Blog
Notes on Windows Jump List forensics.
The AutomaticDestinations-ms File Format Explained
A byte-level reference for the automaticDestinations-ms file format: OLE Compound File container, numbered LNK streams, and the DestList stream.
2026-05-25
How to Clear or Delete Windows Jump Lists
Three ways to clear, delete, or disable Windows Jump Lists on Windows 10 and 11 — and what each method leaves behind forensically.
2026-05-25
The CustomDestinations-ms File Format Explained
A technical reference for the customDestinations-ms format: how applications build it via ICustomDestinationList and how to parse its concatenated LNK payloads.
2026-05-25
Jump List Forensics: A Practical DFIR Walkthrough
A reproducible DFIR workflow for Jump Lists: target paths, access timestamps, originating hostnames, AppID-to-app mapping, and report-grade citations.
2026-05-25
Jump List Parser Tools Compared (2026)
An honest DFIR comparison of JLECmd, Jumplist Explorer, Jumplist-Browser, and an in-browser Jump List Parser.
2026-05-25
What Is a Windows Jump List? A Beginner's Guide
A Windows Jump List is a per-application list of recently and frequently used items, surfaced from the Start Menu and taskbar since Windows 7.
2026-05-25
Where Windows Stores Jump List Files (Win 7, 10, 11)
The exact on-disk paths for AutomaticDestinations and CustomDestinations Jump List artifacts on Windows 7, 10, and 11.
2026-05-25
Understanding Windows Jump Lists
What Windows Jump List artifacts are, where they live on disk, and why they matter for digital forensics and incident response.
2026-05-18