Blog

Notes on Windows Jump List forensics.

• Jump List AppIDs: What They Are and How to Resolve One

  The AppID is the Jump List filename, and it is a hash, not a name. How the CRC-64 is derived, why you resolve by lookup not computation, and what an unknown AppID is worth in an investigation.

  2026-06-15

• Jump Lists From the Attacker's Side: Recon, Spoofing, Cleanup

  What an adversary actually does with Jump Lists. Reading them for targeting, planting misleading entries, the limits of using them for persistence, and what each move leaves behind for the defender.

  2026-06-15

• Building a Jump List Timeline When Someone Tried to Hide It

  How to reconstruct a defensible timeline from DestList MRU ordering, and how to spot deleted entries, forged timestamps, and a cleared Jump List for what it is.

  2026-06-15

• Jump Lists vs ShellBags vs Prefetch: Which Artifact Answers What

  Three different questions, three different artifacts. A working analyst's guide to what Jump Lists, ShellBags, Prefetch, and Recent LNK files each prove, where they overlap, and where each one is blind.

  2026-06-15

• Parsing AutomaticDestinations in Python the Hard Way

  Opening the OLE compound file, walking the DestList stream, decoding the embedded LNKs and converting FILETIME, with the version-skew and locking gotchas that break naive scripts.

  2026-06-15

• The AutomaticDestinations-ms File Format Explained

  A byte-level reference for the automaticDestinations-ms file format: OLE Compound File container, numbered LNK streams, and the DestList stream.

  2026-05-25

• How to Clear or Delete Windows Jump Lists

  Three ways to clear, delete, or disable Windows Jump Lists on Windows 10 and 11, and what each method actually leaves behind forensically.

  2026-05-25

• The CustomDestinations-ms File Format Explained

  A technical reference for the customDestinations-ms format: how applications build it via ICustomDestinationList and how to parse its concatenated LNK payloads.

  2026-05-25

• Jump List Forensics: A Practical DFIR Walkthrough

  A reproducible DFIR workflow for Jump Lists: target paths, access timestamps, originating hostnames, AppID-to-app mapping, and report-grade citations.

  2026-05-25

• Jump List Parser Tools Compared (2026)

  A DFIR practitioner's comparison of JLECmd, JumpListExplorer, Jumplist-Browser, and an in-browser Jump List Parser.

  2026-05-25

• What Is a Windows Jump List? A Beginner's Guide

  A Windows Jump List is a per-application list of recently and frequently used items, surfaced from the Start Menu and taskbar since Windows 7.

  2026-05-25

• Where Windows Stores Jump List Files (Win 7, 10, 11)

  The exact on-disk paths for AutomaticDestinations and CustomDestinations Jump List artifacts on Windows 7, 10, and 11.

  2026-05-25

• Understanding Windows Jump Lists

  What Windows Jump List artifacts are, where they live on disk, and why they matter for digital forensics and incident response.

  2026-05-18