What Is a Windows Jump List? A Beginner's Guide

A Windows Jump List is a per-application menu of recently used, frequently used, and pinned items that Windows surfaces from the taskbar and Start Menu. Introduced in Windows 7 and unchanged in form through Windows 10 and Windows 11, each Jump List is also a file on disk that records what a user opened with which application, when, and from where.

The UI concept

Right-click any taskbar icon — Notepad, Word, Explorer, Chrome — and the flyout that appears is the Jump List for that app. The same menu shows up next to pinned tiles in the Start Menu. Sections typically include Pinned, Recent, Frequent, and any application-defined groups (for example, Chrome's Most visited, or Word's Recent Documents).

The mechanism is two-sided. Windows itself tracks recent and frequent items for every registered application. The application can also publish its own categories using the ICustomDestinationList shell API. Both end up on disk in the same folder, but in two different file formats.

How Windows builds them

Each application that wants a Jump List registers an AppID — a hash-like identifier such as 1b4dd67f29cb1962. Whenever the user opens a file through that application, the Windows shell records a Windows Shell Link (.lnk) into the corresponding Jump List file. The LNK captures the target path, size, timestamps, volume serial number, and often the NetBIOS hostname and MAC address of the machine where the file was opened.

Two file types

Both file types live under %AppData%\Microsoft\Windows\Recent\ and are named <AppID>.<extension>:

• AutomaticDestinations (*.automaticDestinations-ms) — written by Windows. The container is an OLE Compound File (the same format as legacy .doc). Each numbered stream is an embedded LNK, and a special DestList stream orders them and records per-entry access timestamps, entry IDs, and the source hostname.
• CustomDestinations (*.customDestinations-ms) — written by the application itself. The container is a flat binary blob: a header, then a sequence of LNK structures grouped into named categories, terminated by an 0xBABFFBAB footer.

Practically: AutomaticDestinations is where Windows tells you what the user did. CustomDestinations is where the application tells you what it wanted to show.

What's inside an entry

Decoding a single Jump List entry typically yields:

• The full target path of the file or URL opened.
• File metadata at the time of opening — size, MAC times, attributes.
• The volume serial number and drive type, useful for fingerprinting removable media.
• A TrackerDataBlock containing the machine's NetBIOS name and a MAC-address derived ObjectID.
• For AutomaticDestinations, an access timestamp and access count from the DestList stream.

Together, these turn a Jump List into a per-user timeline of file interaction that survives even after the original file is deleted.

Why it matters for forensics

For a DFIR analyst, Jump Lists answer a question that few other artifacts answer cleanly: which application opened which file, on which host, at which time. They corroborate ShellBags, Recent Items, and Prefetch, and they often preserve references to files on USB drives or network shares that no longer exist. If you want to go past the primer and parse the bytes yourself, the follow-up post on understanding Windows Jump Lists walks through the formats in detail.