-05-18